samba - Dec 2002 - Strange winbindd situation

I set up winbindd last week on my Linux workstation.  So far it's been
working just fine and I've been enjoying the benefits of being able to
connect to it with my NT user account.  However, last week I noticed
that there were two or three new NT users in my '/home/winnt/DOMAIN'
directory that I *HADN'T* logged into this system with.  I chalked it up
to a potential virus or worm infection so I had those three users run
their antivirus scanners.  They turned up clean, so I then suspected
some kind of spyware or trojan.  Anyway... I deleted the new home
directories for those users and didn't think about it again until
today.  I only did this since I decided I'd better check since my
smb.log file as it was pretty big this morning.  Well... it looks like I
am getting multiple connection attempts from different machines within
and outside of my NT domain (We have one way trusts with our other
domains).  So... my questions are:
-What would cause these connections?
-Something malicious, or just a quirk with the clients?
-As far as I can tell, these clients all seem to be Win2K and XP.  Is
this something natural to those clients?  Maybe they search for shares
and this results in logons?

Anyone else seen this before?

Thanks
George

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> Message: 12
> Date: Wed, 11 Dec 2002 11:37:08 -0500
> From: George Lenzer <George.Lenzer@cpl.org>
> To: samba@lists.samba.org
> Subject: [Samba] Strange winbindd situation
> -What would cause these connections?
> -Something malicious, or just a quirk with the clients?
> -As far as I can tell, these clients all seem to be Win2K and XP.  Is
> this something natural to those clients?  Maybe they search for shares
> and this results in logons?
>
This seems like normal windows operation to me ... epsecially if you
have printer shares on your machine.

If you don't want to see this:
1)Don't run samba if you don't need to
2)If you do need to run samba, but don't need to auto-create home
directory shares for users, turn off pam obedience 'obey pam
restrictions = no'. This is actually the default, but in many
circumstances it's very convenient to set 'obey pam restrictions =
yes'.

Making your samba server non-browseable may also help matters ...

Buchan

- --
|--------------Another happy Mandrake Club member--------------|
Buchan Milne                Mechanical Engineer, Network Manager
Cellphone * Work            +27 82 472 2231 * +27 21 8828820x121
Stellenbosch Automotive Engineering         http://www.cae.co.za
GPG Key                   http://ranger.dnsalias.com/bgmilne.asc
1024D/60D204A7 2919 E232 5610 A038 87B1 72D6 AC92 BA50 60D2 04A7
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQE995QOrJK6UGDSBKcRAhg0AKC+SJUQhXHkGT+Zh8+oAl48nzfBMgCffZH/
uy78QRntITkX0hpOuyGpkMA=YzS+
-----END PGP SIGNATURE-----