similar to: Samba Audit Logs

On Sat, 5 May 2018 11:11:21 -0300 "Ethy H. Brito via samba" <samba at lists.samba.org> wrote: > On Sat, 5 May 2018 23:40:47 +1000 > Robin G via samba <samba at lists.samba.org> wrote: > > ... > > > > full_audit:prefix = %u|%I|%S > > full_audit:failure = none > > full_audit:success = mkdir rmdir read pread write pwrite

On Sun, 6 May 2018 20:05:20 +1000 Robin G <robinghere3 at gmail.com> wrote: > Hi Rowland, > here is the smb.conf. All shares have the full_audit > > [global] > workgroup = RESOLVS > netbios name = DC1 > security = USER > obey pam restrictions = yes > local master = yes > domain master = yes > preferred

I think the issue is permissions related. I changed the log location to /tmp/audit.log and now it is populating. What should be the permissions for /var/log/samba/audit.log? On Mon, May 7, 2018 at 12:29 AM, Robin G <robinghere3 at gmail.com> wrote: > Hi Rowland, > > Thank you. > > I tried both options. The following is using option 2 > [global] > vfs objects =

Hi Rowland, here is the smb.conf. All shares have the full_audit [global] workgroup = RESOLVS netbios name = DC1 security = USER obey pam restrictions = yes local master = yes domain master = yes preferred master = yes domain logons = yes os level = 50 #### LDAP definitions #### ### Logging syslog = 0 log file =

Hi Rowland, Thank you. I tried both options. The following is using option 2 [global] vfs objects = full_audit [homes] create mask = 0700 directory mask = 0700 browseable = No read only = No path = %H full_audit:prefix = %u|%I|%S full_audit:failure = none full_audit:success = mkdir rmdir read pread write pwrite rename unlink

Hello, I'm trying to send Dovecot logs to a Graylog server. To do this, I'd like to pass logs to rsyslog and rsyslog pass logs to remote Graylog server. I set in dovecot.conf : syslog_facility = local5.info I set in rsyslog.conf : local5.info @192.168.xxx.xxx:5555 Restarted services and it doesn't work. I use nmap to test if port 5555 is opened and this port is open. What

Hello all, Recently I,ve activated the Samba vfs audit module on my CentOS server. Then, I configured syslog to save the events, how open files, create directories.. in /var/log/samba/audit.log, but the same information are being stored in /var/log/messages too.. How I can configure Syslog to store this informations only in messages log file? Bellow, a part of my syslog.conf

Well, Despite I've recently answered about vfs object recycle on this list, it seems that it isn't working as excepted. Using Samba 4.4.5, compiled from sources Here is the conf for a share: [musique] path = /media/data/musique read only = No vfs objects = acl_xattr recycle recycle:directory_mode = 0770 recycle:subdir_mode = 0700

On 04/18/2016 07:09 PM, lingpanda101 at gmail.com wrote: > On 4/18/2016 12:52 PM, Johannes Amorosa | Celluloid VFX wrote: >> >> On 04/15/2016 04:36 PM, lingpanda101 at gmail.com wrote: >>> On 4/15/2016 10:08 AM, Johannes Amorosa | Celluloid VFX wrote: >>>> Hello, >>>> we're using sambas internal DNS server. >>>> >>>> Is

here it is ---- [global] workgroup = all server string = Samba Server load printers = no security = user max log size = 200 time server = yes local master = no os level = 10 log file = /var/log/samba/log.%I printcap name = /dev/null netbios name = new07server-fst # log level = 2 acls:10

Hello everyone, We have some chrooted sftp-only users on a CentOS release 6.6 server. The server had been logging their actions, but after recent updates the logs have stopped. The server correctly logs non-chrooted users: Sep 14 17:47:24 vsecure4 sshd[1981]: Accepted publickey for jcours from 192.168.10.166 port 42545 ssh2 Sep 14 17:47:24 vsecure4 sshd[1981]: pam_unix(sshd:session):

In dealing with an unrelated issue I came across this in rsyslog.conf. # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* -/var/log/maillog # Log cron stuff cron.* /var/log/cron Why is there a "-"

HI all, So I'd like to log the user's operations on some shares. As I need to know who made what when. I'd read a previous answer from Andrew about auditing, so I can see loggued operations. Modified smb.conf : > [global] > vfs objects = dfs_samba4, acl_xattr, full_audit > full_audit:success =none > full_audit:failure = none share is : > [journal] > path =

Hello, We have a problem with our Samba server (we tested with two versions 3.6.6 and 4.1.11). When a User edit an Excel file and saves, another user can not save this edited later. The temporary file named like 885E9010 will be created and Excel reports that this file can not be accessed. I have test it with Windows and Mac. Both have the same Problem. This is our samba configuration:

On 06. aug. 2018 16:37, Oleg Cherkasov via samba wrote: > On 06. aug. 2018 15:15, Oleg Cherkasov via samba wrote: >> >> This morning three of our FreeBSD-11.1-p11 servers with Samba 4.7.7 >> installations started to ignore ACL settings and reject user access to >> shares.  All three servers are members of DC running on Windows Server >> 2008R2.  Everything has

Hello, the last two days i have problems with my AD group which is defined in share setting valid users Winbind looks to lost mapping of this group and so no user can connect to this share anymore. When restart winbind service mapping works again until mapping lost again. ls -lsa shows me in issue this: 2 4 drwxr-x--- 63 root 12001

Hi!! I dont sucess in ssh with user my domain, in my Filserver(Member) Samba 4.7.3 Compilated Ubuntu 16.04 # smb.conf [global]         workgroup = XXXXX         realm = INTERNO.XXX.XXXX.BR         security = ADS         username map = /usr/local/samba/etc/user.map         dedicated keytab file = /etc/krb5.keytab         kerberos method = secrets and keytab         winbind cache time =

HI! I have one fileserve, has ok but now when change permission(oyher user not Administrator) with RSAT show me message: "Failed to enumerate objects in the container. Access is denied" Samba Version (Compilated) 4.7.3 Ubuntu 16.04 # smb.conf [global]         workgroup = XXXXX         realm = INTERNO.XXXXX.XXX.BR         security = ADS         username map =

Hi Rowland here is it: [global] netbios name = ID-175 security = ADS workgroup = HQKONTRAST realm = HQ.KONTRAST dedicated keytab file = /etc/krb5.keytab kerberos method = secrets and keytab winbind trusted domains only = no winbind use default domain = yes winbind enum users = yes winbind enum groups = yes winbind

Am 07.09.18 um 20:07 schrieb Rowland Penny via samba: > On Fri, 7 Sep 2018 19:09:37 +0200 > "Stefan G. Weichinger via samba" <samba at lists.samba.org> wrote: >> But >> >> # net rpc rights grant "Domänen-Admins" SeDiskOperatorPrivilege -U >> "mydomain\administrator" >> >> fails >> >> also for