[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(219) check_ntlm_password: Checking password for unmapped user []\[]@[SERVICE-INFO-01] with the new password interface [2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(222) check_ntlm_password: mapped user is: [TOTEM]\[]@[SERVICE-INFO-01] [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235) fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:44, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235) fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(268) check_ntlm_password: guest authentication for user [] succeeded [2006/09/18 16:00:44, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(319) NTLMSSP Sign/Seal - Initialising with flags: [2006/09/18 16:00:44, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62) Got NTLMSSP neg_flags=0x60088215 [2006/09/18 16:00:44, 3] smbd/password.c:register_vuid(221) User name: nobody Real name: nobody [2006/09/18 16:00:44, 3] smbd/password.c:register_vuid(240) UNIX uid 65534 is UNIX user nobody, and will be vuid 102 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 26 of length 86 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtconX (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] lib/access.c:check_access(313) check_access: no hostnames in host allow/deny list. [2006/09/18 16:00:44, 2] lib/access.c:check_access(324) Allowed connection from (192.168.151.38) [2006/09/18 16:00:44, 3] smbd/service.c:make_connection_snum(543) Connect path is '/var/tmp' for service [IPC$] [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-501 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-514 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-32-546 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:44, 3] smbd/vfs.c:vfs_init_default(203) Initialising default vfs hooks [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-501 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-514 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-32-546 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/service.c:make_connection_snum(705) service-info-01 (192.168.151.38) connect to service IPC$ initially as user nobody (uid=65534, gid=65534) (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/reply.c:reply_tcon_and_X(326) tconX service=IPC$ [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 27 of length 100 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBntcreateX (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/nttrans.c:nt_open_pipe(503) nt_open_pipe: Known pipe samr opening. [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 28 of length 208 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860) api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:check_bind_req(732) check_bind_req for \PIPE\samr [2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74a9 nwritten=140 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 29 of length 63 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBreadX (pid 12833) [2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_read_and_X(242) readX-IPC pnum=74a9 min=1024 max=1024 nread=116 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 30 of length 199 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(102) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(219) check_ntlm_password: Checking password for unmapped user []\[]@[SERVICE-INFO-01] with the new password interface [2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(222) check_ntlm_password: mapped user is: [TOTEM]\[]@[SERVICE-INFO-01] [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(102) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(102) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235) fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:44, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235) fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(268) check_ntlm_password: guest authentication for user [] succeeded [2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74a9 nwritten=131 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 31 of length 248 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=160 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74a9)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_GET_DOM_PWINFO [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 22 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 32 of length 1304 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=1216 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74a9)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_CHGPASSWD_USER [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 2 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(102) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 3 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(102) : conn_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 3 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 0] smbd/chgpasswd.c:check_oem_password(832) check_oem_password: incorrect password length (886305395). [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 38 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 33 of length 45 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBclose (pid 12833) [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 34 of length 43 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBulogoffX (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/reply.c:reply_ulogoffX(1108) ulogoffX vuid=102 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 35 of length 39 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtdis (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/service.c:close_cnum(887) service-info-01 (192.168.151.38) closed connection to service IPC$ [2006/09/18 16:00:44, 3] smbd/connection.c:yield_connection(69) Yielding connection to IPC$ [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 36 of length 86 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtconX (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] lib/access.c:check_access(313) check_access: no hostnames in host allow/deny list. [2006/09/18 16:00:44, 2] lib/access.c:check_access(324) Allowed connection from (192.168.151.38) [2006/09/18 16:00:44, 3] smbd/service.c:make_connection_snum(543) Connect path is '/var/tmp' for service [IPC$] [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015 [2006/09/18 16:00:44, 3] smbd/vfs.c:vfs_init_default(203) Initialising default vfs hooks [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (531, 506) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/service.c:make_connection_snum(705) service-info-01 (192.168.151.38) connect to service IPC$ initially as user plegrand (uid=531, gid=506) (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/reply.c:reply_tcon_and_X(326) tconX service=IPC$ [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 37 of length 100 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBntcreateX (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (531, 506) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/nttrans.c:nt_open_pipe(503) nt_open_pipe: Known pipe samr opening. [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 38 of length 208 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860) api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:check_bind_req(732) check_bind_req for \PIPE\samr [2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74aa nwritten=140 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 39 of length 63 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBreadX (pid 12833) [2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_read_and_X(242) readX-IPC pnum=74aa min=1024 max=1024 nread=116 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 40 of length 272 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(219) check_ntlm_password: Checking password for unmapped user [TOTEM]\[plegrand]@[SERVICE-INFO-01] with the new password interface [2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(222) check_ntlm_password: mapped user is: [TOTEM]\[plegrand]@[SERVICE-INFO-01] [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] libsmb/ntlm_check.c:ntlm_password_check(282) ntlm_password_check: NT MD4 password check failed for user plegrand [2006/09/18 16:00:44, 3] auth/auth_winbind.c:check_winbind_security(80) check_winbind_security: Not using winbind, requested domain [TOTEM] was for this SAM. [2006/09/18 16:00:44, 2] auth/auth.c:check_ntlm_password(312) check_ntlm_password: Authentication for user [plegrand] -> [plegrand] FAILED with error NT_STATUS_WRONG_PASSWORD [2006/09/18 16:00:44, 1] rpc_server/srv_pipe.c:api_pipe_ntlmssp_verify(414) api_pipe_ntlmssp_verify: User [TOTEM]\[plegrand] from machine SERVICE-INFO-01 failed authentication on named pipe samr. [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:process_complete_pdu(752) process_complete_pdu: DCE/RPC fault sent on pipe lsass [2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74aa nwritten=204 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 41 of length 248 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=160 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74aa)Transaction 42 of length 45 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBclose (pid 12833) [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 43 of length 104 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBntcreateX (pid 12833) [2006/09/18 16:00:44, 3] smbd/nttrans.c:nt_open_pipe(503) nt_open_pipe: Known pipe lsarpc opening. [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 44 of length 140 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860) api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsass [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:check_bind_req(732) check_bind_req for \PIPE\lsarpc [2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74ab nwritten=72 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 45 of length 63 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBreadX (pid 12833) [2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_read_and_X(242) readX-IPC pnum=74ab min=1024 max=1024 nread=68 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 46 of length 188 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=100 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "lsarpc" (pnum 74ab)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: LSA_OPENPOLICY2 [2006/09/18 16:00:44, 3] rpc_parse/parse_lsa.c:lsa_io_sec_qos(181) lsa_io_sec_qos: length c does not match size 8 [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 830 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 47 of length 134 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=46 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "lsarpc" (pnum 74ab)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 512 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 48 of length 100 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBntcreateX (pid 12833) [2006/09/18 16:00:44, 3] smbd/nttrans.c:nt_open_pipe(503) nt_open_pipe: Known pipe samr opening. [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 49 of length 140 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860) api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:check_bind_req(732) check_bind_req for \PIPE\samr [2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74ac nwritten=72 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 50 of length 63 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBreadX (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (531, 506) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_read_and_X(242) readX-IPC pnum=74ac min=1024 max=1024 nread=68 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 51 of length 172 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=84 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74ac)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 52 of length 45 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBclose (pid 12833) [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 53 of length 100 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBntcreateX (pid 12833) [2006/09/18 16:00:44, 3] smbd/nttrans.c:nt_open_pipe(503) nt_open_pipe: Known pipe samr opening. [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 54 of length 140 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860) api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:check_bind_req(732) check_bind_req for \PIPE\samr [2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74ad nwritten=72 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 55 of length 63 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBreadX (pid 12833) [2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_read_and_X(242) readX-IPC pnum=74ad min=1024 max=1024 nread=68 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 56 of length 160 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=72 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_CONNECT4 [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 754 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 57 of length 164 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=76 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_OPEN_DOMAIN [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 732 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 58 of length 184 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=96 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_LOOKUP_NAMES [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 48 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 59 of length 140 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=52 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_OPEN_USER [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 1447 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 60 of length 132 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=44 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_GET_USRDOM_PWINFO [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 61 of length 236 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=148 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 62 of length 132 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=44 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_CLOSE_HND [2006/09/18 16:00:44, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) Closed policy [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 63 of length 132 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=44 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_CLOSE_HND [2006/09/18 16:00:44, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) Closed policy [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 64 of length 132 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=44 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_CLOSE_HND [2006/09/18 16:00:44, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) Closed policy [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 65 of length 45 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBclose (pid 12833) [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 66 of length 132 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=44 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "lsarpc" (pnum 74ab)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: LSA_CLOSE [2006/09/18 16:00:44, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) Closed policy [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 67 of length 45 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBclose (pid 12833) [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 68 of length 240 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBsesssetupX (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sesssetup.c:reply_sesssetup_and_X(638) wct=12 flg2=0xc807 [2006/09/18 16:00:44, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(518) Doing spnego session setup [2006/09/18 16:00:44, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(549) NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[] [2006/09/18 16:00:44, 3] smbd/sesssetup.c:reply_spnego_negotiate(427) Got OID 1 3 6 1 4 1 311 2 2 10 [2006/09/18 16:00:44, 3] smbd/sesssetup.c:reply_spnego_negotiate(430) Got secblob of size 40 [2006/09/18 16:00:44, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62) Got NTLMSSP neg_flags=0xe2088297 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 69 of length 292 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBsesssetupX (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sesssetup.c:reply_sesssetup_and_X(638) wct=12 flg2=0xc807 [2006/09/18 16:00:44, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(518) Doing spnego session setup [2006/09/18 16:00:44, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(549) NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[] [2006/09/18 16:00:44, 3] libsmb/ntlmssp.c:ntlmssp_server_auth(616) Got user=[] domain=[] workstation=[SERVICE-INFO-01] len1=1 len2=0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(219) check_ntlm_password: Checking password for unmapped user []\[]@[SERVICE-INFO-01] with the new password interface [2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(222) check_ntlm_password: mapped user is: [TOTEM]\[]@[SERVICE-INFO-01] [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235) fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:44, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235) fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(268) check_ntlm_password: guest authentication for user [] succeeded [2006/09/18 16:00:44, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(319) NTLMSSP Sign/Seal - Initialising with flags: [2006/09/18 16:00:44, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62) Got NTLMSSP neg_flags=0x60088215 [2006/09/18 16:00:44, 3] smbd/password.c:register_vuid(221) User name: nobody Real name: nobody [2006/09/18 16:00:44, 3] smbd/password.c:register_vuid(240) UNIX uid 65534 is UNIX user nobody, and will be vuid 103 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 70 of length 86 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtconX (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] lib/access.c:check_access(313) check_access: no hostnames in host allow/deny list. [2006/09/18 16:00:44, 2] lib/access.c:check_access(324) Allowed connection from (192.168.151.38) [2006/09/18 16:00:44, 3] smbd/service.c:make_connection_snum(543) Connect path is '/var/tmp' for service [IPC$] [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-501 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-514 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-32-546 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:44, 3] smbd/vfs.c:vfs_init_default(203) Initialising default vfs hooks [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-501 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-514 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-32-546 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/service.c:make_connection_snum(705) service-info-01 (192.168.151.38) connect to service IPC$ initially as user nobody (uid=65534, gid=65534) (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/reply.c:reply_tcon_and_X(326) tconX service=IPC$ [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 71 of length 100 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBntcreateX (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/nttrans.c:nt_open_pipe(503) nt_open_pipe: Known pipe samr opening. [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 72 of length 208 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860) api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:check_bind_req(732) check_bind_req for \PIPE\samr [2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74ae nwritten=140 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 73 of length 63 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBreadX (pid 12833) [2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_read_and_X(242) readX-IPC pnum=74ae min=1024 max=1024 nread=116 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 74 of length 199 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(103) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(219) check_ntlm_password: Checking password for unmapped user []\[]@[SERVICE-INFO-01] with the new password interface [2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(222) check_ntlm_password: mapped user is: [TOTEM]\[]@[SERVICE-INFO-01] [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(103) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(103) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235) fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:44, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235) fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(268) check_ntlm_password: guest authentication for user [] succeeded [2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74ae nwritten=131 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 75 of length 248 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=160 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74ae)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_GET_DOM_PWINFO [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 22 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 76 of length 1304 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=1216 params=0 setup=2 [2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74ae)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_CHGPASSWD_USER [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 2 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(103) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 3 [2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(103) : conn_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 3 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:44, 0] smbd/chgpasswd.c:check_oem_password(832) check_oem_password: incorrect password length (886305395). [2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 38 [2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890) Transaction 77 of length 45 [2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685) switch message SMBclose (pid 12833) [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 78 of length 43 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBulogoffX (pid 12833) [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/reply.c:reply_ulogoffX(1108) ulogoffX vuid=103 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 79 of length 39 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtdis (pid 12833) [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/service.c:close_cnum(887) service-info-01 (192.168.151.38) closed connection to service IPC$ [2006/09/18 16:00:46, 3] smbd/connection.c:yield_connection(69) Yielding connection to IPC$ [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 80 of length 100 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBntcreateX (pid 12833) [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (531, 506) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/nttrans.c:nt_open_pipe(503) nt_open_pipe: Known pipe samr opening. [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 81 of length 208 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860) api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:check_bind_req(732) check_bind_req for \PIPE\samr [2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74af nwritten=140 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 82 of length 63 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBreadX (pid 12833) [2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_read_and_X(242) readX-IPC pnum=74af min=1024 max=1024 nread=116 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 83 of length 272 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] auth/auth.c:check_ntlm_password(219) check_ntlm_password: Checking password for unmapped user [TOTEM]\[plegrand]@[SERVICE-INFO-01] with the new password interface [2006/09/18 16:00:46, 3] auth/auth.c:check_ntlm_password(222) check_ntlm_password: mapped user is: [TOTEM]\[plegrand]@[SERVICE-INFO-01] [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] libsmb/ntlm_check.c:ntlm_password_check(282) ntlm_password_check: NT MD4 password check failed for user plegrand [2006/09/18 16:00:46, 3] auth/auth_winbind.c:check_winbind_security(80) check_winbind_security: Not using winbind, requested domain [TOTEM] was for this SAM. [2006/09/18 16:00:46, 2] auth/auth.c:check_ntlm_password(312) check_ntlm_password: Authentication for user [plegrand] -> [plegrand] FAILED with error NT_STATUS_WRONG_PASSWORD [2006/09/18 16:00:46, 1] rpc_server/srv_pipe.c:api_pipe_ntlmssp_verify(414) api_pipe_ntlmssp_verify: User [TOTEM]\[plegrand] from machine SERVICE-INFO-01 failed authentication on named pipe samr. [2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:process_complete_pdu(752) process_complete_pdu: DCE/RPC fault sent on pipe lsass [2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74af nwritten=204 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 84 of length 248 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=160 params=0 setup=2 [2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74af)Transaction 85 of length 45 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBclose (pid 12833) [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 86 of length 104 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBntcreateX (pid 12833) [2006/09/18 16:00:46, 3] smbd/nttrans.c:nt_open_pipe(503) nt_open_pipe: Known pipe lsarpc opening. [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 87 of length 140 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860) api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsass [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:check_bind_req(732) check_bind_req for \PIPE\lsarpc [2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74b0 nwritten=72 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 88 of length 63 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBreadX (pid 12833) [2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_read_and_X(242) readX-IPC pnum=74b0 min=1024 max=1024 nread=68 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 89 of length 188 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=100 params=0 setup=2 [2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "lsarpc" (pnum 74b0)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: LSA_OPENPOLICY2 [2006/09/18 16:00:46, 3] rpc_parse/parse_lsa.c:lsa_io_sec_qos(181) lsa_io_sec_qos: length c does not match size 8 [2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 830 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 90 of length 134 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=46 params=0 setup=2 [2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "lsarpc" (pnum 74b0)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY [2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 512 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 91 of length 100 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBntcreateX (pid 12833) [2006/09/18 16:00:46, 3] smbd/nttrans.c:nt_open_pipe(503) nt_open_pipe: Known pipe samr opening. [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 92 of length 140 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860) api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:check_bind_req(732) check_bind_req for \PIPE\samr [2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74b1 nwritten=72 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 93 of length 63 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBreadX (pid 12833) [2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_read_and_X(242) readX-IPC pnum=74b1 min=1024 max=1024 nread=68 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 94 of length 172 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=84 params=0 setup=2 [2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b1)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 95 of length 45 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBclose (pid 12833) [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 96 of length 100 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBntcreateX (pid 12833) [2006/09/18 16:00:46, 3] smbd/nttrans.c:nt_open_pipe(503) nt_open_pipe: Known pipe samr opening. [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 97 of length 140 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860) api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:check_bind_req(732) check_bind_req for \PIPE\samr [2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74b2 nwritten=72 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 98 of length 63 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBreadX (pid 12833) [2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_read_and_X(242) readX-IPC pnum=74b2 min=1024 max=1024 nread=68 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 99 of length 160 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=72 params=0 setup=2 [2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_CONNECT4 [2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 754 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 100 of length 164 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (531, 506) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=76 params=0 setup=2 [2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_OPEN_DOMAIN [2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 732 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 101 of length 184 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=96 params=0 setup=2 [2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_LOOKUP_NAMES [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 48 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 102 of length 140 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=52 params=0 setup=2 [2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_OPEN_USER [2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 1447 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 103 of length 132 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=44 params=0 setup=2 [2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_GET_USRDOM_PWINFO [2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 104 of length 236 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=148 params=0 setup=2 [2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 105 of length 132 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=44 params=0 setup=2 [2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_CLOSE_HND [2006/09/18 16:00:46, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) Closed policy [2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 106 of length 132 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=44 params=0 setup=2 [2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_CLOSE_HND [2006/09/18 16:00:46, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) Closed policy [2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 107 of length 132 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=44 params=0 setup=2 [2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_CLOSE_HND [2006/09/18 16:00:46, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) Closed policy [2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 108 of length 45 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBclose (pid 12833) [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 109 of length 132 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=44 params=0 setup=2 [2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "lsarpc" (pnum 74b0)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: LSA_CLOSE [2006/09/18 16:00:46, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) Closed policy [2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 110 of length 45 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBclose (pid 12833) [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 111 of length 240 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBsesssetupX (pid 12833) [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/sesssetup.c:reply_sesssetup_and_X(638) wct=12 flg2=0xc807 [2006/09/18 16:00:46, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(518) Doing spnego session setup [2006/09/18 16:00:46, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(549) NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[] [2006/09/18 16:00:46, 3] smbd/sesssetup.c:reply_spnego_negotiate(427) Got OID 1 3 6 1 4 1 311 2 2 10 [2006/09/18 16:00:46, 3] smbd/sesssetup.c:reply_spnego_negotiate(430) Got secblob of size 40 [2006/09/18 16:00:46, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62) Got NTLMSSP neg_flags=0xe2088297 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 112 of length 292 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBsesssetupX (pid 12833) [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/sesssetup.c:reply_sesssetup_and_X(638) wct=12 flg2=0xc807 [2006/09/18 16:00:46, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(518) Doing spnego session setup [2006/09/18 16:00:46, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(549) NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[] [2006/09/18 16:00:46, 3] libsmb/ntlmssp.c:ntlmssp_server_auth(616) Got user=[] domain=[] workstation=[SERVICE-INFO-01] len1=1 len2=0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] auth/auth.c:check_ntlm_password(219) check_ntlm_password: Checking password for unmapped user []\[]@[SERVICE-INFO-01] with the new password interface [2006/09/18 16:00:46, 3] auth/auth.c:check_ntlm_password(222) check_ntlm_password: mapped user is: [TOTEM]\[]@[SERVICE-INFO-01] [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235) fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:46, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235) fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:46, 3] auth/auth.c:check_ntlm_password(268) check_ntlm_password: guest authentication for user [] succeeded [2006/09/18 16:00:46, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(319) NTLMSSP Sign/Seal - Initialising with flags: [2006/09/18 16:00:46, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62) Got NTLMSSP neg_flags=0x60088215 [2006/09/18 16:00:46, 3] smbd/password.c:register_vuid(221) User name: nobody Real name: nobody [2006/09/18 16:00:46, 3] smbd/password.c:register_vuid(240) UNIX uid 65534 is UNIX user nobody, and will be vuid 104 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 113 of length 86 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtconX (pid 12833) [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] lib/access.c:check_access(313) check_access: no hostnames in host allow/deny list. [2006/09/18 16:00:46, 2] lib/access.c:check_access(324) Allowed connection from (192.168.151.38) [2006/09/18 16:00:46, 3] smbd/service.c:make_connection_snum(543) Connect path is '/var/tmp' for service [IPC$] [2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-501 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-514 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-32-546 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:46, 3] smbd/vfs.c:vfs_init_default(203) Initialising default vfs hooks [2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-501 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-514 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-32-546 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/service.c:make_connection_snum(705) service-info-01 (192.168.151.38) connect to service IPC$ initially as user nobody (uid=65534, gid=65534) (pid 12833) [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/reply.c:reply_tcon_and_X(326) tconX service=IPC$ [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 114 of length 100 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBntcreateX (pid 12833) [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/nttrans.c:nt_open_pipe(503) nt_open_pipe: Known pipe samr opening. [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 115 of length 208 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860) api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:check_bind_req(732) check_bind_req for \PIPE\samr [2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74b3 nwritten=140 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 116 of length 63 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBreadX (pid 12833) [2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_read_and_X(242) readX-IPC pnum=74b3 min=1024 max=1024 nread=116 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 117 of length 199 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(104) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] auth/auth.c:check_ntlm_password(219) check_ntlm_password: Checking password for unmapped user []\[]@[SERVICE-INFO-01] with the new password interface [2006/09/18 16:00:46, 3] auth/auth.c:check_ntlm_password(222) check_ntlm_password: mapped user is: [TOTEM]\[]@[SERVICE-INFO-01] [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(104) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(104) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235) fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:46, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235) fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069 [2006/09/18 16:00:46, 3] auth/auth.c:check_ntlm_password(268) check_ntlm_password: guest authentication for user [] succeeded [2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74b3 nwritten=131 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 118 of length 248 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=160 params=0 setup=2 [2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b3)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_GET_DOM_PWINFO [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 22 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 119 of length 1304 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=1216 params=0 setup=2 [2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b3)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_CHGPASSWD_USER [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 2 [2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(104) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 3 [2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(104) : conn_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 3 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:46, 0] smbd/chgpasswd.c:check_oem_password(832) check_oem_password: incorrect password length (886305395). [2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 38 [2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890) Transaction 120 of length 45 [2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685) switch message SMBclose (pid 12833) [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 121 of length 43 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBulogoffX (pid 12833) [2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:47, 3] smbd/reply.c:reply_ulogoffX(1108) ulogoffX vuid=104 [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 122 of length 39 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBtdis (pid 12833) [2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:47, 3] smbd/service.c:close_cnum(887) service-info-01 (192.168.151.38) closed connection to service IPC$ [2006/09/18 16:00:47, 3] smbd/connection.c:yield_connection(69) Yielding connection to IPC$ [2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 123 of length 100 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBntcreateX (pid 12833) [2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (531, 506) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:47, 3] smbd/nttrans.c:nt_open_pipe(503) nt_open_pipe: Known pipe samr opening. [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 124 of length 208 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860) api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass [2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:check_bind_req(732) check_bind_req for \PIPE\samr [2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74b4 nwritten=140 [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 125 of length 63 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBreadX (pid 12833) [2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_read_and_X(242) readX-IPC pnum=74b4 min=1024 max=1024 nread=116 [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 126 of length 272 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:47, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:47, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:47, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:47, 3] auth/auth.c:check_ntlm_password(219) check_ntlm_password: Checking password for unmapped user [TOTEM]\[plegrand]@[SERVICE-INFO-01] with the new password interface [2006/09/18 16:00:47, 3] auth/auth.c:check_ntlm_password(222) check_ntlm_password: mapped user is: [TOTEM]\[plegrand]@[SERVICE-INFO-01] [2006/09/18 16:00:47, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:47, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:47, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2006/09/18 16:00:47, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 1 [2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2006/09/18 16:00:47, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2006/09/18 16:00:47, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0 [2006/09/18 16:00:47, 3] libsmb/ntlm_check.c:ntlm_password_check(282) ntlm_password_check: NT MD4 password check failed for user plegrand [2006/09/18 16:00:47, 3] auth/auth_winbind.c:check_winbind_security(80) check_winbind_security: Not using winbind, requested domain [TOTEM] was for this SAM. [2006/09/18 16:00:47, 2] auth/auth.c:check_ntlm_password(312) check_ntlm_password: Authentication for user [plegrand] -> [plegrand] FAILED with error NT_STATUS_WRONG_PASSWORD [2006/09/18 16:00:47, 1] rpc_server/srv_pipe.c:api_pipe_ntlmssp_verify(414) api_pipe_ntlmssp_verify: User [TOTEM]\[plegrand] from machine SERVICE-INFO-01 failed authentication on named pipe samr. [2006/09/18 16:00:47, 3] rpc_server/srv_pipe_hnd.c:process_complete_pdu(752) process_complete_pdu: DCE/RPC fault sent on pipe lsass [2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74b4 nwritten=204 [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 127 of length 248 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:47, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=160 params=0 setup=2 [2006/09/18 16:00:47, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:47, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b4)Transaction 128 of length 45 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBclose (pid 12833) [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 129 of length 104 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBntcreateX (pid 12833) [2006/09/18 16:00:47, 3] smbd/nttrans.c:nt_open_pipe(503) nt_open_pipe: Known pipe lsarpc opening. [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 130 of length 140 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860) api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsass [2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:check_bind_req(732) check_bind_req for \PIPE\lsarpc [2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74b5 nwritten=72 [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 131 of length 63 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBreadX (pid 12833) [2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_read_and_X(242) readX-IPC pnum=74b5 min=1024 max=1024 nread=68 [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 132 of length 188 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:47, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=100 params=0 setup=2 [2006/09/18 16:00:47, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:47, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "lsarpc" (pnum 74b5)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: LSA_OPENPOLICY2 [2006/09/18 16:00:47, 3] rpc_parse/parse_lsa.c:lsa_io_sec_qos(181) lsa_io_sec_qos: length c does not match size 8 [2006/09/18 16:00:47, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:47, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015 [2006/09/18 16:00:47, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 830 [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 133 of length 134 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:47, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=46 params=0 setup=2 [2006/09/18 16:00:47, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:47, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "lsarpc" (pnum 74b5)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY [2006/09/18 16:00:47, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 512 [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 134 of length 100 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBntcreateX (pid 12833) [2006/09/18 16:00:47, 3] smbd/nttrans.c:nt_open_pipe(503) nt_open_pipe: Known pipe samr opening. [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 135 of length 140 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860) api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass [2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:check_bind_req(732) check_bind_req for \PIPE\samr [2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74b6 nwritten=72 [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 136 of length 63 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBreadX (pid 12833) [2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_read_and_X(242) readX-IPC pnum=74b6 min=1024 max=1024 nread=68 [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 137 of length 172 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:47, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=84 params=0 setup=2 [2006/09/18 16:00:47, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:47, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b6)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:47, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 138 of length 45 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBclose (pid 12833) [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 139 of length 100 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBntcreateX (pid 12833) [2006/09/18 16:00:47, 3] smbd/nttrans.c:nt_open_pipe(503) nt_open_pipe: Known pipe samr opening. [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 140 of length 140 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBwriteX (pid 12833) [2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860) api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass [2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:check_bind_req(732) check_bind_req for \PIPE\samr [2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_write_and_X(199) writeX-IPC pnum=74b7 nwritten=72 [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 141 of length 63 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBreadX (pid 12833) [2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_read_and_X(242) readX-IPC pnum=74b7 min=1024 max=1024 nread=68 [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 142 of length 160 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:47, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=72 params=0 setup=2 [2006/09/18 16:00:47, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:47, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b7)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_CONNECT4 [2006/09/18 16:00:47, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:47, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015 [2006/09/18 16:00:47, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 754 [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 143 of length 164 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:47, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=76 params=0 setup=2 [2006/09/18 16:00:47, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:47, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b7)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_OPEN_DOMAIN [2006/09/18 16:00:47, 3] lib/util_seaccess.c:se_access_check(251) [2006/09/18 16:00:47, 3] lib/util_seaccess.c:se_access_check(252) se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015 [2006/09/18 16:00:47, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 732 [2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890) Transaction 144 of length 184 [2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685) switch message SMBtrans (pid 12833) [2006/09/18 16:00:47, 3] smbd/ipc.c:reply_trans(538) trans <\PIPE\> data=96 params=0 setup=2 [2006/09/18 16:00:47, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2006/09/18 16:00:47, 3] smbd/ipc.c:api_fd_reply(296) Got API command 0x26 on pipe "samr" (pnum 74b7)free_pipe_context: destroying talloc pool of size 0 [2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509) api_rpcTNP: rpc command: SAMR_LOOKUP_NAMES [2006/09/18 16:00:47, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1 [2006/09/18 16:00:47, 3] smbd/uid.c:push_conn_ctx(287) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1