R: [Samba] unauthorized acess attempt

[Gianluca Culot]

The dovecot logs to syslog to the /var/log/maillog 

# Syslog facility to use if you're logging to syslog. Usually if you don't
# want to use "mail", you'll use local0..local7. Also other standard
# facilities are supported.
syslog_facility = mail

And in SYSLOG.CONF
mail.*                                          /var/log/maillog

The message I reported in taken from /var/log/maillog

So... Actualy I do not receive any Error message from dovecot...
Looks like dovecot rely on the error message of winbind and doesn't log any
more message...
Possible?
Strange ?

> -----Messaggio originale-----
> Da: samba-bounces+gianlucaculot=dmsware.com at lists.samba.org 
> [mailto:samba-bounces+gianlucaculot=dmsware.com at lists.samba.or
> g] Per conto di samba at piven.org
> Inviato: sabato 15 dicembre 2007 15.16
> A: 'Samba at Lists. Samba. Org'
> Oggetto: Re: [Samba] unauthorized acess attempt
> 
> Gianluca Culot wrote:
> > Hello list
> >  
> > I'm facing a little security problem
> >  
> > I get A LOT (3 a minute) a such a message
> >  
> >  mail dovecot-auth: pam_winbind(dovecot): request failed: No such 
> > user, PAM error was unknown user (13), NT error was 
> > NT_STATUS_NO_SUCH_USER
> > 
> > I'd like to know which is the user name used in such 
> attempts How can 
> > I get such info without raising log level to an inacceptable level 
> > (which would cause my log file to explode !?! )
> 
> Have you looked at your dovecot logs to see who's trying to 
> login at that time?
> 
> Don Piven
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/listinfo/samba
>