1

I keep getting these logs in my /var/log/auth.log every 10-20 seconds:

Jun 22 11:31:12 debian smbd[1795]: pam_unix(samba:session): session closed for user nobody
Jun 22 11:31:08 debian smbd[1794]: pam_unix(samba:session): session closed for user nobody
Jun 22 11:30:44 debian smbd[1779]: pam_unix(samba:session): session closed for user nobody

How can I stop this? I checked my port and this what I got:

root@debian:/home/debian# netstat -ap | grep smbd
tcp        0      0 *:netbios-ssn           *:*                     LISTEN      19317/smbd
tcp        0      0 *:microsoft-ds          *:*                     LISTEN      19317/smbd
tcp6       0      0 [::]:netbios-ssn        [::]:*                  LISTEN      19317/smbd
tcp6       0      0 [::]:microsoft-ds       [::]:*                  LISTEN      19317/smbd
unix  2      [ ]         DGRAM                    583178168 19317/smbd          /var/cache/samba/msg/19317
unix  2      [ ]         DGRAM                    583178311 19349/smbd          /var/cache/samba/msg/19349

root@debian:/home/debian# netstat -ap | grep samba
unix  2      [ ACC ]     STREAM     LISTENING     583178532 19378/nmbd          /var/run/samba/nmbd/unexpected
unix  2      [ ]         DGRAM                    583178168 19317/smbd          /var/cache/samba/msg/19317
unix  2      [ ]         DGRAM                    583178311 19349/smbd          /var/cache/samba/msg/19349
unix  2      [ ]         DGRAM                    583178517 19378/nmbd          /var/cache/samba/msg/19378

How can I stop the Samba log from making that "PAM session closed" message?

1

2 Answers 2

1

I wonder if an approach similar to this one could be utilized here, see this Q&A titled: cron+pam heavily spamming my logs. In this Q&A the following was used to quiet a cron log that was "spamming" the logs in a similar way:

session     [success=1 default=ignore] pam_succeed_if.so service in cron quiet use_uid

I believe in your scenario you'd need to modify the cron to smd, like so:

session     [success=1 default=ignore] pam_succeed_if.so service in smbd quiet use_uid

I'm not 100% on which file to modify and don't have a Debian system handy to fully vet this. I believe it'll be a file under this directory: /etc/pam.d/, you'll have to play with it to determine which file exactly.

Incidentally, the messages are occurring because the shell that is defined for the user, nobody, is set to something like /bin/false or /bin/noshell and this is what's leading to these messages showing up in the auth.log file.

References

1

The same issue happened to me, and commenting the following line in /etc/samba/smb.conf worked for me.

map to guest = bad user

"pam_unix(samba:session): session closed for user nobody" appeared right after trying to access the share folder from Windows or other clients. It seems Windows client tries to contact samba as guest (not verified) especially when no credential is configured in the credential manager.

You may also need to change the following if you do not need guest accessing (default = yes).

usershare allow guests = no

After updating /etc/samba/smb.conf and starting the service, samba clients are able to access the shared folder.

service smbd status

Starting Samba SMB Daemon...
Started Samba SMB Daemon.
pam_unix(samba:session): session opened for user (username) by (uid=0)
pam_unix(samba:session): session closed for user (username)
pam_unix(samba:session): session opened for user (username) by (uid=0)
pam_unix(samba:session): session opened for user (username) by (uid=0)
pam_unix(samba:session): session closed for user (username)

This page helped me identify the cause.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .