MONITORING user's file activity in SAMBA (2.0.7)

Andrew Bartlett abartlet at
Fri Oct 5 19:16:02 GMT 2001

Oliver Thieke wrote:
> Hi out there at the screens !
> I'm trying to establish more security on a
> samba-based File-Server (on solaris 2.6,
> samba version 2.0.7).
> The system is screwed up in terms of security,
> but I can't change that in the short run. But I
> want to be able - at least - to track down the
> "bad guy" in case of emergency :-).
> My goal is to figure out which client computer
> issued a specific file/dir deletion on the
> samba-server. The problem is: every client
> machine uses the same user name to logon to
> the shares (as I wrote: screwed-up-architecture).

Fix the architecture.  Once you have done that, and users using their
own logins, then look into the audit vfs example module (may require
coding for your particular situation).

> Can you give me any pointers ?
> Thanx for your help in advance from a dusky Berlin
> Oliver Thieke

Andrew Bartlett                                 abartlet at
Samba Team member, Build Farm maintainer        abartlet at
Student Network Administrator, Hawker College   abartlet at

More information about the samba mailing list