LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Server (https://www.linuxquestions.org/questions/linux-server-73/)
-   -   who deleted share file/folder in samba ? (https://www.linuxquestions.org/questions/linux-server-73/who-deleted-share-file-folder-in-samba-670454/)

megerdin 09-17-2008 04:10 AM

who deleted share file/folder in samba ?
 
Hello everyone
Is there any way to know who deleted samba share dir/file?


I have running samba server on FC7 machine, and my user machine is windows.


any help please!!

TB0ne 09-17-2008 08:47 AM

Quote:

Originally Posted by megerdin (Post 3282884)
Hello everyone
Is there any way to know who deleted samba share dir/file?

I have running samba server on FC7 machine, and my user machine is windows.

It depends....was it deleted from a Windows workstation, or from the Linux system?

From Windows, you could always go check the recycle bin's on different folks desktops, and see if your folder is there. From Linux, check the shell history files of the different users, and see if there's someone who deleted it.

megerdin 09-18-2008 12:34 AM

Quote:

From Windows, you could always go check the recycle bin's on different folks desktops
I didn't understands ur recycle bin's on different folks desktops word.


what do u mean by this line?

would you please make a little clear this line ?

jschiwal 09-18-2008 12:58 AM

If you have a publicly writable share, you should use "security = user" instead of "security = share", which is obsolete, so each user needs to authenticate. Also set the "sticky" bit on the directory being shared. That prevents one user from deleting another users files inside the directory. It is still up to the user saving a file to modify the write permissions of the file to prevent other users from altering or zeroing the file.

You could enable auditing in the kernel. The filesytem you use would need to support it.

megerdin 09-18-2008 02:11 AM

Quote:

You could enable auditing in the kernel
How to enable please!

megerdin 09-18-2008 04:40 AM

hel-l-l-ooooooooooooo

I got this work.I just add the following line in my smb.conf


Quote:

vfs objects = extd_audit

Now I can trace there work in samba log......

special thanks to Ubuntu Forums

TB0ne 09-18-2008 08:06 AM

Quote:

Originally Posted by megerdin (Post 3283994)
I didn't understands ur recycle bin's on different folks desktops word.


what do u mean by this line?

would you please make a little clear this line ?

Seems clear to me....go to the different Windows workstations, and look in the recycle bin.


All times are GMT -5. The time now is 06:07 PM.