R: [Samba] unauthorized acess attempt
Gianluca Culot
gianlucaculot at dmsware.com
Wed Dec 19 09:15:45 GMT 2007
The dovecot logs to syslog to the /var/log/maillog
# Syslog facility to use if you're logging to syslog. Usually if you don't
# want to use "mail", you'll use local0..local7. Also other standard
# facilities are supported.
syslog_facility = mail
And in SYSLOG.CONF
mail.* /var/log/maillog
The message I reported in taken from /var/log/maillog
So... Actualy I do not receive any Error message from dovecot...
Looks like dovecot rely on the error message of winbind and doesn't log any
more message...
Possible?
Strange ?
> -----Messaggio originale-----
> Da: samba-bounces+gianlucaculot=dmsware.com at lists.samba.org
> [mailto:samba-bounces+gianlucaculot=dmsware.com at lists.samba.or
> g] Per conto di samba at piven.org
> Inviato: sabato 15 dicembre 2007 15.16
> A: 'Samba at Lists. Samba. Org'
> Oggetto: Re: [Samba] unauthorized acess attempt
>
> Gianluca Culot wrote:
> > Hello list
> >
> > I'm facing a little security problem
> >
> > I get A LOT (3 a minute) a such a message
> >
> > mail dovecot-auth: pam_winbind(dovecot): request failed: No such
> > user, PAM error was unknown user (13), NT error was
> > NT_STATUS_NO_SUCH_USER
> >
> > I'd like to know which is the user name used in such
> attempts How can
> > I get such info without raising log level to an inacceptable level
> > (which would cause my log file to explode !?! )
>
> Have you looked at your dovecot logs to see who's trying to
> login at that time?
>
> Don Piven
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/listinfo/samba
>
More information about the samba
mailing list