search for: auth_log

samba-4.7.5 debian 9.3 installed as join dc in existing domain on samba 4.1 everiting look like working but some windows member stop to have access to shares on dc by ip connect by \\full_domain_name work there some log in samba dc [2018/02/20 15:15:00.652467, 4] ../auth/auth_log.c:860(log_successful_authz_event_human_readable) Successful AuthZ: [DCE/RPC,ncacn_np] user [NT AUTHORITY]\[SYSTEM] [S-1-5-18] at [Tue, 20 Feb 2018 15:15:00.652451 +07] Remote host [ipv6::::0] local host [ipv6::::0] [2018/02/20 15:15:00.652521, 4] ../auth/auth_log.c:220(log_json) JSON Authoriza...

...d_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED' [2018/04/03 15:38:03.801475, 3] ../source4/smbd/process_single.c:114(single_terminate) single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED] [2018/04/03 15:38:03.823029, 4] ../auth/auth_log.c:860(log_successful_authz_event_human_readable) Successful AuthZ: [DCE/RPC,ncacn_np] user [TESTE]\[Administrator] [S-1-5-21-3073023332-2932986482-1183422282-500] at [Tue, 03 Apr 2018 15:38:03.823015 -03] Remote host [ipv4:10.255.1.104:63313] local host [ipv4: 10.255.0.3:445] [2018/04/03 15:38:03...

auth.c:auth_log contains the following code: authlog("%s %s for %s%.100s from %.200s port %d%s", authmsg, method, authctxt->valid ? "" : "illegal user ", ---> authctxt->valid && authctxt->pw->pw_uid == 0 ? &quo...

...lied for user domainuser [2019/11/06 15:27:32.953703,? 2] ../source4/auth/ntlm/auth.c:475(auth_check_password_recv) ? auth_check_password_recv: sam authentication for user [COMPANY\domainuser] FAILED with error NT_STATUS_WRONG_PASSWORD, authoritative=1 [2019/11/06 15:27:32.953814,? 2] ../auth/auth_log.c:760(log_authentication_event_human_readable) ? Auth: [winbind,(null)] user [COMPANY]\[domainuser] at [Wed, 06 Nov 2019 15:27:32.953792 CET] with [NTLMv1] status [NT_STATUS_WRONG_PASSWORD] workstation [DC1] remote host [ipv4:127.0.0.1:0] mapped to [COMPANY]\[domainuser]. local host [ipv4:127....

...4.7 I have setup auth logging, and while I can relate most failed passwords to users mistyping a password, there is one kind that I don't understand, happening across our samba-DCs. Things work without issues, but I'm just being curious. :-) > [2017/11/23 04:47:32.166753, 2] ../auth/auth_log.c:760(log_authentication_event_human_readable) > Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[P002556$@SAMBA.COMPANY.COM] at [Thu, 23 Nov 2017 04:47:32.166711 CET] with [arcfour-hmac-md5] status [NT_STATUS_WRONG_PASSWORD] workstation [(null)] remote host [ipv4:1.2.3.30:62827]...

...:52.092567,  0] ../lib/util/fault.c:151(smb_panic_default)   PANIC: internal error [2018/05/28 17:35:52.305123,  0] ../source4/smbd/process_standard.c:158(standard_child_pipe_handler)   standard_child_pipe_handler: Child 14753 () terminated with signal 6 [2018/05/28 17:35:53.345432,  4] ../auth/auth_log.c:860(log_successful_authz_event_human_readable)   Successful AuthZ: [LDAP,krb5] user [DOMAINXXXX]\[USERYYYYY] [S-1-5-21-1156415912-958998882-3220085130-1180] at [Mon, 28 May 2018 17:35:53.3 45385 -03] Remote host [ipv4:192.168.51.210:57372] local host [ipv4:172.16.1.102:389] [2018/05/28 17:35:...

...dcesrv_drsuapi_DsReplicaUpdateRefs)   ../source4/rpc_server/drsuapi/updaterefs.c:374: Refusing DsReplicaUpdateRefs for sid S-1-5-21-454945863-777199239-1595221609-1112 with GUID 0acce4bc-1193-4609-8e4d-a0771bb6fb76 Log on target DC dcnh1: ============== [2017/12/27 08:20:55.278559,  5] ../auth/auth_log.c:860(log_successful_authz_event_human_readable)   Successful AuthZ: [DCE/RPC,ncacn_ip_tcp] user [NT AUTHORITY]\[ANONYMOUS LOGON] [S-1-5-7] at [Wed, 27 Dec 2017 08:20:55.278538 CET] Remote host [ipv4:192.168.172.14:36196] local host [ipv4:192.168.152.15:135] [2017/12/27 08:20:55.278641,  5] ../...

Hello, I have set up audit logging and I find many entries of this type : ./auth/auth_log.c:760(log_authentication_event_human_readable) Auth: [SMB2,(null)] user [MYDOMAIN]\[MYWORKSTATION$] at [mar., 23 juil. 2019 07:49:43.486619 -03] with [NTLMv2] status [NT_STATUS_NO_SUCH_USER] workstation [MYWORKSTATION] remote host [ipv4:10.x.x.x:49472] mapped to [MYDOMAIN]\[MYWORKSTATION$]. local...

...c:374: Refusing > > DsReplicaUpdateRefs for sid > > S-1-5-21-454945863-777199239-1595221609-1112 with GUID > > 0acce4bc-1193-4609-8e4d-a0771bb6fb76 > > > > Log on target DC dcnh1: > > ============== > > [2017/12/27 08:20:55.278559,  5] > > ../auth/auth_log.c:860(log_successful_authz_event_human_readable) > >   Successful AuthZ: [DCE/RPC,ncacn_ip_tcp] user [NT > > AUTHORITY]\[ANONYMOUS LOGON] [S-1-5-7] at [Wed, 27 Dec 2017 > > 08:20:55.278538 CET] Remote host [ipv4:192.168.172.14:36196] local > > host [ipv4:192.168.152.15:13...

...ror message, that the domain cannot be found. In the logs of the NAS I can only find the error message ?synowin: domain_test_join.c:59 net ads test join fail?. In the logs of the DC I notice that from one second to the other the connection seems to fail: [2020/03/18 00:51:45.001044, 3] ../../auth/auth_log.c:653(log_authentication_event_human_readable) Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)][FILESERVER$@DS.EXAMPLE.COM] at [Wed, 18 Mar 2020 00:51:45.001031 CET] with [aes256-cts-hmac-sha1?96] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:10.0.1.100:51352] became [EXA...

...; > S-1-5-21-454945863-777199239-1595221609-1112 with GUID > > > > 0acce4bc-1193-4609-8e4d-a0771bb6fb76 > > > > > > > > Log on target DC dcnh1: > > > > ============== > > > > [2017/12/27 08:20:55.278559, 5] > > > > ../auth/auth_log.c:860(log_successful_authz_event_human_readabl > > > > e) > > > > Successful AuthZ: [DCE/RPC,ncacn_ip_tcp] user [NT > > > > AUTHORITY]\[ANONYMOUS LOGON] [S-1-5-7] at [Wed, 27 Dec 2017 > > > > 08:20:55.278538 CET] Remote host [ipv4:192.168.172.14:36...

..../source4/rpc_server/drsuapi/updaterefs.c:374: Refusing > DsReplicaUpdateRefs for sid > S-1-5-21-454945863-777199239-1595221609-1112 with GUID > 0acce4bc-1193-4609-8e4d-a0771bb6fb76 > > Log on target DC dcnh1: > ============== > [2017/12/27 08:20:55.278559,  5] > ../auth/auth_log.c:860(log_successful_authz_event_human_readable) >   Successful AuthZ: [DCE/RPC,ncacn_ip_tcp] user [NT > AUTHORITY]\[ANONYMOUS LOGON] [S-1-5-7] at [Wed, 27 Dec 2017 > 08:20:55.278538 CET] Remote host [ipv4:192.168.172.14:36196] local > host [ipv4:192.168.152.15:135] > [2017/12/27...

...Account which is tied to Windows login? I got these error-message in /var/log/syslog:   check_ntlm_password:  Authentication for user [testuser.user at gmx.net] -> [testuser.user at gmx.net] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative =1 [2019/01/30 11:51:53.584395,  2] ../auth/auth_log.c:760(log_authentication_event _human_readable)   Auth: [SMB2,(null)] user [MicrosoftAccount]\[testuser.user at gmx.net] at [Mi,  30 Jan 2019 11:51:53.584386 UTC] with [NTLMv2] status [NT_STATUS_NO_SUCH_USER] workstation [DONALD] remote host [ipv4:192.168.1.2:50007] mapped to [MicrosoftAc coun...

...9/11/06 15:27:32.953703,? 2] > ../source4/auth/ntlm/auth.c:475(auth_check_password_recv) > ? auth_check_password_recv: sam authentication for user > [COMPANY\domainuser] FAILED with error NT_STATUS_WRONG_PASSWORD, > authoritative=1 > [2019/11/06 15:27:32.953814,? 2] > ../auth/auth_log.c:760(log_authentication_event_human_readable) > ? Auth: [winbind,(null)] user [COMPANY]\[domainuser] at [Wed, 06 Nov > 2019 15:27:32.953792 CET] with [NTLMv1] status > [NT_STATUS_WRONG_PASSWORD] workstation [DC1] remote host > [ipv4:127.0.0.1:0] mapped to [COMPANY]\[domainuser]. lo...

...OMAIN.COM [2018/03/03 20:18:57.293106,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)   Kerberos: ENC-TS Pre-authentication succeeded -- nfs/mint-nfs.subdomain.domain.com at SUBDOMAIN.DOMAIN.COM using aes256-cts-hmac-sha1-96 [2018/03/03 20:18:57.297323,  3] ../auth/auth_log.c:760(log_authentication_event_human_readable)   Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[nfs/mint-nfs.subdomain.domain.com at SUBDOMAIN.DOMAIN.COM] at [Sat, 03 Mar 2018 20:18:57.297240 EST] with [aes256-cts-hmac-sha1-96] status [NT_STATUS_OK] workstation [(null)] remote ho...

...>> DsReplicaUpdateRefs for sid >>> S-1-5-21-454945863-777199239-1595221609-1112 with GUID >>> 0acce4bc-1193-4609-8e4d-a0771bb6fb76 >>> >>> Log on target DC dcnh1: >>> ============== >>> [2017/12/27 08:20:55.278559,  5] >>> ../auth/auth_log.c:860(log_successful_authz_event_human_readable) >>>   Successful AuthZ: [DCE/RPC,ncacn_ip_tcp] user [NT >>> AUTHORITY]\[ANONYMOUS LOGON] [S-1-5-7] at [Wed, 27 Dec 2017 >>> 08:20:55.278538 CET] Remote host [ipv4:192.168.172.14:36196] local >>> host [ipv4:192.168...

...y cranking up debug, I can see this: [2018/12/24 16:04:02.012369, 2] ../source3/auth/auth.c:332(auth_check_ntlm_password) check_ntlm_password: Authentication for user [HIRSCH] -> [hirsch] FAILED with error NT_STATUS_WRONG_PASSWORD, authoritative=1 [2018/12/24 16:04:02.012420, 2] ../auth/auth_log.c:760(log_authentication_event_human_readable) Auth: [SMB,(null)] user []\[HIRSCH] at [Mon, 24 Dec 2018 16:04:02.012407 EST] with [LANMan] status [NT_STATUS_WRONG_ PASSWORD] workstation [vmdos] remote host [ipv4:192.168.245.103:38962] mapped to []\[hirsch]. local host [ipv4:192.168 .245.30:139...

...D > > > > > > 0acce4bc-1193-4609-8e4d-a0771bb6fb76 > > > > > > > > > > > > Log on target DC dcnh1: > > > > > > ============== > > > > > > [2017/12/27 08:20:55.278559, 5] > > > > > > ../auth/auth_log.c:860(log_successful_authz_event_human_rea > > > > > > dabl > > > > > > e) > > > > > > Successful AuthZ: [DCE/RPC,ncacn_ip_tcp] user [NT > > > > > > AUTHORITY]\[ANONYMOUS LOGON] [S-1-5-7] at [Wed, 27 Dec 2017 > > >...

...; S-1-5-21-454945863-777199239-1595221609-1112 with GUID >>>>> 0acce4bc-1193-4609-8e4d-a0771bb6fb76 >>>>> >>>>> Log on target DC dcnh1: >>>>> ============== >>>>> [2017/12/27 08:20:55.278559, 5] >>>>> ../auth/auth_log.c:860(log_successful_authz_event_human_readabl >>>>> e) >>>>> Successful AuthZ: [DCE/RPC,ncacn_ip_tcp] user [NT >>>>> AUTHORITY]\[ANONYMOUS LOGON] [S-1-5-7] at [Wed, 27 Dec 2017 >>>>> 08:20:55.278538 CET] Remote host [ipv4:192.168.172.1...

...;>>>> 0acce4bc-1193-4609-8e4d-a0771bb6fb76 >>>>>>>> >>>>>>>> Log on target DC dcnh1: >>>>>>>> ============== >>>>>>>> [2017/12/27 08:20:55.278559, 5] >>>>>>>> ../auth/auth_log.c:860(log_successful_authz_event_human_r >>>>>>>> ea >>>>>>>> dabl >>>>>>>> e) >>>>>>>> Successful AuthZ: [DCE/RPC,ncacn_ip_tcp] user [NT >>>>>>>> AUTHORITY]\[ANONYMOUS LOGON]...