I have users authenticating with squid (NTLM) to an Active Directory server using Samba 3.5.4 and I'd like to log users' login attempts.
I'd like a line showing something like:
TIMESTAMP username@DOMAIN SUCCESS/FAILURE
On the samba log files, authentication-related information is tagged with the
Here are some examples. The name of the user was replaced with
There are other messages beyond these two. These lines were produced by a Samba from the backports repository of lenny. The samba version is 3.5.6, the actual package version is 2:3.5.6~dfsg-3~bpo50+1. The exact configuration for logging on
if you're hitting AD, then you should see the logon attempts in the "security log". It should contain not only the username, but also the source IP (which should be your squid host).
Here's a good article on setting it up: http://www.windowsecurity.com/articles/windows-active-directory-auditing.html
I would caution on auditing success though, as it tends to fill up the logs fast.
If you modify the
You do get the information I'm after (by default logged to