similar to: Need IP on failed logins in logfile

I used to also get related log messages of the form: auth_check_password_send: Checking password for unmapped user [HPRS]\[mark]@[ROVER] auth_check_password_send: mapped user is: [HPRS]\[mark]@[ROVER] but now all I get is the auth_check_password_recv in the log. Perhaps the change is due to an upgrade to Samba, or perhaps a change I made to my smb.conf log options? (see log config in my

On Sun, 26 Jun 2016 09:24:16 Rowland penny <rpenny at samba.org> wrote: > ... > So, if you are looking for an ipaddress of a failed login attempt, it > seems you can get it. That looked interesting. I tried creating the logfile /var/log/samba/.log.samba.%m and restart samba. What it did was immediately create separate log files for each currently attached workstation:

On 26/06/16 06:16, Mark Foley wrote: > I used to also get related log messages of the form: > > auth_check_password_send: Checking password for unmapped user [HPRS]\[mark]@[ROVER] > auth_check_password_send: mapped user is: [HPRS]\[mark]@[ROVER] > > but now all I get is the auth_check_password_recv in the log. Perhaps the change is due to an > upgrade to Samba, or perhaps

Maurik, You are right. I am currently using 4.1.17 and have the same failed login messages as you describe. There is, however, a bit more information further down in the logfile: [2015/10/07 16:51:24.076283, 2] authentication for user [HPRS/Administrator] FAILED with error NT_STATUS_WRONG_PASSWORD auth_check_password_send: Checking password for unmapped user [HPRS]\[Administrator]@[ROVER]

This may have been asked before, but I can't find it. I am getting repeated external attempted to log into our AD/DC (running Samba 4.4.14). In /var/log/samba/log.samba I get entried like: 2017/09/19 05:02:25.562957, 2] ../source4/auth/ntlm/auth.c:430(auth_check_password_recv) auth_check_password_recv: sam_ignoredomain authentication for user [HPRS\333] FAILED with error

On Mon, 16 Apr 2018 14:12:02 -0400 Mark Foley via samba <samba at lists.samba.org> wrote: > Still having daily problems. Yesterday, again, I reset the user > password from the AD/DC as the domain administrator: samba-tool user > setpassword mark > > Today, I was unable to log in. The only message in the log.samba file > is: > > [2018/04/16 14:02:12.199145, > 2]

I'm having a very annoying problem I can't figure out. I've been running Samba4 as our office AD/DC for several years. This is a recent problem. Whenever I Remote Desktop into a particular Windows workstation (192.168.0.4) I get the following message in /var/log/samba/log.samba: Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[mark at HPRS] at [Thu, 17 Jan 2019

I've setup samba4 to authenticate against a separate LDAP server. I can ssh to my server but attempts to login to a windows7 member server using the ldap domain are not working. Relevant errors: [2014/07/18 06:46:28.177400, 3] ../source4/auth/ntlm/auth.c:270(auth_check_password_send) auth_check_password_send: Checking password for unmapped user [ldapdom]\[user]@[win7host]

On 25/06/16 21:48, mj wrote: > > > On 06/25/2016 06:32 PM, Mark Foley wrote: >> I think I've read something on this before, but I can't seem to find it. > As far as we know, this is impossible. :-( > > It a feature we would also VERY much like to see, for exactly the same > reason. > > MJ > never actually tried this, but couldn't you use pam_tally

Need help on this. My account is locked out. Need way to reset. --Mark -----Original Message----- Date: Fri, 13 Apr 2018 14:49:44 -0400 Organization: Ohio Highway Patrol Retirement System To: samba at lists.samba.org Subject: Re: [Samba] How to change Domain password as normal user? On Thu, 5 Apr 2018 16:59:15 +0100 Rowland Penny <rpenny at samba.org> wrote: > > On Thu, 05 Apr 2018

Hi, Since I really would like some more info (specifically: remote ip address) to be logged with failed password attempts, I have tried to edit the samba source code. :-) Anyway, I changed in source4/auth/ntlm/auth.c > if (tevent_req_is_nterror(req, &status)) { > DEBUG(2,("auth_check_password_recv: " > "%s authentication for user [%s\\%s] " >

On Sat, 19 Jan 2019 19:03:58 +0000 Rowland Penny wrote: > > On Sat, 19 Jan 2019 13:37:18 -0500 > Mark Foley via samba <samba at lists.samba.org> wrote: > > > I sure could use some help on this. Perhaps this problem is due to a > > recent Windows update? > > > > I have determined that whenever I log into the Windows 7 host > > DBSERVER from any

Well, I've just added another directory to not make the redirected folders a the root. And, Favorites and Documents do work. Goog suggestion to check the Windows event viewer. I'll do that and get back with what I find. Thanks, --Mark -----Original Message----- > To: samba at lists.samba.org > From: James <lingpanda101 at gmail.com> > Date: Tue, 1 Sep 2015 08:14:06 -0400

Hi, In the past (2 months ago) : I have two AD Domain under Samba 4.1 : A and B. I war able to  connect a share in A from B. Now (after upgrade) : I have a W2016 domain (B) and a Samba 4.6 domain (A) but I can't connect a share in A from B. The user from B which try to connect the share in A has the same login in the two domains. So since the upgrade I don't have the same behavior

Hi, I have been having issues with NTLMv2 on newly provisioned domains, using Samba 4.1 from backports on Debian Wheezy. Everything seems to be working fine, except for NTLMv2 authentication with Squid and "ntlm_auth" on newer Windows versions. If I set "Lmcompatibility" down on the Windows PCs, then authentication works, but that is temporary workaround at best. I have

Hi Jeremy, list, On 06/26/2016 12:11 AM, Jeremy Allison wrote: > We should probably have something in the server that logs > this as an official "event". Can someone log a RFE bug in > the bugzilla so we don't forget this request ? I created this bug: https://bugzilla.samba.org/show_bug.cgi?id=11998 I hope it is (approximately) what you mean. :-) Best regards, MJ

Hi all, I am running a Samba 4.2.14 Active Directory server on Debian and it is working fine. I have Windows workstations, Linux servers and some web services authenticate against the Samba AD. The only thing that I am missing is a proper logging for the authentication events on this system. Especially in case of web services, which are using LDAP authentication against Samba, from the logs I can

New to linux and new to Samba so any direction in troubleshooting would be helpful. Here is what I have so far. Within a half an hour of a reboot of the server my cpu reaches high numbers and becomes slow to respond on all actions. With my limited understanding I have used vmstat to observe the system. I noticed is that the numbers of forks grows from 1-2k to 43k within 30 minutes after reboot. I

I have a problem I've not been able to figure out. I'm using Samba4 as the office AD/DC. I've set up the Redirected Folders policy to redirect Desktop, Favorites and Documents to \\mail.hprs.local. I set this up months ago and it works great for Documents and Favorites, but Desktop is not redirected (no Desktop): $ ls -l /redirectedFolders/Users/thisuser/ total 16 drwxrwx---+ 10

Hi, As I configured the Roaming profiles under linux, it more or less generate an abnormal operation (in less than 2 mins) if I add/copy some files to the home directory. But for Windows XP and Windows 7 is running smoothly and it generates folders at the Samba4 server location with corresponding users. e.g. Administrator (for XP), and Administrator.V2 (for Win7/2008) based on my observations. I