Authentication failure

[Andrew Bartlett]

Edward Dekkers wrote:
> 
> I'm getting a lot of:
> 
> Security Violations
> =-=-=-=-=-=-=-=-=-=
> Oct 25 07:19:21 server PAM_unix[24792]: authentication failure; (uid=0) ->
> floraplant for samba service
> Oct 25 07:26:02 server PAM_unix[24803]: authentication failure; (uid=0) ->
> floraplant for samba service
> 
> Unusual System Events
> =-=-=-=-=-=-=-=-=-=-=
> Oct 25 07:19:21 server PAM_unix[24792]: authentication failure; (uid=0) ->
> floraplant for samba service
> Oct 25 07:26:02 server PAM_unix[24803]: authentication failure; (uid=0) ->
> floraplant for samba service
> 
> all day every day for every user. It does not seem to affect usability at
> all, but it is annoying to have these messages come up every time. A search
> on Google turned up a patch for Samba 1.19-p18 to fix this. I'm using RedHat
> 6.2 with all updates and Samba 2.0.10. Was this patch actually applied? How
> do I get rid of this stuff?
> 
> P.S. Someone on the RedHat list suggested it something to do with case
> mangling of user names - but I don't know how to circumvent that either.

Case sensitivity in PASSWORDS.  Unfortunetly some brain-dead code in
Windows forces all passwords to UPPER CASE before sending them over the
wire.  Samba must then try all case combinations (as directed by the
password level paramater) till it finds a correct password.  When
compiled --with-pam, this means that we make a number of (audited) calls
to the pam library.  While this *may* have been quieted down in more
recent versions (by telling PAM not to log) the basic problem can only
be resolved with 'encrypt passwords = yes'.

Andrew Bartlett 

-- 
Andrew Bartlett                                 abartlet at pcug.org.au
Samba Team member, Build Farm maintainer        abartlet at samba.org
Student Network Administrator, Hawker College   abartlet at hawkerc.net
http://samba.org     http://build.samba.org     http://hawkerc.net