Samba Logging for Audit Trails

Listing 1. Log Entries from /var/log/samba/log.smbd

[2003/11/25 17:13:12, 0] smbd/server.c:main(791)
    smbd version 2.2.8a started.
  Copyright Andrew Tridgell and the \
    Samba Team 1992-2002
[2003/11/25 17:17:32, 0] \
    rpc_server/srv_netlog_nt.c:_net_sam_logon(643)
  Logon . Domain:[NETDOMAIN].\
    HostName:[192.168.0.15]. \
    User:[john]. FAILED No Such User
[2003/11/25 17:17:55, 0] \
    rpc_server/srv_netlog_nt.c:_net_sam_logon(665)
  Logon . Domain:[NETDOMAIN]. \
    HostName:[192.168.0.15]. \
    User:[bill]. FAILED Incorrect Password
[2003/11/25 17:18:33, 0] \
    rpc_server/srv_netlog_nt.c:_net_sam_logon(691)
  Logon . Domain:[NETDOMAIN]. \
    HostName:[192.168.0.15] \
    User:[bill] Successfully Logged On
[2003/11/25 17:19:34, 0] \
    smbd/chgpasswd.c:check_oem_password(836)
  check_oem_password: incorrect password length \
    (262218674) for user bill.
[2003/11/25 17:19:46, 0] \
    smbd/chgpasswd.c:chgpasswd(474)
  Password Change: user bill, \
    New password is shorter than minimum password \
    length = 8
[2003/11/25 17:21:29, 0] \
    smbd/chgpasswd.c:chat_with_program(450)
  Password Change . User:[bill] \
    Password Successfully Changed
[2003/11/25 17:16:58, 0] \
    smbd/service.c:close_cnum(680)
  clientPC (192.168.0.15) \
    closed connection to service bill

Listing 2. DEBUG Calls Added to source/rpc_server/srv_netlog_nt.c

632  /* get the account information */
633  pdb_init_sam(&sampass);
634  become_root();
635  ret = pdb_getsampwnam(sampass, nt_username);
636  unbecome_root();
637
638
639  if (!ret)
640  {
641     pdb_free_sam(sampass);
642     // ESK
631  /* checks for failed users */
643     DEBUG(0,("Logon . Domain:[%s]. HostName: \
       [%s]. User:[%s]. FAILED No Such User \n",
             lp_workgroup(),
             client_addr(),
             nt_username));
644     return NT_STATUS_NO_SUCH_USER;
645  }
646
647  acct_ctrl = pdb_get_acct_ctrl(sampass);
630  map_username(nt_username);
.
.
.
663  /* Check for failed password */
664  if (!NT_STATUS_IS_OK(status)) {
665     DEBUG(0,("Logon . Domain:[%s]. HostName: \
   [%s]. User:[%s]. FAILED Incorrect Password \n",
             lp_workgroup(),
             client_addr(),
             nt_username));
666     pdb_free_sam(sampass);
667     return status;
668  }
.
.
.
669 /* Check PAM Password */
670 #ifdef WITH_PAM
671  become_root();
672  status =
   smb_pam_accountcheck(pdb_get_username(sampass));
673  unbecome_root();
674  if (!NT_STATUS_IS_OK(status)) {
675     pdb_free_sam(sampass);
676     DEBUG(0,("Logon . Domain:[%s]. HostName: \
   [%s]. User:[%s]. FAILED Incorrect Password \n",
                lp_workgroup(),
                client_addr(),
                nt_username));
677     return status;
678  }
679 #endif
.
.
.
690   /* Makes it to this point you have
         successfully logged on */
691   DEBUG(0,("Logon . Domain:[%s]. HostName: \
       [%s] User:[%s] Successfully Logged On\n",
                lp_workgroup(),
                client_addr(),
                nt_username));