Am 25.10.21 um 11:04 schrieb Rowland Penny via samba:> On Mon, 2021-10-25 at 10:40 +0200, cn--- via samba wrote:
>> I have set "auth_audit"
>>
>> log level = 1 auth_audit:3@/var/log/samba/print.log
>>
>> And I have tons of these:
>>
>>
>> [2021/10/25 10:38:44.484840, 3]
>> ../../auth/auth_log.c:653(log_authentication_event_human_readable)
>> Auth: [DCE/RPC,(null)] user [DOMAIN-02]\[user] at [Mon, 25 Oct
>> 2021
>> 10:38:44.484815 CEST] with [NTLMv2] status [NT_STATUS_OK]
>> workstation
>> [BR-HOST] remote host [ipv4:X.X.X.X:59409] became [DOMAIN-02]\[user]
>> [S-1-5-21-xxx-xxx-xxx-xxx]. local host [ipv4:X.X.X.X:445]
>>
>>
>
> Try changing the 3 in 'auth_audit' to 2, what you are receiving in
the
> logs is just Samba telling you that authentication was successful.
Yes I know. But it is NTLM Auth not Kerberos as before the Updates and
there so many many more then before the update. This is what made me
suspicious.
Regards
--
Dr. Christian Naumer
Vice President
Unit Head Bioprocess Development
BRAIN Biotech AG
Darmstaedter Str. 34-36, D-64673 Zwingenberg
e-mail cn at brain-biotech.com, homepage www.brain-biotech.com
phone +49-6251-9331-30 / fax +49-6251-9331-11
Sitz der Gesellschaft: Zwingenberg/Bergstrasse
Registergericht AG Darmstadt, HRB 24758
Vorstand: Adriaan Moelker (Vorstandsvorsitzender),
Lukas Linnig
Aufsichtsratsvorsitzender: Dr. Georg Kellinghusen