I have a very basic SMB share set up on a Debian machine, living in a largely windows workgroup.
I very deliberately have not set authentication up on the share, but I am interested in capturing who is browsing/connecting/accessing the share. In the log.smbd file I can see it captures domain credentials when a user connects, which is great:
Auth: [SMB2,(null)] user [DOMAIN]\[USERNAME] at [Mon, 20 Jan 2020 15:06:28.188511 GMT] with [NTLMv2] status [NT_STATUS_NO_SUCH_USER] workstation [HOSTNAME] remote host [ipv4:xx.xx.xx.xx] mapped to [DOMAIN]\[USERNAME]. local host [ipv4:xx.xx.xx.xx:445]
And I can strip those lines out, however I'm aware that what essentially happens is if the user cannot be found locally on the server, it authenticates as guest, which then is considered the user "nobody" in the logs, so when I find the access lines I get:
[2020/01/20 14:28:17.780310, 2] ../../source3/smbd/open.c:1452(open_file) nobody opened file private/passwords.txt read=No write=No (numopen=10)
To my mind there are three high level ways to achieve this:
- Some sort of access method similar to anonymous FTP, where I can ask for credentials but regardless of what is typed the user gets in (and hope people use their network credentials)
- When someone connects, create a new user for them on the fly based on their domain username
- Use a third party utility for monitoring the share (not ideal, a last resort)
But I can't seem to find a solution that matches the first two. Anyone have any ideas?