MONITORING user's file activity in SAMBA (2.0.7)

[Andrew Bartlett]

Oliver Thieke wrote:
> 
> Hi out there at the screens !
> 
> I'm trying to establish more security on a
> samba-based File-Server (on solaris 2.6,
> samba version 2.0.7).
> The system is screwed up in terms of security,
> but I can't change that in the short run. But I
> want to be able - at least - to track down the
> "bad guy" in case of emergency :-).
>
> My goal is to figure out which client computer
> issued a specific file/dir deletion on the
> samba-server. The problem is: every client
> machine uses the same user name to logon to
> the shares (as I wrote: screwed-up-architecture).

Fix the architecture.  Once you have done that, and users using their
own logins, then look into the audit vfs example module (may require
coding for your particular situation).

--snip--
 
> Can you give me any pointers ?
> 
> Thanx for your help in advance from a dusky Berlin
> 
> Oliver Thieke

-- 
Andrew Bartlett                                 abartlet at pcug.org.au
Samba Team member, Build Farm maintainer        abartlet at samba.org
Student Network Administrator, Hawker College   abartlet at hawkerc.net
http://samba.org     http://build.samba.org     http://hawkerc.net