R: [Samba] unauthorized acess attempt

[Gianluca Culot]

 I'M SORRY

The log file is MESSAGES

/var/log/messages

AND NOT /var/log/maillog... As I reported in my last email !
Actually there is no error message in /var/log/maillog

> -----Messaggio originale-----
> Da: samba-bounces+gianlucaculot=dmsware.com at lists.samba.org 
> [mailto:samba-bounces+gianlucaculot=dmsware.com at lists.samba.or
> g] Per conto di Gianluca Culot
> Inviato: mercoledì 19 dicembre 2007 10.16
> A: samba at piven.org; 'Samba at Lists. Samba. Org'
> Oggetto: R: [Samba] unauthorized acess attempt
> 
> The dovecot logs to syslog to the /var/log/maillog 
> 
> # Syslog facility to use if you're logging to syslog. Usually 
> if you don't # want to use "mail", you'll use local0..local7. 
> Also other standard # facilities are supported.
> syslog_facility = mail
> 
> And in SYSLOG.CONF
> mail.*                                          /var/log/maillog
> 
> The message I reported in taken from /var/log/maillog
> 
> So... Actualy I do not receive any Error message from dovecot...
> Looks like dovecot rely on the error message of winbind and 
> doesn't log any more message...
> Possible?
> Strange ?
> 
> > -----Messaggio originale-----
> > Da: samba-bounces+gianlucaculot=dmsware.com at lists.samba.org
> > [mailto:samba-bounces+gianlucaculot=dmsware.com at lists.samba.or
> > g] Per conto di samba at piven.org
> > Inviato: sabato 15 dicembre 2007 15.16
> > A: 'Samba at Lists. Samba. Org'
> > Oggetto: Re: [Samba] unauthorized acess attempt
> > 
> > Gianluca Culot wrote:
> > > Hello list
> > >  
> > > I'm facing a little security problem
> > >  
> > > I get A LOT (3 a minute) a such a message
> > >  
> > >  mail dovecot-auth: pam_winbind(dovecot): request failed: No such 
> > > user, PAM error was unknown user (13), NT error was 
> > > NT_STATUS_NO_SUCH_USER
> > > 
> > > I'd like to know which is the user name used in such
> > attempts How can
> > > I get such info without raising log level to an 
> inacceptable level 
> > > (which would cause my log file to explode !?! )
> > 
> > Have you looked at your dovecot logs to see who's trying to 
> login at 
> > that time?
> > 
> > Don Piven
> > --
> > To unsubscribe from this list go to the following URL and read the
> > instructions:  https://lists.samba.org/mailman/listinfo/samba
> > 
> 
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/listinfo/samba
>