search for: log_authentication_event_human_read

...p auth logging, and while I can relate most failed passwords to users mistyping a password, there is one kind that I don't understand, happening across our samba-DCs. Things work without issues, but I'm just being curious. :-) > [2017/11/23 04:47:32.166753, 2] ../auth/auth_log.c:760(log_authentication_event_human_readable) > Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[P002556$@SAMBA.COMPANY.COM] at [Thu, 23 Nov 2017 04:47:32.166711 CET] with [arcfour-hmac-md5] status [NT_STATUS_WRONG_PASSWORD] workstation [(null)] remote host [ipv4:1.2.3.30:62827] mapped to [WRKGRP]\[P002556$]. local host...

Hello, I have set up audit logging and I find many entries of this type : ./auth/auth_log.c:760(log_authentication_event_human_readable) Auth: [SMB2,(null)] user [MYDOMAIN]\[MYWORKSTATION$] at [mar., 23 juil. 2019 07:49:43.486619 -03] with [NTLMv2] status [NT_STATUS_NO_SUCH_USER] workstation [MYWORKSTATION] remote host [ipv4:10.x.x.x:49472] mapped to [MYDOMAIN]\[MYWORKSTATION$]. local host What does it mean ? When a domain u...

...at the domain cannot be found. In the logs of the NAS I can only find the error message ?synowin: domain_test_join.c:59 net ads test join fail?. In the logs of the DC I notice that from one second to the other the connection seems to fail: [2020/03/18 00:51:45.001044, 3] ../../auth/auth_log.c:653(log_authentication_event_human_readable) Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)][FILESERVER$@DS.EXAMPLE.COM] at [Wed, 18 Mar 2020 00:51:45.001031 CET] with [aes256-cts-hmac-sha1?96] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:10.0.1.100:51352] became [EXAMPLE][FILESERVER$] [S?1?5?21?1451753080?56...

...../lib/util/fault.c:151(smb_panic_default)   PANIC: internal error [2018/05/28 17:35:53.562573,  0] ../source4/smbd/process_standard.c:158(standard_child_pipe_handler)   standard_child_pipe_handler: Child 14755 () terminated with signal 6 [2018/05/28 17:36:00.121746,  3] ../auth/auth_log.c:760(log_authentication_event_human_readable)

...the log in log.samba: [2018/09/13 11:20:18.975729, 2] ../source4/auth/ntlm/auth.c:475(auth_check_password_recv) auth_check_password_recv: sam authentication for user [0904\LC001$] FAILED with error NT_STATUS_WRONG_PASSWORD, authoritative=1 [2018/09/13 11:20:18.975922, 2] ../auth/auth_log.c:760(log_authentication_event_human_readable) Auth: [SMB2,NTLMSSP] user [0904]\[LC001$] at [Thu, 13 Sep 2018 11:20:18.975877 CST] with [NTLMv2] status [NT_STATUS_WRONG_PASSWORD] workstation [LC001] remote host [ipv4:8.22.127.165:49158] mapped to [0904]\[LC001$]. local host [ipv4:8.22.127.120:445] [2018/09/13 11:20:21.903399, 2] ../sour...

...with one windows 10 client. [2020/10/05 09:21:47.356628, 2] ../source3/auth/auth.c:334(auth_check_ntlm_password) check_ntlm_password: Authentication for user [ap31] -> [ap31] FAILED with error NT_STATUS_WRONG_PASSWORD, authoritative=1 [2020/10/05 09:21:47.356724, 2] ../auth/auth_log.c:610(log_authentication_event_human_readable) Auth: [SMB2,(null)] user [.]\[ap31] at [Mo, 05 Okt 2020 09:21:47.356700 CEST] with [NTLMv2] status [NT_STATUS_WRONG_PASSWORD] workstation [AP31-PC] remote host [ipv4:192.168.0.54:49927] mapped to [.]\[ap31]. local host [ipv4:192.168.0.100:445] {"timestamp": "2020-10-05T09:21...

...9/10 18:18:57.227872, 2] > ../source4/auth/ntlm/auth.c:478(auth_check_password_recv) > auth_check_password_recv: NO_METHOD authentication for user > [TESTHV\mtest] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=0 > [2018/09/10 18:18:57.227909, 2] > ../auth/auth_log.c:476(log_authentication_event_human_readable) > Auth: [SamLogon,network] user [TESTHV]\[mtest] at [Mon, 10 Sep 2018 > 18:18:57.227901 NZST] with [NTLMv2] status [NT_STATUS_NO_SUCH_USER] > workstation [TESTHV-DC1] remote host [ipv4:192.168.179.229:50070] mapped > to [TESTHV]\[mtest]. local host [ipv4:192.168.179.226:49153] N...

...domainuser [2019/11/06 15:27:32.953703,? 2] ../source4/auth/ntlm/auth.c:475(auth_check_password_recv) ? auth_check_password_recv: sam authentication for user [COMPANY\domainuser] FAILED with error NT_STATUS_WRONG_PASSWORD, authoritative=1 [2019/11/06 15:27:32.953814,? 2] ../auth/auth_log.c:760(log_authentication_event_human_readable) ? Auth: [winbind,(null)] user [COMPANY]\[domainuser] at [Wed, 06 Nov 2019 15:27:32.953792 CET] with [NTLMv1] status [NT_STATUS_WRONG_PASSWORD] workstation [DC1] remote host [ipv4:127.0.0.1:0] mapped to [COMPANY]\[domainuser]. local host [ipv4:127.0.0.1:0] [2019/11/06 15:27:32.954029,? 2]...

Hello,     I recently upgrade Samba to 4.7.0 and enabled the Authentication and Authorization audit support. One of the first events I see is from a disabled user account. [2017/09/26 12:24:17.894767,  3, pid=1257, effective(0, 0), real(0, 0)] ../auth/auth_log.c:760(log_authentication_event_human_readable)   Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[bdiley at DOMAIN.LOCAL] at [Tue, 26 Sep 2017 12:24:17.894746 EDT] with [aes256-cts-hmac-sha1-96] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:172.16.24.20:52728] became [DOMAIN]\[bdiley] [S-1-5-21-940051827-22...

...ynowin: domain_test_join.c:59 net ads test join fail?. Well, that would seem to suggest that the NAS isn't joined to the domain > In the logs of the DC I notice that from one second to the other the connection seems to fail: > > [2020/03/18 00:51:45.001044, 3] ../../auth/auth_log.c:653(log_authentication_event_human_readable) Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)][FILESERVER$@DS.EXAMPLE.COM] at [Wed, 18 Mar 2020 00:51:45.001031 CET] with [aes256-cts-hmac-sha1?96] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:10.0.1.100:51352] became [EXAMPLE][FILESERVER$] [S?1?5?21?1451753080?56...

Hi everyone, we are running Samba version 4.19.3 on Rocky Linux 8.9. Recently we have been seeing errors like these for all Linux hosts in our network. Jan 11 15:36:55 dc4.REALM.COM samba[4339]: [2024/01/11 15:36:55.080863, 2] ../../auth/auth_log.c:876(log_authentication_event_human_readable) Jan 11 15:36:55 dc4.REALM.COM samba[4339]: Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[HOST$@REALM.COM] at [Thu, 11 Jan 2024 15:36:55.080852 CET] with [aes256-cts-hmac-sha1-96] status [NT_STATUS_PROTOCOL_UNREACHABLE] workstation [(null)] remote host [ipv4:X.X.X.X:52874]...

Out of curiosity: is QNAP as bad as Synology or is there another ?mainstream? NAS solution with more vanilla Samba out there? Alexander On 25. March 2020 at 11:40:08, Ralph Boehme via samba (samba at lists.samba.org) wrote: Am 3/25/20 um 11:36 AM schrieb Rowland penny via samba: > Thanks Ralph, didn't know that, but shouldn't they provide source code > somewhere ? they

...ebug, I can see this: [2018/12/24 16:04:02.012369, 2] ../source3/auth/auth.c:332(auth_check_ntlm_password) check_ntlm_password: Authentication for user [HIRSCH] -> [hirsch] FAILED with error NT_STATUS_WRONG_PASSWORD, authoritative=1 [2018/12/24 16:04:02.012420, 2] ../auth/auth_log.c:760(log_authentication_event_human_readable) Auth: [SMB,(null)] user []\[HIRSCH] at [Mon, 24 Dec 2018 16:04:02.012407 EST] with [LANMan] status [NT_STATUS_WRONG_ PASSWORD] workstation [vmdos] remote host [ipv4:192.168.245.103:38962] mapped to []\[hirsch]. local host [ipv4:192.168 .245.30:139] [2018/12/24 16:04:02.012527, 2] ../auth...

...what seems to be a kerberos ticket renewal. The lockout setting is currently at 25 attempts.  In the logs (debug level cranked up to 5) I see 25 successive wrong password attempts in the course of a few seconds culminating in a lock out: [2018/02/12 15:32:52.383900,  2] ../auth/auth_log.c:760(log_authentication_event_human_readable)   Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[exampleuser at MICROWAY] at [Mon, 12 Feb 2018 15:32:52.383881 EST] with [arcfour-hmac-md5] status [NT_STATUS_WRONG_PASSWORD] workstation [(null)] remote host [ipv4:192.168.200.17:50205] mapped to [MICROWAY]\[exampleuser]. loc...

...for 'ISEAPPL' with key CHALLENGE/cc [2018/06/13 16:12:58.521086,  3] ../libcli/auth/schannel_state_tdb.c:121(schannel_store_session_key_tdb)   schannel_store_session_key_tdb: stored schannel info with key SECRETS/SCHANNEL/ISEAPPL [2018/06/13 16:12:58.521235,  3] ../auth/auth_log.c:760(log_authentication_event_human_readable) Auth: [NETLOGON,ServerAuthenticate] user [EXAMPLE]\[ISEAPPL$] at [Wed, 13 Jun 2018 16:12:58.521173 IST] with [HMAC-MD5] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:192.168.100.40:62133] became [EXAMPLE]\[ISEAPPL$] [S-1-5-21-3209396036-1574839989-2322605064-1124]. local hos...

...domain_test_join.c:59 net ads test join fail?. Well, that would seem to suggest that the NAS isn't joined to the domain > In the logs of the DC I notice that from one second to the other the connection seems to fail: > > [2020/03/18 00:51:45.001044, 3] ../../auth/auth_log.c:653(log_authentication_event_human_readable) Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)][FILESERVER$@DS.EXAMPLE.COM] at [Wed, 18 Mar 2020 00:51:45.001031 CET] with [aes256-cts-hmac-sha1?96] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:10.0.1.100:51352] became [EXAMPLE][FILESERVER$] [S?1?5?21?1451753080?56...

...connection) single_accept_connection: accept: NT_STATUS_TOO_MANY_OPENED_FILES [2018/04/22 14:47:01.240682, 0] ../source4/smbd/process_single.c:57(single_accept_connection) single_accept_connection: accept: NT_STATUS_TOO_MANY_OPENED_FILES [2018/04/22 22:21:57.770716, 2] ../auth/auth_log.c:760(log_authentication_event_human_readable) Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[DC01$@SAMDOM.SVMETAL.CZ] at [Sun, 22 Apr 2018 22:21:57.770692 CEST] with [(null)] status [NT_STATUS_NO_SUCH_USER] workstation [(null)] remote host [ipv4:192.168.1.1:43281] mapped to [(null)]\[(null)]. local host [NULL] [2018/04/2...

...svol on the samba 4 ADDC (DC1) from this same computer. My log.smbd shows the following: #> tail log.smbd check_ntlm_password: Authentication for user [tech] -> [tech] FAILED with error NT_STATUS_NO_LOGON_SERVERS, authoritative=1 [2020/11/09 20:58:45.144324, 2] ../../auth/auth_log.c:653(log_authentication_event_human_readable) Auth: [SMB2,(null)] user [CROSSFIRE]\[tech] at [Mon, 09 Nov 2020 20:58:45.144299 EST] with [NTLMv2] status [NT_STATUS_NO_LOGON_SERVERS] workstation [CROSSFIRE-EDITI] remote host [ipv4:192.168.11.20:58682] mapped to [CROSSFIRE]\[tech]. local host [ipv4:192.168.11.3:445] {"timestamp"...

...2.953703,? 2] > ../source4/auth/ntlm/auth.c:475(auth_check_password_recv) > ? auth_check_password_recv: sam authentication for user > [COMPANY\domainuser] FAILED with error NT_STATUS_WRONG_PASSWORD, > authoritative=1 > [2019/11/06 15:27:32.953814,? 2] > ../auth/auth_log.c:760(log_authentication_event_human_readable) > ? Auth: [winbind,(null)] user [COMPANY]\[domainuser] at [Wed, 06 Nov > 2019 15:27:32.953792 CET] with [NTLMv1] status > [NT_STATUS_WRONG_PASSWORD] workstation [DC1] remote host > [ipv4:127.0.0.1:0] mapped to [COMPANY]\[domainuser]. local host > [ipv4:127.0.0.1:0] > [20...

...nt NTLM from being used?? [2018/10/09 17:49:29.507046,  2] ../source3/auth/auth.c:332(auth_check_ntlm_password)  check_ntlm_password:  Authentication for user [MYUSER] -> [MYUSER] FAILED with error NT_STATUS_NO_LOGON_SERVERS, authoritative=1[2018/10/09 17:49:29.507074,  2] ../auth/auth_log.c:760(log_authentication_event_human_readable)  Auth: [SMB2,(null)] user [MYDOMAIN]\[MYUSER] at [Tue, 09 Oct 2018 17:49:29.507062 -03] with [NTLMv2] status [NT_STATUS_NO_LOGON_SERVERS] workstation [MACHINENAME] remote host [ipv4:192.168.1.1:1109] mapped to [MYDOMAIN]\[MYUSER]. local host [ipv4:10.0.0.1:445]   Em quarta-feira, 10 de out...