Displaying 20 results from an estimated 52 matches for "dsdb_password_json_audit".
2020 Aug 20
2
dsdb_password_json_audit and samba-tool
Greetings.
Samba documentation states:
Password changes and Password resets are logged under
dsdb_password_audit and a JSON representation is logged under the
dsdb_password_json_audit.
I have enabled
log level = 0 dsdb_password_json_audit:4@/var/log/samba/password.log
and then tried a password change using
samba-tool user setpassword <user>
but no log entry was added. I wonder if samba-tool generated password
changes aren't logged because it wasn't gene...
2020 Aug 20
0
dsdb_password_json_audit and samba-tool
On Thu, 2020-08-20 at 18:24 -0400, Robert Marcano via samba wrote:
> Greetings.
>
> Samba documentation states:
>
> Password changes and Password resets are logged under
> dsdb_password_audit and a JSON representation is logged under the
> dsdb_password_json_audit.
>
> I have enabled
>
> log level = 0
> dsdb_password_json_audit:4@/var/log/samba/password.log
>
> and then tried a password change using
>
> samba-tool user setpassword <user>
>
> but no log entry was added. I wonder if samba-tool generated
> pa...
2018 Sep 14
2
kpasswd_samdb_set_password: domain\user (S-...) is changing password of user@domain
I have dsdb_password_audit:5 & dsdb_password_json_audit:5 enabled, but I
don't get the message I included.
I instead get an audit log that a password was changed...but not by who.
Was hoping to get more info in a single log entry, so I can track who on my
staff is doing password resets and setup email alerts via my logging system.
On Fri, Sep 14,...
2018 Sep 14
2
kpasswd_samdb_set_password: domain\user (S-...) is changing password of user@domain
...smb:1 rpc_parse:1 rpc_srv:1
rpc_cli:1 passdb:1 sam:1 auth:1 winbind:1 vfs:1 idmap:1 quota:1 acls:1
locking:1 msdfs:1 dmapi:1 registry:1 scavenger:1 dns:1 ldb:1 tevent:1
auth_audit:5 auth_json_audit:5 kerberos:1 drs_repl:1 smb2:1 smb2_credits:1
dsdb_audit:5 dsdb_json_audit:5 dsdb_password_audit:5
dsdb_password_json_audit:5 dsdb_transaction_audit:5
dsdb_transaction_json_audit:5 dsdb_group_audit:5 dsdb_group_json_audit:5
On Fri, Sep 14, 2018 at 1:17 PM Andrew Bartlett <abartlet at samba.org> wrote:
> On Fri, 2018-09-14 at 13:00 -0400, Bill Baird via samba wrote:
> > I have dsdb_password_audit:5 &am...
2018 Sep 14
2
kpasswd_samdb_set_password: domain\user (S-...) is changing password of user@domain
Hi All,
I'm prepping for a classicupgrade and noticed that if I set log level = 5,
I get a log like this when we update a password for a user:
*kpasswd_samdb_set_password: DOMAIN\username(S--x-x-x-xxx-xxx-xxxx) is
changing password of username at domain*
I can't seem to figure out what debug class I need to enable to still get
this alert, but still set my default logging to 1.
Thanks
2020 Sep 16
1
Logging successful log-ins
...t wasn't factually accurate.
So, just to be extra explicit.
Samba can log both sucessful and failed authentications, but only successful authorizations, not unsuccessful authorizations.
Right?
ABvs> Adding info on the per-log class stuff to log into different files
ABvs> like
ABvs> dsdb_password_json_audit:4@/var/log/samba/password.log
ABvs> would be awesome too.
ABvs> Andrew Bartlett
ABvs> On Wed, 2020-09-16 at 10:53 -0700, Gregory Sloop via samba wrote:
>> There's a note at the top of that document:
>> "Samba only supports logging of succeeded authorization events....
2019 Mar 08
1
samba-tool domain provision stuck when using python3
...v: 7 rpc_cli: 7 passdb: 7 sam: 7 auth: 7 winbind: 7 vfs: 7 idmap: 7 quota: 7 acls: 7 locking: 7 msdfs: 7 dmapi: 7 registry: 7 scavenger: 7 dns: 7 ldb: 7 tevent: 7 auth_audit: 7 auth_json_audit: 7 kerberos: 7 drs_repl: 7 smb2: 7 smb2_credits: 7 dsdb_audit: 7 dsdb_json_audit: 7 dsdb_password_audit: 7 dsdb_password_json_audit: 7 dsdb_transaction_audit: 7 dsdb_transaction_json_audit: 7 dsdb_group_audit: 7 dsdb_group_json_audit: 7
and it didn't go on.
here's my step to complile samba 4.10rc4.
1 install some packages from repos with epel enabled.
yum install attr bind-utils docbook-style-xsl gcc gdb krb5-worksta...
2020 Sep 16
2
Logging successful log-ins
There's a note at the top of that document:
"Samba only supports logging of succeeded authorization events."
Does that mean that it won't log authentication events at all? Because that's implied.
I think it would be better, assuming it will log auth events, to say;
"Samba only supports logging of *successful* authorization events, not unsuccessful. Samba also supports
2020 Sep 16
2
force samba 4.12.5 to log failed and succeeding authentication
Hi all,
i'm strugling since a few hours to find what i can do to have some debug
information in samba on succesfull or unsccessful login attempt.
I'm running the standard bulleye samba deb package.
Systemd is installed and see some thing , but whatever i put in smb.conf
It seems like i can't have access to those information.
i have allready try :
-log level = 1 auth:5 winbind:5
2023 Mar 27
1
clients not connecting to samba shares
...bind: 5
?vfs: 5
?idmap: 5
?quota: 5
?acls: 5
?locking: 5
?msdfs: 5
?dmapi: 5
?registry: 5
?scavenger: 5
?dns: 5
?ldb: 5
?tevent: 5
?auth_audit: 5
?auth_json_audit: 5
?kerberos: 5
?drs_repl: 5
?smb2: 5
?smb2_credits: 5
?dsdb_audit: 5
?dsdb_json_audit: 5
?dsdb_password_audit: 5
?dsdb_password_json_audit: 5
?dsdb_transaction_audit: 5
?dsdb_transaction_json_audit: 5
?dsdb_group_audit: 5
?dsdb_group_json_audit: 5
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
INFO: Current debug levels:
?all: 5
?tdb: 5...
2018 Dec 01
2
Setup a Samba AD DC as an additional DC
...bind: 8
vfs: 8
idmap: 8
quota: 8
acls: 8
locking: 8
msdfs: 8
dmapi: 8
registry: 8
scavenger: 8
dns: 8
ldb: 8
tevent: 8
auth_audit: 8
auth_json_audit: 8
kerberos: 8
drs_repl: 8
smb2: 8
smb2_credits: 8
dsdb_audit: 8
dsdb_json_audit: 8
dsdb_password_audit: 8
dsdb_password_json_audit: 8
dsdb_transaction_audit: 8
dsdb_transaction_json_audit: 8
dsdb_group_audit: 8
dsdb_group_json_audit: 8
Processing section "[netlogon]"
Processing section "[sysvol]"
pm_process() returned Yes
ldb_wrap open of secrets.ldb
Could not find machine account in secrets databas...
2020 May 20
4
smbclient oddness
Are there any logs on the client or server at a higher log level?
Andrew Bartlett
On Wed, 2020-05-20 at 12:39 +1200, Grant Petersen via samba wrote:
> I forgot to mention that using the smbclient option
>
> -A /etc/cred/authfile
>
> behaves the same way as attempting to manually enter the password on
> the command line; failing in 4.12.2 and working in 4.11.0
>
>
2019 Dec 11
0
security = ads parameter not working in samba 4.9.5
...bind: 6
vfs: 6
idmap: 6
quota: 6
acls: 6
locking: 6
msdfs: 6
dmapi: 6
registry: 6
scavenger: 6
dns: 6
ldb: 6
tevent: 6
auth_audit: 6
auth_json_audit: 6
kerberos: 6
drs_repl: 6
smb2: 6
smb2_credits: 6
dsdb_audit: 6
dsdb_json_audit: 6
dsdb_password_audit: 6
dsdb_password_json_audit: 6
dsdb_transaction_audit: 6
dsdb_transaction_json_audit: 6
dsdb_group_audit: 6
dsdb_group_json_audit: 6
lp_load_ex: refreshing parameters
Initialising global parameters
INFO: Current debug levels:
all: 6
tdb: 6
printdrivers: 6
lanman: 6
smb: 6
rpc_parse: 6
rpc_srv: 6
rpc_cl...
2023 Mar 28
1
clients not connecting to samba shares
...??tevent: 5
>>> ??auth_audit: 5
>>> ??auth_json_audit: 5
>>> ??kerberos: 5
>>> ??drs_repl: 5
>>> ??smb2: 5
>>> ??smb2_credits: 5
>>> ??dsdb_audit: 5
>>> ??dsdb_json_audit: 5
>>> ??dsdb_password_audit: 5
>>> ??dsdb_password_json_audit: 5
>>> ??dsdb_transaction_audit: 5
>>> ??dsdb_transaction_json_audit: 5
>>> ??dsdb_group_audit: 5
>>> ??dsdb_group_json_audit: 5
>>> lp_load_ex: refreshing parameters
>>> Initialising global parameters
>>> rlimit_max: increasing rlimit_...
2020 Oct 14
2
azure ad provisioning | password hashes sync
...N=Users,DC=samba,DC=company,DC=com
> 88488634-868425949-572>;CN=Denied RODC Password Replication Group,CN=Users,DC
> [2020/10/14 13:36:54.288696, 3, pid=32634, effective(0, 0), real(0, 0)] ../../source3/smbd/password.c:140(register_homes_share)
> dsdb_password_audit: 10
> dsdb_password_json_audit: 10
> last_password_change : Thu Mar 12 09:00:04 PM 2020 CET
> allow_password_change : Thu Mar 12 09:00:04 PM 2020 CET
> force_password_change : Thu Sep 14 04:48:05 AM 30828 CEST...
2020 Jul 13
10
Problem with network browsing
...dmap: 10
quota: 10
acls: 10
locking: 10
msdfs: 10
dmapi: 10
registry: 10
scavenger: 10
dns: 10
ldb: 10
tevent: 10
auth_audit: 10
auth_json_audit: 10
kerberos: 10
drs_repl: 10
smb2: 10
smb2_credits: 10
dsdb_audit: 10
dsdb_json_audit: 10
dsdb_password_audit: 10
dsdb_password_json_audit: 10
dsdb_transaction_audit: 10
dsdb_transaction_json_audit: 10
dsdb_group_audit: 10
dsdb_group_json_audit: 10
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
INFO: Current debug levels:
all: 10
td...
2019 Dec 10
6
security = ads parameter not working in samba 4.9.5
I've re-read this thread but its a bit confusing due to 2 persons with the same probem in one thread.
Im thinking here, how is samba started, since winbind is not running.
Im suspecting samba-addc or samba is starting. Not smbd nmbd winbind.
I suggest to run this:
Disable that all again.
systemctl disable samba-addc samba smbd nmbd winbind
systemctl mask samba-addc samba smbd nmbd
2020 Jul 13
0
Problem with network browsing
...> scavenger: 10
> dns: 10
> ldb: 10
> tevent: 10
> auth_audit: 10
> auth_json_audit: 10
> kerberos: 10
> drs_repl: 10
> smb2: 10
> smb2_credits: 10
> dsdb_audit: 10
> dsdb_json_audit: 10
> dsdb_password_audit: 10
> dsdb_password_json_audit: 10
> dsdb_transaction_audit: 10
> dsdb_transaction_json_audit: 10
> dsdb_group_audit: 10
> dsdb_group_json_audit: 10
> lp_load_ex: refreshing parameters
> Initialising global parameters
> rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
>...
2020 Jul 13
0
Problem with network browsing
...registry: 10
> scavenger: 10
> dns: 10
> ldb: 10
> tevent: 10
> auth_audit: 10
> auth_json_audit: 10
> kerberos: 10
> drs_repl: 10
> smb2: 10
> smb2_credits: 10
> dsdb_audit: 10
> dsdb_json_audit: 10
> dsdb_password_audit: 10
> dsdb_password_json_audit: 10
> dsdb_transaction_audit: 10
> dsdb_transaction_json_audit: 10
> dsdb_group_audit: 10
> dsdb_group_json_audit: 10
> lp_load_ex: refreshing parameters
> Initialising global parameters
> rlimit_max: increasing rlimit_max (1024) to minimum Windows
> limit (16384)
&...
2018 Sep 14
0
kpasswd_samdb_set_password: domain\user (S-...) is changing password of user@domain
...cause it can be reliably parsed.
https://wiki.samba.org/index.php/Samba_4.9_Features_added/changed#Password_change_audit_support
Password change audit support
Password changes in the AD DC are now logged to Samba's debug logs
under the "dsdb_password_audit" debug class and
"dsdb_password_json_audit" for JSON formatted log entries.
Andrew Bartlett
--
Andrew Bartlett http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org
Samba Developer, Catalyst IT http://catalyst.net.nz/services/samba