[Samba] Logging successful log-ins

[Andrew Bartlett]

On Wed, 2020-09-16 at 13:06 -0700, Gregory Sloop via samba wrote:
> 
> ABvs> Yeah, it's a wiki.  Go for your life!
> 
> I can do that - I just was not sure I was right and didn't want to
> put something in the wiki that wasn't factually accurate.
> So, just to be extra explicit.
> 
> Samba can log both sucessful and failed authentications, but only
> successful authorizations, not unsuccessful authorizations.
> Right?

Correct.  Unsuccessful authorizations would be things like:
 - not allowed to access this share
 - kerberos ticket not accepted.

Andrew Bartlett

> 
> ABvs> Adding info on the per-log class stuff to log into different
> files
> ABvs> like 
> ABvs> dsdb_password_json_audit:4@/var/log/samba/password.log
> ABvs> would be awesome too.
> 
> 
> ABvs> Andrew Bartlett
> 
> ABvs> On Wed, 2020-09-16 at 10:53 -0700, Gregory Sloop via samba
> wrote:
> > > There's a note at the top of that document:
> > > "Samba only supports logging of succeeded authorization events."
> > > Does that mean that it won't log authentication events at all?
> > > Because that's implied.
> > > I think it would be better, assuming it will log auth events, to
> > > say;
> > > "Samba only supports logging of *successful* authorization
> > > events,
> > > not unsuccessful. Samba also supports logging of both successful
> > > and
> > > unsuccessful auth events."
> > > Just my two bits worth.
-- 
Andrew Bartlett
https://samba.org/~abartlet/
Authentication Developer, Samba Team         https://samba.org
Samba Development and Support, Catalyst IT - Expert Open Source
Solutions
https://catalyst.net.nz/services/samba