samba - Apr 2015 - Samba 4.2 Account Lockout logging

Hello,

We are using the account lockout feature in Samba 4.2.  Unfortunately my own
account is being locked out overnight and I can't figure out where from :-( 
Is there a level of logging on a Samba4 DC I can use to record the source
address of any authentication failures, be they with Kerberos or native LDAP?

Thanks,

--
Luke Bigum
---

LMAX Exchange, Yellow Building, 1A Nicholas Road, London W11 4AN
http://www.LMAX.com/

---
#1 Fastest Growing Tech Company in UK - Sunday Times Tech Track 100 (2014)

Awards
2015 Best FX Trading Venue - ECN/MTF - WSL Institutional Trading Awards
2014 Best Margin Sector Platform - Profit & Loss Readers' Choice Awards
2014 Best FX Trading Venue - ECN/MTF - WSL Institutional Trading Awards
2014 Best Infrastructure/Technology Initiative - WSL Institutional Trading
Awards
2013 #15 Fastest Growing Tech Company in UK - Sunday Times Tech Track 100
2013 Best Overall Testing Project - The European Software Testing Awards
2013 Best Margin Sector Platform - Profit & Loss Readers' Choice Awards
2013 Best FX Trading Platform - ECN/MTF - WSL Institutional Trading Awards
2013 Best Executing Venue - Forex Magnates Awards
2011 Best Trading System - Financial Sector Technology Awards
2011 Innovative Programming Framework - Oracle Duke's Choice Awards
---

FX and CFDs are leveraged products that can result in
losses exceeding your deposit. They are not suitable
for everyone so please ensure you fully understand
the risks involved.

This message and its attachments are confidential,
may not be disclosed or used by any person other
than the addressee and are intended only for the
named recipient(s). This message is not intended for
any recipient(s) who based on their nationality,
place of business, domicile or for any other
reason, is/are subject to local laws or regulations
which prohibit the provision of such products and
services. This message is subject to the terms at
http://www.lmax.com/pdf/general-disclaimers.pdf
however if you cannot access these, please notify
us by replying to this email and we will send you
the terms. If you are not the intended recipient,
please notify the sender immediately and delete any
copies of this message.

LMAX Exchange is the trading name of LMAX Limited. LMAX
Limited operates a multilateral trading facility. LMAX
Limited is authorised and regulated by the Financial
Conduct Authority (firm registration number 509778)
and is a company registered in England and Wales
(number 6505809).

LMAX Hong Kong Limited is a wholly-owned subsidiary
of LMAX Limited. LMAX Hong Kong is licensed by the
Securities and Futures Commission in Hong Kong to
conduct Type 3 (leveraged foreign exchange trading)
regulated activity with CE Number BDV088.

hi Luke,
> We are using the account lockout feature in Samba 4.2. Unfortunately
> my own account is being locked out overnight and I can't figure out
> where from :-( Is there a level of logging on a Samba4 DC I can use
> to record the source address of any authentication failures, be they
> with Kerberos or native LDAP?
I don't think you get a definite source address, but with LDAP the
alleged workstation name is logged at level 3. It'll look something
like this:

    auth_check_password_send: mapped user is:
[domain]\[account]@[workstation]

The workstation name can be spoofed.

I am not sure about Kerberos. You may be out of luck.

For the file server, you can set the log file to be "log.%I" and the
%I will expand into the client IP address.

cheers,
Douglas

On 4/15/2015 8:41 PM, Douglas Bagnall wrote:
> hi Luke,
>
>> We are using the account lockout feature in Samba 4.2. Unfortunately
>> my own account is being locked out overnight and I can't figure out
>> where from :-( Is there a level of logging on a Samba4 DC I can use
>> to record the source address of any authentication failures, be they
>> with Kerberos or native LDAP?
> I don't think you get a definite source address, but with LDAP the
> alleged workstation name is logged at level 3. It'll look something
> like this:
>
>     auth_check_password_send: mapped user is:
> [domain]\[account]@[workstation]
>
> The workstation name can be spoofed.
>
> I am not sure about Kerberos. You may be out of luck.
>
> For the file server, you can set the log file to be "log.%I" and
the
> %I will expand into the client IP address.
>
> cheers,
> Douglas
On a Windows box you can install Microsoft's Account Lockout Status
tool. It will provide additional details that may be beneficial.

http://www.microsoft.com/en-us/download/details.aspx?id=15201

-- 
-James