[Samba] multiple users from the same machine?
Chris Garrigues
cwg-dated-1095176286.a25750 at Trinsics.Com
Thu Sep 9 15:38:06 GMT 2004
I'm concerned about the machine known as accountingii in the below smbstatus:
Samba version 3.0.5pre2-SVN-build-1326
PID Username Group Machine
-------------------------------------------------------------------
2727 bbeerman users bbeerman1 (10.2.240.172)
30957 llawrence users df2x1121 (10.2.240.190)
28942 btalbot users dc2x1121 (10.2.240.174)
7750 btalbot users accountingii (10.2.240.147)
30607 mmerriam users marklaptop2 (10.2.240.185)
10434 btalbot users accounting3 (10.2.240.131)
7750 kpotts users accountingii (10.2.240.147)
31273 bjames users product1 (10.2.240.173)
7750 btalbot users accountingii (10.2.240.147)
31394 mlugo users border01 (10.2.240.188)
1566 btalbot users accountingiii (10.2.240.134)
Service pid machine Connected at
-------------------------------------------------------
pfw-import 2727 bbeerman1 Thu Sep 9 09:52:03 2004
accounting 1566 accountingiii Thu Sep 9 09:00:41 2004
accounting 2727 bbeerman1 Thu Sep 9 09:52:03 2004
IPC$ 10434 accounting3 Tue Sep 7 08:04:04 2004
IPC$ 7750 accountingii Fri Sep 3 16:41:57 2004
local-soft 2727 bbeerman1 Thu Sep 9 09:52:03 2004
accounting 30957 df2x1121 Thu Sep 9 06:35:26 2004
IPC$ 30607 marklaptop2 Thu Sep 9 06:12:19 2004
kpotts 7750 accountingii Thu Sep 9 09:45:41 2004
accounting 7750 accountingii Thu Sep 9 09:45:54 2004
software 2727 bbeerman1 Thu Sep 9 09:52:03 2004
IPC$ 28942 dc2x1121 Tue Aug 17 10:43:43 2004
bbeerman 2727 bbeerman1 Thu Sep 9 09:51:17 2004
mmerriam 30607 marklaptop2 Thu Sep 9 06:11:44 2004
groups 2727 bbeerman1 Thu Sep 9 09:52:03 2004
software 1566 accountingiii Thu Sep 9 09:00:41 2004
mlugo 31394 border01 Thu Sep 9 07:02:53 2004
btalbot 1566 accountingiii Thu Sep 9 09:00:32 2004
IPC$ 7750 accountingii Thu Sep 9 08:40:18 2004
HumanResou 7750 accountingii Thu Sep 9 09:45:40 2004
IPC$ 1566 accountingiii Thu Sep 9 09:01:03 2004
accounting 31394 border01 Thu Sep 9 07:03:04 2004
bjames 31273 product1 Thu Sep 9 06:52:07 2004
llawrence 30957 df2x1121 Thu Sep 9 06:35:07 2004
Locked files:
Pid DenyMode Access R/W Oplock Name
--------------------------------------------------------------
1566 DENY_WRITE 0x2019f RDWR NONE /export/accounting/GLedger/Border/BETBINV.XLS Thu Sep 9 10:20:48 2004
31273 DENY_NONE 0x2019f RDWR EXCLUSIVE+BATCH /home/bjames/My Documents/Product/Price Protection/VPD price protection (master list) 04.xls Thu Sep 9 10:16:59 2004
1566 DENY_NONE 0x2019f RDWR NONE /export/accounting/GLedger/Alaska/COGS/COGS0804.xls Thu Sep 9 10:20:29 2004
31273 DENY_NONE 0x2019f RDWR EXCLUSIVE+BATCH /home/bjames/My Documents/Product/Game Buys/September/gamebuySEP.2004.xls Thu Sep 9 07:07:41 2004
You'll note that it claims that btalbot is logged on twice and kpotts once
from the same machine. ps shows that PID 7750 is owned by kpotts:
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
kpotts 7750 0.0 3.0 10564 3788 ? S Sep03 1:33 /usr/sbin/smbd3 -
What triggered us to notice this was that btalbot was having errors on one of
the other machines in accessing an excel file (she wasn't specific on what
happened; she thought "the same problem we had before" was a good enough
description ~sigh~).
An investigation into the event log on accountingii showed that this morning
at 9:30 there was an error with the printer that claimed the user was btalbot
although kpotts was logged in at the time!
Chris
--
Chris Garrigues http://www.DeepEddy.Com/~cwg/
Trinsic Solutions http://www.trinsics.com
1611-B West 6th Street
Austin, TX 78703-5074 512-322-0180
If you don't apply what you've learned, you haven't
learned anything.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 235 bytes
Desc: not available
Url : http://lists.samba.org/archive/samba/attachments/20040909/d2ceef09/attachment.bin
More information about the samba
mailing list