I keep getting these logs in my /var/log/auth.log every 10-20 seconds:

Jun 22 11:31:12 debian smbd[1795]: pam_unix(samba:session): session closed for user nobody
Jun 22 11:31:08 debian smbd[1794]: pam_unix(samba:session): session closed for user nobody
Jun 22 11:30:44 debian smbd[1779]: pam_unix(samba:session): session closed for user nobody

How can I stop this? I checked my port and this what I got:

root@debian:/home/debian# netstat -ap | grep smbd
tcp        0      0 *:netbios-ssn           *:*                     LISTEN      19317/smbd
tcp        0      0 *:microsoft-ds          *:*                     LISTEN      19317/smbd
tcp6       0      0 [::]:netbios-ssn        [::]:*                  LISTEN      19317/smbd
tcp6       0      0 [::]:microsoft-ds       [::]:*                  LISTEN      19317/smbd
unix  2      [ ]         DGRAM                    583178168 19317/smbd          /var/cache/samba/msg/19317
unix  2      [ ]         DGRAM                    583178311 19349/smbd          /var/cache/samba/msg/19349

root@debian:/home/debian# netstat -ap | grep samba
unix  2      [ ACC ]     STREAM     LISTENING     583178532 19378/nmbd          /var/run/samba/nmbd/unexpected
unix  2      [ ]         DGRAM                    583178168 19317/smbd          /var/cache/samba/msg/19317
unix  2      [ ]         DGRAM                    583178311 19349/smbd          /var/cache/samba/msg/19349
unix  2      [ ]         DGRAM                    583178517 19378/nmbd          /var/cache/samba/msg/19378

How can I stop the Samba log from making that "PAM session closed" message?

I wonder if an approach similar to this one could be utilized here, see this Q&A titled: cron+pam heavily spamming my logs. In this Q&A the following was used to quiet a cron log that was "spamming" the logs in a similar way:

session     [success=1 default=ignore] pam_succeed_if.so service in cron quiet use_uid

I believe in your scenario you'd need to modify the cron to smd, like so:

session     [success=1 default=ignore] pam_succeed_if.so service in smbd quiet use_uid

I'm not 100% on which file to modify and don't have a Debian system handy to fully vet this. I believe it'll be a file under this directory: /etc/pam.d/, you'll have to play with it to determine which file exactly.

Incidentally, the messages are occurring because the shell that is defined for the user, nobody, is set to something like /bin/false or /bin/noshell and this is what's leading to these messages showing up in the auth.log file.

References

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.