LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 05-15-2010, 09:35 AM   #1
efciem
LQ Newbie
 
Registered: Nov 2008
Posts: 6

Rep: Reputation: 0
[SAMBA] How to track windows user access , create files /modify files on linux SMB


Hello,

I have a SAMBA server setup on a Fedora box in my office, I will be using it to share out company documents.

I am looking for a way to log SMB client connections from Windows workstations ( Each employee has an account that they authenticate with, they have a linux username that is = to their windows username that they use to auth to the linux SMB shares with.

I would like to log a.) When a particular user Creates a file or folder on the share , b.) When a user deletes a file or folder from the share, and c.) When a user modifies an existing file or folder on the share...


Does anyone know what I could do to enable logging to log all these things? I can create a script to parse out the details from a log if it can be captured.

In fact even a method of logging when a user accesses a folder or file would be sufficient as I can track File creation and file modification already and can script a date/time comparrison to join the access log statements with the file change report information.


I hope thats a clear enough description, sure could use some help.

Thanks

Last edited by efciem; 05-16-2010 at 08:45 AM.
 
Old 05-15-2010, 01:42 PM   #2
marozsas
Senior Member
 
Registered: Dec 2005
Location: Campinas/SP - Brazil
Distribution: SuSE, RHEL, Fedora, Ubuntu
Posts: 1,393
Blog Entries: 1

Rep: Reputation: 64
Samba has an audit module that I think can do what you want.
For example, in my instalation, a typical output is:
Code:
May  7 13:05:26 bigslam smbd_audit: tatiane.falasca|192.168.160.24|stc-081|rh|unlink|ok|RECURSOS HUMANOS/volume03.doc
May  3 18:16:59 bigslam smbd_audit: erika|192.168.160.126|stc-057|at|open|ok|r|2010/Doctos scanneados/CTPS Paulo 3.JPG 
May  3 18:16:59 bigslam smbd_audit: erika|192.168.160.126|stc-057|at|pwrite|ok|2010/Doctos scanneados/B5a00196 
May  3 18:16:59 bigslam smbd_audit: erika|192.168.160.126|stc-057|at|rename|ok|2010/Doctos scanneados/Registro Paulo.zip|Lixeira/2010/Doctos scanneados/Copy #4 of Registro Paulo.zip
In this output you can see the date, the server name, the samba auditing module name, the user name, the IP of the windows client, the windows machine name, the name of the samba share (in this case, "rh" and "at"), the operation (which could be mkdir, rename, unlink, rmdir, open, and pwrite) the status of operation (and the open mode), and finally, the name of file in the share.

To use it, install the samba audit module, and in the smb.conf, in a share definition:
Code:
...
[Marketing]
	comment = Marketing
	path = ...
	valid users = ...
	vfs objects = full_audit
	full_audit:failure = none
	full_audit:success = mkdir rename unlink rmdir open pwrite
	full_audit:prefix = %u|%I|%m|%S

...
There are some more options in this module, but you got the idea.
I hope it helps.
 
Old 05-16-2010, 08:45 AM   #3
efciem
LQ Newbie
 
Registered: Nov 2008
Posts: 6

Original Poster
Rep: Reputation: 0
Thanks,
That was exactly what I was looking for.

I owe you, thanks again.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
To access files on SAMBA installed Linux from Windows ahmed73 Suse/Novell 1 02-27-2008 01:34 AM
hiding log files of samba from windows user pmember01 Linux - Newbie 1 02-04-2008 08:49 AM
10.2 can't modify files on windows share through SMB ajsitch Suse/Novell 2 01-19-2007 08:55 AM
can't create/modify files in a samba share deadslota Linux - Newbie 4 08-07-2004 10:26 PM
short smb question (create files) CarLost Linux - Networking 5 06-14-2004 09:58 AM


All times are GMT -5. The time now is 04:57 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration