[Samba] multiple users from the same machine?

[Chris Garrigues]

I'm concerned about the machine known as accountingii in the below smbstatus:

Samba version 3.0.5pre2-SVN-build-1326
PID     Username      Group         Machine                        
-------------------------------------------------------------------
 2727   bbeerman      users         bbeerman1    (10.2.240.172)
30957   llawrence     users         df2x1121     (10.2.240.190)
28942   btalbot       users         dc2x1121     (10.2.240.174)
 7750   btalbot       users         accountingii (10.2.240.147)
30607   mmerriam      users         marklaptop2  (10.2.240.185)
10434   btalbot       users         accounting3  (10.2.240.131)
 7750   kpotts        users         accountingii (10.2.240.147)
31273   bjames        users         product1     (10.2.240.173)
 7750   btalbot       users         accountingii (10.2.240.147)
31394   mlugo         users         border01     (10.2.240.188)
 1566   btalbot       users         accountingiii (10.2.240.134)

Service      pid     machine       Connected at
-------------------------------------------------------
pfw-import    2727   bbeerman1     Thu Sep  9 09:52:03 2004
accounting    1566   accountingiii  Thu Sep  9 09:00:41 2004
accounting    2727   bbeerman1     Thu Sep  9 09:52:03 2004
IPC$         10434   accounting3   Tue Sep  7 08:04:04 2004
IPC$          7750   accountingii  Fri Sep  3 16:41:57 2004
local-soft    2727   bbeerman1     Thu Sep  9 09:52:03 2004
accounting   30957   df2x1121      Thu Sep  9 06:35:26 2004
IPC$         30607   marklaptop2   Thu Sep  9 06:12:19 2004
kpotts        7750   accountingii  Thu Sep  9 09:45:41 2004
accounting    7750   accountingii  Thu Sep  9 09:45:54 2004
software      2727   bbeerman1     Thu Sep  9 09:52:03 2004
IPC$         28942   dc2x1121      Tue Aug 17 10:43:43 2004
bbeerman      2727   bbeerman1     Thu Sep  9 09:51:17 2004
mmerriam     30607   marklaptop2   Thu Sep  9 06:11:44 2004
groups        2727   bbeerman1     Thu Sep  9 09:52:03 2004
software      1566   accountingiii  Thu Sep  9 09:00:41 2004
mlugo        31394   border01      Thu Sep  9 07:02:53 2004
btalbot       1566   accountingiii  Thu Sep  9 09:00:32 2004
IPC$          7750   accountingii  Thu Sep  9 08:40:18 2004
HumanResou    7750   accountingii  Thu Sep  9 09:45:40 2004
IPC$          1566   accountingiii  Thu Sep  9 09:01:03 2004
accounting   31394   border01      Thu Sep  9 07:03:04 2004
bjames       31273   product1      Thu Sep  9 06:52:07 2004
llawrence    30957   df2x1121      Thu Sep  9 06:35:07 2004
Locked files:
Pid    DenyMode   Access      R/W        Oplock           Name
--------------------------------------------------------------
1566   DENY_WRITE 0x2019f     RDWR       NONE             /export/accounting/GLedger/Border/BETBINV.XLS   Thu Sep  9 10:20:48 2004
31273  DENY_NONE  0x2019f     RDWR       EXCLUSIVE+BATCH  /home/bjames/My Documents/Product/Price Protection/VPD price protection (master list) 04.xls   Thu Sep  9 10:16:59 2004
1566   DENY_NONE  0x2019f     RDWR       NONE             /export/accounting/GLedger/Alaska/COGS/COGS0804.xls   Thu Sep  9 10:20:29 2004
31273  DENY_NONE  0x2019f     RDWR       EXCLUSIVE+BATCH  /home/bjames/My Documents/Product/Game Buys/September/gamebuySEP.2004.xls   Thu Sep  9 07:07:41 2004

You'll note that it claims that btalbot is logged on twice and kpotts once 
from the same machine.  ps shows that PID 7750 is owned by kpotts:

USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
kpotts    7750  0.0  3.0 10564 3788 ?        S    Sep03   1:33 /usr/sbin/smbd3 -

What triggered us to notice this was that btalbot was having errors on one of 
the other machines in accessing an excel file (she wasn't specific on what 
happened; she thought "the same problem we had before" was a good enough 
description ~sigh~).

An investigation into the event log on accountingii showed that this morning 
at 9:30 there was an error with the printer that claimed the user was btalbot 
although kpotts was logged in at the time!

Chris

-- 
Chris Garrigues                 http://www.DeepEddy.Com/~cwg/
Trinsic Solutions		http://www.trinsics.com
1611-B West 6th Street
Austin, TX  78703-5074		512-322-0180

	    If you don't apply what you've learned, you haven't 
	       learned anything.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 235 bytes
Desc: not available
Url : http://lists.samba.org/archive/samba/attachments/20040909/d2ceef09/attachment.bin