Displaying 20 results from an estimated 65 matches for "auth_check_password_recv".
2017 Sep 19
3
How to track attempted breakins, authentication failure logging
This may have been asked before, but I can't find it. I am getting repeated external attempted
to log into our AD/DC (running Samba 4.4.14). In /var/log/samba/log.samba I get entried like:
2017/09/19 05:02:25.562957, 2] ../source4/auth/ntlm/auth.c:430(auth_check_password_recv)
auth_check_password_recv: sam_ignoredomain authentication for user [HPRS\333] FAILED with error NT_STATUS_NO_SUCH_USER
[2017/09/19 05:02:33.493494, 2] ../source4/auth/ntlm/auth.c:430(auth_check_password_recv)
auth_check_password_recv: sam_ignoredomain authentication for user [HPRS\ADMINISTRA...
2018 Sep 14
2
samba4.8.x machine account authentication using NetJoinDomain faled
...in(server, domain, OU, account, password, (JoinOptions.NETSETUP_JOIN_DOMAIN | JoinOptions.NETSETUP_JOIN_UNSECURE |JoinOptions.NETSETUP_DOMAIN_JOIN_IF_JOINED | JoinOptions.NETSETUP_MACHINE_PWD_PASSED));
Here’s the log in log.samba:
[2018/09/13 11:20:18.975729, 2] ../source4/auth/ntlm/auth.c:475(auth_check_password_recv)
auth_check_password_recv: sam authentication for user [0904\LC001$] FAILED with error NT_STATUS_WRONG_PASSWORD, authoritative=1
[2018/09/13 11:20:18.975922, 2] ../auth/auth_log.c:760(log_authentication_event_human_readable)
Auth: [SMB2,NTLMSSP] user [0904]\[LC001$] at [Thu, 13 Sep 2018 11:20:...
2015 Nov 26
2
nitwit's attempt to edit samba source
Hi,
Since I really would like some more info (specifically: remote ip
address) to be logged with failed password attempts, I have tried to
edit the samba source code. :-)
Anyway, I changed in source4/auth/ntlm/auth.c
> if (tevent_req_is_nterror(req, &status)) {
> DEBUG(2,("auth_check_password_recv: "
> "%s authentication for user [%s\\%s] "
> "FAILED with error %s\n",
> (state->method ? state->method->ops->name : "NO_METHOD"),
> state->user_info->mapped.domain_name,
> state->user_info->mapped.accoun...
2016 Jun 26
2
Need IP on failed logins in logfile
I used to also get related log messages of the form:
auth_check_password_send: Checking password for unmapped user [HPRS]\[mark]@[ROVER]
auth_check_password_send: mapped user is: [HPRS]\[mark]@[ROVER]
but now all I get is the auth_check_password_recv in the log. Perhaps the change is due to an
upgrade to Samba, or perhaps a change I made to my smb.conf log options? (see log config in
my original email below mj's).
Anyway, samba does (or did) have access to the hostname of the offending computer. The one
shown above, ROVER, is actual my h...
2016 Jun 26
1
Need IP on failed logins in logfile
...og files for each currently attached
workstation: log.samba.192.168.0.50, log.samba.192.168.0.51, etc. I then tried connecting
remotely with a bad password as I had done before. It created a file log.samba.%m (no IP) with
the entry
[2016/06/26 14:56:28.119286, 2] ../source4/auth/ntlm/auth.c:420(auth_check_password_recv)
auth_check_password_recv: sam_ignoredomain authentication for user [HPRS\mark] FAILED with error NT_STATUS_WRONG_PASSWORD
In the log files with IPs, e.g. log.samba.192.168.0.50, I do see IP addresses on messages with
"closed connection" text, but the failed login logfile does not have...
2017 Feb 07
2
Samba authentication logs
...inst Samba, from the logs I can only see that there is a request for a
certain user to authenticate and then the result which might be OK or
WRONG.... but no info about the machine or IP initiating the request.
Below is an example:
*[2017/02/07 10:06:44.584159, 5]
../source4/auth/ntlm/auth.c:438(auth_check_password_recv)*
* auth_check_password_recv: sam_ignoredomain authentication for user
[DOMAIN\user] succeeded*
Raising the logging level does not seem to help getting any more details.
In addition, I would like to have audit logs for important events, like for
example when administrators or users themselves ch...
2018 Sep 11
0
shared folder in the samba domain, can't be access on trusting domain users
...4/auth/ntlm/auth.c:243(auth_check_password_send)
> auth_check_password_send: Checking password for unmapped user
> [TESTHV]\[mtest]@[TESTHV-DC1]
> auth_check_password_send: user is: [TESTHV]\[mtest]@[TESTHV-DC1]
> [2018/09/10 18:18:57.227872, 2]
> ../source4/auth/ntlm/auth.c:478(auth_check_password_recv)
> auth_check_password_recv: NO_METHOD authentication for user
> [TESTHV\mtest] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=0
> [2018/09/10 18:18:57.227909, 2]
> ../auth/auth_log.c:476(log_authentication_event_human_readable)
> Auth: [SamLogon,network] user [TESTHV]\...
2016 Jun 26
0
Need IP on failed logins in logfile
On 26/06/16 06:16, Mark Foley wrote:
> I used to also get related log messages of the form:
>
> auth_check_password_send: Checking password for unmapped user [HPRS]\[mark]@[ROVER]
> auth_check_password_send: mapped user is: [HPRS]\[mark]@[ROVER]
>
> but now all I get is the auth_check_password_recv in the log. Perhaps the change is due to an
> upgrade to Samba, or perhaps a change I made to my smb.conf log options? (see log config in
> my original email below mj's).
>
> Anyway, samba does (or did) have access to the hostname of the offending computer. The one
> shown above...
2017 Sep 19
0
How to track attempted breakins, authentication failure logging
...;
> This may have been asked before, but I can't find it. I am
> getting repeated external attempted to log into our AD/DC
> (running Samba 4.4.14). In /var/log/samba/log.samba I get
> entried like:
>
> 2017/09/19 05:02:25.562957, 2]
> ../source4/auth/ntlm/auth.c:430(auth_check_password_recv)
> auth_check_password_recv: sam_ignoredomain authentication
> for user [HPRS\333] FAILED with error NT_STATUS_NO_SUCH_USER
>
> [2017/09/19 05:02:33.493494, 2]
> ../source4/auth/ntlm/auth.c:430(auth_check_password_recv)
> auth_check_password_recv: sam_ignoredomain authenti...
2014 Jul 18
1
Question(s) about user mapping
...end: mapped user is: [sambadom]\[user]@[win7host]
[2014/07/18 06:46:28.178098, 3] ../source4/auth/ntlm/auth_sam.c:61(authsam_search_account) sam_search_user: Couldn't find user [user] in samdb, under C=dom,DC=server,DC=edu
[2014/07/18 06:46:28.178184, 2] ../source4/auth/ntlm/auth.c:420(auth_check_password_recv) auth_check_password_recv: sam_ignoredomain authentication for user [sambadom\user] FAILED with error NT_STATUS_NO_SUCH_USER
It appears that some manner of user id mapping is being searched for. What I really want is for it to preserve and use the domain that was passed in rather than sub...
2018 Jan 22
2
RODC and LDAP via Simple Authentication fails
Am 22.01.2018 um 21:39 schrieb Andrew Bartlett:
> On Mon, 2018-01-22 at 21:30 +0100, Johannes Engel via samba wrote:
>> [2018/01/22 21:15:50.022197, 2]
>> ../source4/auth/ntlm/auth.c:475(auth_check_password_recv)
>> auth_check_password_recv: sam_failtrusts authentication for user
>> [MYDOMAIN\ldap] FAILED with error NT_STATUS_NO_TRUST_LSA_SECRET,
>> authoritative=1
> Hmm. Are you sure the RODC's join to the domain is all OK?
Certainly to me it looks ok:
Finding a writeable DC f...
2015 Nov 27
0
nitwit's attempt to edit samba source
...nfo (specifically: remote ip
> address) to be logged with failed password attempts, I have tried to
> edit the samba source code. :-)
>
> Anyway, I changed in source4/auth/ntlm/auth.c
>
>
>> if (tevent_req_is_nterror(req, &status)) {
>> DEBUG(2,("auth_check_password_recv: "
>> "%s authentication for user [%s\\%s] "
>> "FAILED with error %s\n",
>> (state->method ? state->method->ops->name : "NO_METHOD"),
>> state->user_info->mapped.domain_...
2017 Jul 11
2
Samba ADS-member-server: FQDNs in /etc/hosts
Am 2017-07-11 um 09:04 schrieb Stefan G. Weichinger via samba:
> Am 2017-07-10 um 13:08 schrieb Stefan G. Weichinger via samba:
>
>> And what does this tell me, please:
>>
>> [2017/07/10 13:07:48.593400, 1]
>> ../source3/auth/token_util.c:430(add_local_groups)
>> SID S-1-5-21-2940660672-4062535256-4144655499-1008 -> getpwuid(11008)
>> failed
2016 Jun 25
4
Need IP on failed logins in logfile
...am running Samba Version 4.1.23 as an AD/DC on Linux Slackware64 14.1. I am logging samba
messages to /var/log/samba/log.samba with logging set to the following in smb.conf:
log level = 2 passdb:5 auth:10 winbind:2 lanman:10
I have a script that scans this logfile for message like the following:
auth_check_password_recv: sam_ignoredomain authentication for user [HPRS\thisuser] FAILED with error NT_STATUS_NO_SUCH_USER
auth_check_password_recv: sam_ignoredomain authentication for user [HPRS\thatuser] FAILED with error NT_STATUS_WRONG_PASSWORD
Usually, these are not a big deal as they are the results of a local doma...
2015 Jun 19
2
Samba rebind user@email.com to user_email.com
...d for unmapped user []\[user at company.com]@[sheep]
[2015/06/19 11:04:28.601720, 2] ../source4/auth/ntlm/auth_util.c:91(map_user_info_cracknames)
map_user_info: Cracknames of account 'user at company.com' -> DOMAIN_ONLY
[2015/06/19 11:04:28.601864, 2] ../source4/auth/ntlm/auth.c:420(auth_check_password_recv)
auth_check_password_recv: NO_METHOD authentication for user [(null)\(null)] FAILED with error NT_STATUS_NO_SUCH_USER
[2015/06/19 11:04:28.602191, 3] ../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'dcesrv: NT_STATUS_INVALID_PARAMETER'
I reali...
2018 Apr 16
2
How to change Domain password as normal user?
...esterday, again, I reset the user
> password from the AD/DC as the domain administrator: samba-tool user
> setpassword mark
>
> Today, I was unable to log in. The only message in the log.samba file
> is:
>
> [2018/04/16 14:02:12.199145,
> 2] ../source4/auth/ntlm/auth.c:430(auth_check_password_recv)
> auth_check_password_recv: sam_ignoredomain authentication for user
> [HPRS\mark] FAILED with error NT_STATUS_ACCOUNT_LOCKED_OUT
>
> There are no preceeding messages with invalid passwords, etc. If I
> reset the password as domain administrator I get locked out sometime
> a day...
2018 Jan 22
2
RODC and LDAP via Simple Authentication fails
...C=domain,DC=com
[2018/01/22 21:15:50.017031, 3]
../libcli/nbt/lmhosts.c:184(resolve_lmhosts_file_as_sockaddr)
resolve_lmhosts: Attempting lmhosts lookup for name
ef201f76-caaa-40b7-9ff2-41b4790dcf4d._msdcs.my.domain.com<0x20>
[2018/01/22 21:15:50.022197, 2]
../source4/auth/ntlm/auth.c:475(auth_check_password_recv)
auth_check_password_recv: sam_failtrusts authentication for user
[MYDOMAIN\ldap] FAILED with error NT_STATUS_NO_TRUST_LSA_SECRET,
authoritative=1
[2018/01/22 21:15:50.026733, 2]
../auth/auth_log.c:760(log_authentication_event_human_readable)
Auth: [LDAP,simple bind] user
[(null)]\[cn=LDAP,cn=...
2015 Mar 31
4
Login not possible / machine account issues
...different from the client domain
(SUB.DOMAIN.TLD), check if there are identically named server accounts
in these two domains, or use the fully-qualified name to identify the
server.
Checking samba logs revealed this entry:
log.samba-[2015/03/28 14:48:58.156066, 2]
../source4/auth/ntlm/auth.c:420(auth_check_password_recv)
log.samba: auth_check_password_recv: sam_ignoredomain authentication
for user [DOMAIN\workstation$] FAILED with error
NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT
log.samba-[2015/03/28 14:48:58.160911, 2]
../source4/auth/ntlm/auth.c:420(auth_check_password_recv)
log.samba: auth_check_password_re...
2015 Nov 27
2
nitwit's attempt to edit samba source
...s error perhaps tell you something, or are you just as clueless
as I am now:
> [1955/4033] Compiling source4/auth/ntlm/auth.c
> In file included from ../source4/include/includes.h:62:0,
> from ../source4/auth/ntlm/auth.c:21:
> ../source4/auth/ntlm/auth.c: In function ‘auth_check_password_recv’:
> ../source4/auth/ntlm/auth.c:429:34: error: dereferencing pointer to incomplete type
> state->user_info->remote_host->addr,
> ^
> ../source4/../lib/util/debug.h:185:20: note: in definition of macro ‘DEBUG’
> && (dbgte...
2019 Jan 18
3
NT_STATUS_ACCOUNT_LOCKED_OUT
...w where it's getting the "user
[(null)]\[mark at HPRS]" bit from.
After some period of time (or some number of "wrong password" messages), my account gets locked
out. The next time I try logging in from Remote desktop, or if I try ntlm_auth, I get the
following message:
auth_check_password_recv: sam authentication for user [HPRS\mark] FAILED with error NT_STATUS_ACCOUNT_LOCKED_OUT, authoritative=1
[2019/01/17 00:24:22.733958, 2] ../auth/auth_log.c:760(log_authentication_event_human_readable)
At this point I have to go into ADUC and disable and re-enable the user account in order to be
a...