Hello list I'm facing a little security problem I get A LOT (3 a minute) a such a message mail dovecot-auth: pam_winbind(dovecot): request failed: No such user, PAM error was unknown user (13), NT error was NT_STATUS_NO_SUCH_USER I'd like to know which is the user name used in such attempts How can I get such info without raising log level to an inacceptable level (which would cause my log file to explode !?! ) Thanks eveybody Gianluca
On Fri, Dec 14, 2007 at 04:26:13PM +0100, Gianluca Culot wrote:> Hello list > > I'm facing a little security problem > > I get A LOT (3 a minute) a such a message > > mail dovecot-auth: pam_winbind(dovecot): request failed: No such user, PAM > error was unknown user (13), NT error was NT_STATUS_NO_SUCH_USER > > I'd like to know which is the user name used in such attempts > How can I get such info without raising log level to an inacceptable level > (which would cause my log file to explode !?! )This needs a patch I think. I'll look into this. Can you log a bug at bugzilla.samba.org please ? If you can build from source, I can send you something you can use quicker than waiting for an official release :-). Jeremy.
Gianluca Culot wrote:> Hello list > > I'm facing a little security problem > > I get A LOT (3 a minute) a such a message > > mail dovecot-auth: pam_winbind(dovecot): request failed: No such user, PAM > error was unknown user (13), NT error was NT_STATUS_NO_SUCH_USER > > I'd like to know which is the user name used in such attempts > How can I get such info without raising log level to an inacceptable level > (which would cause my log file to explode !?! )Have you looked at your dovecot logs to see who's trying to login at that time? Don Piven