[Samba] Smbstatus shows many nobody users from win10 pc's
Rowland Penny
rpenny at samba.org
Fri Mar 2 14:53:56 UTC 2018
On Fri, 2 Mar 2018 07:05:58 -0700 (MST)
soulman via samba <samba at lists.samba.org> wrote:
> I know more people posted about this , but i see no solution.
> smbstatus gives over 100 nobody users
> The windows 10 pc is doing nothing, just a reboot ( and logon ) ,
> than this happens:
>
> Samba version 4.6.2 Centos 7.
> PID Username Group
> Machine Protocol Version Encryption Signing
> ----------------------------------------------------------------------------------------------------------------------------------------
> 54712 nobody nobody 192.168.1.206
> (ipv4:192.168.1.206:49705) SMB3_11 - -
> 54712 nobody nobody 192.168.1.206
> (ipv4:192.168.1.206:49705) SMB3_11 - -
> 54712 nobody nobody 192.168.1.206
> (ipv4:192.168.1.206:49705) SMB3_11 - -
> 54712 nobody nobody 192.168.1.206
> (ipv4:192.168.1.206:49705) SMB3_11 - -
> 54712 nobody nobody 192.168.1.206
> (ipv4:192.168.1.206:49705) SMB3_11 - -
> 54712 nobody nobody 192.168.1.206
> (ipv4:192.168.1.206:49705) SMB3_11 - -
>
> snippet of log:
> The windows 10 pc is doing nothing, just a reboot , than this happens:
> [2018/03/02 09:14:45.713737, 2]
> ../source3/smbd/close.c:788(close_normal_file) jeroen
> closed file ict/it/beveiliging/backup_schema_2018_NL.xlsx (numopen=2)
> NT_STATUS_OK [2018/03/02 09:14:45.714420, 2]
> ../source3/smbd/close.c:788(close_normal_file) jeroen
> closed file ict/Facturen/facturen.xls (numopen=1) NT_STATUS_OK
>
> [2018/03/02 09:16:39.511403, 3]
> ../auth/ntlmssp/ntlmssp_util.c:69(debug_ntlmssp_flags) Got
> NTLMSSP neg_flags=0xe2088297
> [2018/03/02 09:16:39.513104, 3]
> ../auth/ntlmssp/ntlmssp_server.c:452(ntlmssp_server_preauth)
> Got user=[] domain=[] workstation=[PCJEROEN] len1=1 len2=0
> [2018/03/02 09:16:39.513177, 3]
> ../source3/param/loadparm.c:3823(lp_load_ex) lp_load_ex:
> refreshing parameters
> [2018/03/02 09:16:39.513277, 3]
> ../source3/param/loadparm.c:542(init_globals) Initialising
> global parameters
> [2018/03/02 09:16:39.513451, 3]
> ../source3/param/loadparm.c:2752(lp_do_section)
> Processing section "[global]"
> [2018/03/02 09:16:39.513718, 2]
> ../source3/param/loadparm.c:2769(lp_do_section)
> Processing section "[homes]"
> [2018/03/02 09:16:39.513786, 2]
> ../source3/param/loadparm.c:2769(lp_do_section)
> Processing section "[word]"
> [2018/03/02 09:16:39.514550, 3]
> ../source3/param/loadparm.c:1592(lp_add_ipc) adding IPC
> service [2018/03/02 09:16:39.514598, 3]
> ../source3/auth/auth.c:178(auth_check_ntlm_password)
> check_ntlm_password: Checking password for unmapped user
> []\[]@[PCJEROEN] with the new password interface
> [2018/03/02 09:16:39.514631, 3]
> ../source3/auth/auth.c:181(auth_check_ntlm_password)
> check_ntlm_password: mapped user is: [SOULMAN]\[]@[PCJEROEN]
> [2018/03/02 09:16:39.514676, 3]
> ../source3/auth/auth.c:249(auth_check_ntlm_password)
> check_ntlm_password: guest authentication for user [] succeeded
>
> user is empty and domain is empty !
> Looks like a strange windows process
>
> my smb.conf says
> map to guest = Never
It would say that, even if it didn't say that, it is the default
What is in the rest of the smb.conf ?
>
> At home running debian , the same thing BUT
> putting smb ports = 445 solves the problem.
This turns off netbios
It looks like 'something' on 'PCJEROEN' is trying to connect.
Rowland
More information about the samba
mailing list