Record failed authentication attempts in Samba

[corrupt3k]

An enterprise environment will likely have authentication enabled on their file shares.
To make it seem more realistic, guest access should not be allowed via Samba.

After taking away guest access, I do not see a valid way to record failed authentication attempts.

Or even recording connection attempts to the service would helpful. Similar to how the HTTP logging works.

[jayjb]

Hey @corrupt3k,

You correct that most shares would have some sort of Authentication however we haven't built monitoring for failed login attempts into OpenCanary so for now we leave guest access open. We only monitor file reads.

Ill definitely add this to the feature list because I think it would be a neat/nice addition. If you taking a stab at it, feel feel to bounce some ideas this way and we can chat about possible directions to take

[corrupt3k]

I was thinking of trying to utilize something like this: https://www.samba.org/samba/docs/current/man-html/vfs_audit.8.html

I also read that adding this line in smb.conf will log auth failure/success:
log level = 1 auth_audit:3

But I have no idea how to parse and alert on the output.

[jayjb]

hi @corrupt3k,

Im sorry i missed your reply. I think that may work. If you check in samba.py in modules, you will see how we handle the parsing of these kinds of logs.

I would suggest, adding the above to the smb.conf and seeing what the logs look like that are being created inside that log file. You can then decide whether to parse the lines using an extension of SambaLogWatcher or creating your own log watcher.

[pierre-louis-lgg]

hi jay

i have a problem with the way the logs work , you might be able ro help me
i am trying to use the same logs template as the opencanary (i am using wazuh to filter allerts and it does not recognise the smb template ) if you have information that could help. me it would be great.

i also have a prolem with the logs that are in 2 separate files (the opencanary default log and the samba log)