Auditin NT Logins

[Peter Samuelson]

[Jonathan W Miner]
> I'm using samba-2.0.6 on a Solaris 2.5.1 server.  Is there any way to
> log NT logins in the same manner that UNIX logins are logged?

2.0.7, when it is released, will have support for the `utmpx' variant
of utmp/wtmp.  Assuming Solaris uses `utmpx', which I don't remember (I 
haven't used Solaris since 1994), this sounds like what you want.  If
you want to try it out and see, 2.0.7pre1 is out already.

I don't know about logging unsuccessful logins to syslog -- whether
this would even be a good idea.  Windows machines often try two
different sets of credentials in what is eventually a successful login,
so you could get a *lot* of false positives).  I don't know the details
of this -- which clients do this or why.

Peter