Samba and AuditD

[Steve Grubb]

Hello,

Moderator system is acting up. But it'll go through eventually.

On Wednesday, February 10, 2021 3:41:45 PM EST Alan Evangelista wrote:
> I have installed audit 2.8.5 on a CentOS 7 and set up the following rule in
> /etc/audit/rules.d/audit.rules:
> 
> -w /data
> 
> /data is shared via Samba to a Windows Server 2016 system. If I write to
> /data in the CentOS7 system, I get the open syscall event in the auditd
> log. If I write to the same directory in the Windows Server 2016, I see the
> file in the /data directory in the CentOS7 system, but the event is not
> logged by audit. Is that the expected behavior?

Unfortunately, yes. The Linux kernel has no idea who the user is in the 
Windows machine since they're not really logged in. This applies to all 
remote files systems. They may yield a few events, but that is more by 
accident than design.

-Steve