Koozali.org: home of the SME Server

Obsolete Releases => SME 7.x Contribs => Topic started by: Jáder on August 11, 2006, 11:14:52 PM

Title: Samba audit
Post by: Jáder on August 11, 2006, 11:14:52 PM

Hi

I'd like to know if someone know how to enable samba audit.
I see on a Brazilian site ( http://www.dicas-l.com.br/dicas-l/20050308.php )

Important things for those do not speak Portuguese:

Edit o smb.conf to add line "vfs object = audit" on share to have audit:
  [documents]
   comment = documents
   path = /home/documents
   writable = yes
   browseable = yes
   admin users = renato
   vfs object = audit

To audit the share must add this line on syslog.conf

Code: [Select]


  #Samba audit user.*;user.!warn;authpriv.none;cron.none;mail.none;news.none   /var/log/samba/audit.log

Log sample (/var/log/samba/audit.log)

  Oct 26 17:54:52 server smbd_audit[7496]: connect to service documentos by user renato
  Oct 26 17:54:52 server smbd_audit[7496]: opendir ./
  Oct 26 17:55:08 server smbd_audit[7496]: opendir documentos
  Oct 26 17:55:15 server smbd_audit[7496]: unlink ./arquivo.txt

There are a package to audit logs named  smbd_audit.
It's like a SARG to Samba (requires just PHP + perl).
It's a cron script to get data from audit.log e save to Mysql.

More info at: http://sourceforge.net/projects/smbdaudit/

My first tought was to do just like we do for RecycleBin:

Code: [Select]

db accounts <ibayname> setprop vfs object audit
signal-event ibay-modify <ibayname>


Not sure if it would work... RecycleBin was just RecycleBin enable and this one has a double word with a parameter and not just enable.

I'm without a test machine to try it and going to vacancy in 36 hours... :) not a good time to make tests on my server.

Any thoughts are welcome.

Thanks


Jáder

Title: Samba audit
Post by: Franco on August 11, 2006, 11:46:33 PM

Install SME7admin and that will log all the connections to Mysql, with that contrib you'll be half-way there.

Title: Samba audit
Post by: Jáder on August 12, 2006, 02:43:49 PM

Hi Stuntshel

I appreciate your tip, but what I'm trying to do is to have log of use of ibays not mysql.
Do you know how to modify ibay (I prefer db config command way) to put this new parameter on a ibay?

Thanks

Jáder

Title: Samba audit
Post by: genzil on August 12, 2006, 06:35:09 PM

That's what he said.

Quote

will log all the connections to Mysql

I'll word it differently:

Install SME7admin and that will log all the use of samba to Mysql, with that contrib you'll be half-way there.