[Samba] Does Samba attempt Anonymous logon to IPC$ shares? Can this lockout accounts?!?
lceamdx at hotmail.com
Thu Dec 19 14:18:01 GMT 2002
Hopefully someone can put my mind at ease...
I have about 10 W2K boxes with account lockout threshold of 5 failed logins
and Additional Restrictions for Anonymous Connections set to 'No access w/o
explicit anon. permissions' (Administrative Tools -> Security Settings ->
Local Policies -> Security Options)
I've set up a Samba server this week and in the past few days I've noticed
that some user accounts have been locked out (and its not just people
forgetting their password).
In /etc/samba/MACHINEONE.log I've got entries like this:
[2002/12/17 18:17:56, 0]
connect to client: machine MACHINEONE rejected the tconX on the IPC$ share.
Error was : NT_STATUS_ACCESS_DENIED.
And in the W2K Security Audit for MACHINETWO, I've got:
Success Audit 18/12/2002 18:55:57 Source:Security Category:Logon/Logoff
Event:538 User:ANONYMOUS LOGON Computer:MACHINETWO
Unfortunately, I can't match up these two event types on a single machine
because the logs and audits are incomplete (I've been switching the smbd log
level and auditing isn't enabled on MACHINEONE )
I just want to be able to track down the cause of this...
MSN 8 helps eliminate e-mail viruses. Get 2 months FREE*.
More information about the samba