If someone has write access to a samba share, then I believe that there is no way to restrict them from deleting files on that share and I don't think samba will log deletions (someone please correct me if I'm wrong here).
<shamelessplug> I have written a shared library that can be loaded via /etc/ld.so.preload or the LD_PRELOAD environment variable that intercepts calls to unlink() and logs them to the syslog. This library cannot prevent file deletions, and there are ways of circumventing it, but it can give you a log of which user and what program deleted which file. You can take a look at it at: http://sourceforge.net/projects/auditunlink If your system is fairly active, the logs can get quite large, but it may give you the information for which you seek. It's been tested and works on my system with samba-2.2.3a on Red Hat 7.3 running as a member server in a Windows 2000 domain. </shamelessplug> Hope this helps, Andy. -----Original Message----- From: Brad Ching [mailto:bqian@;21cn.com] Sent: Wednesday, November 13, 2002 10:17 AM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: samba log problem Dear all: I use samba as Domain like NT server.Yesterday some people delete files through samba share.I check samba log in /var/log/samba but i can not find delete record( who done/which ip address/what netbios etc.) How can i do for samba security?Pls tell me more or give me document for this. Thanks very much. Brad Ching Nov-13-2002 -- redhat-list mailing list unsubscribe mailto:redhat-list-request@;redhat.com?subject=unsubscribe https://listman.redhat.com/mailman/listinfo/redhat-list -- redhat-list mailing list unsubscribe mailto:redhat-list-request@;redhat.com?subject=unsubscribe https://listman.redhat.com/mailman/listinfo/redhat-list
