Logfile worries

[Jeff Vian]

On Mon, 2006-09-18 at 09:49 +0100, Anne Wilson wrote:
> I have logwatch mailing me daily about activity.  This morning the report from 
> this box has the following lines in the samba section:
> 
>  auth/auth_util.c:create_builtin_administrators(763)  
> create_builtin_administrators: Failed to create Administrators : 11 Time(s)
>  auth/auth_util.c:create_builtin_users(729)  create_builtin_users: Failed to 
> create Users : 11 Time(s)
>  auth/auth_util.c:create_local_nt_token(872)  create_local_nt_token: Failed to 
> create BUILTIN\Administrators group! : 11 Time(s)
>  auth/auth_util.c:create_local_nt_token(899)  create_local_nt_token: Failed to 
> create BUILTIN\Administrators group! : 11 Time(s)
> 
> It is a fact that we have problems when trying to connect an XP laptop to a 
> linux share on this box.  I often have to try several times before I can get 
> it to accept the password for that user, and this happened yesterday.  
> However, I have never before seen messages like the ones listed here.
> 
> Can someone please tell me what happened, according to those messages?  Should 
> I be worried?
> 
I would be.  

It is not likely a threat unless it is open on the internet with samba,
but definitely shows that the remote client connecting via samba is not
properly configured.  If you properly configure the client this would
not be getting logged.

Even more of concern is why the client is trying to connect as
Administrator.  Are you running as administrator on that machine?  If so
there is plenty of risk on the client as well.

> Anne
> -- 
> fedora-list mailing list
> fedora-list at redhat.com
> To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list