smb_traffic_analyzer

Name

vfs_smb_traffic_analyzer — log Samba VFS read and write operations through a socket - to a helper application

Synopsis

vfs objects = smb_traffic_analyzer

DESCRIPTION

This VFS module is part of the +smb_traffic_analyzer

Name

vfs_smb_traffic_analyzer — log Samba VFS read and write operations through a socket + to a helper application

Synopsis

vfs objects = smb_traffic_analyzer

DESCRIPTION

This VFS module is part of the samba(7) suite.

The vfs_smb_traffic_analyzer VFS module logs - client file operations on a Samba server and sends this data - over a socket to a helper program (in the following the "Receiver"), - which feeds a SQL database. More + client write and read operations on a Samba server and sends this data + over a socket to a helper program, which feeds a SQL database. More information on the helper programs can be obtained from the homepage of the project at: http://holger123.wordpress.com/smb-traffic-analyzer/ - Since the VFS module depends on a receiver that is doing something with - the data, it is evolving in it's development. Therefore, the module - works with different protocol versions, and the receiver has to be able - to decode the protocol that is used. The protocol version 1 was - introduced to Samba at September 25, 2008. It was a very simple - protocol, supporting only a small list of VFS operations, and had - several drawbacks. The protocol version 2 is a try to solve the - problems version 1 had while at the same time adding new features. -

Protocol version 1 documentation

vfs_smb_traffic_analyzer protocol version 1 is aware - of the following VFS operations:

write

pwrite

read

pread

vfs_smb_traffic_analyzer sends the following data +

vfs_smb_traffic_analyzer currently is aware + of the following VFS operations:

write

pwrite

read

pread

vfs_smb_traffic_analyzer sends the following data in a fixed format seperated by a comma through either an internet or a unix domain socket:

 	BYTES|USER|DOMAIN|READ/WRITE|SHARE|FILENAME|TIMESTAMP

Description of the records: -

BYTES - the length in bytes of the VFS operation
USER - the user who initiated the operation
DOMAIN - the domain of the user
READ/WRITE - either "W" for a write operation or "R" for read
SHARE - the name of the share on which the VFS operation occured
FILENAME - the name of the file that was used by the VFS operation
TIMESTAMP - a timestamp, formatted as "yyyy-mm-dd hh-mm-ss.ms" indicating when the VFS operation occured

BYTES - the length in bytes of the VFS operation
USER - the user who initiated the operation
DOMAIN - the domain of the user
READ/WRITE - either "W" for a write operation or "R" for read
SHARE - the name of the share on which the VFS operation occured
FILENAME - the name of the file that was used by the VFS operation
TIMESTAMP - a timestamp, formatted as "yyyy-mm-dd hh-mm-ss.ms" indicating when the VFS operation occured

This module is stackable.

Drawbacks of protocol version 1

Several drawbacks have been seen with protocol version 1 over time.

- Problematic parsing - - Protocol version 1 uses hyphen and comma to seperate blocks of data. Once there is a - filename with a hyphen, you will run into problems because the receiver decodes the - data in a wrong way. -
- Insecure network transfer - - Protocol version 1 sends all it's data as plaintext over the network. -
- Limited set of supported VFS operations - - Protocol version 1 supports only four VFS operations. -
- No subreleases of the protocol - - Protocol version 1 is fixed on it's version, making it unable to introduce new - features or bugfixes through compatible sub-releases. -

Version 2 of the protocol

Protocol version 2 is an approach to solve the problems introduced with protcol v1. - From the users perspective, the following changes are most prominent among other enhancements: -

- The data from the module may be send encrypted, with a key stored in secrets.tdb. The - Receiver then has to use the same key. The module does AES block encryption over the - data to send. -
- The module now can identify itself against the receiver with a sub-release number, where - the receiver may run with a different sub-release number than the module. However, as - long as both run on the V2.x protocol, the receiver will not crash, even if the module - uses features only implemented in the newer subrelease. Ultimativly, if the module uses - a new feature from a newer subrelease, and the receiver runs an older protocol, it is just - ignoring the functionality. Of course it is best to have both the receiver and the module - running the same subrelease of the protocol. -
- The parsing problems of protocol V1 can no longer happen, because V2 is marshalling the - data packages in a proper way. -
- The module now potientially has the ability to create data on every VFS function. As of - protocol V2.0, there is support for 8 VFS functions, namely write,read,pread,pwrite, - rename,chdir,mkdir and rmdir. Supporting more VFS functions is one of the targets for the - upcoming sub-releases. -

- To enable protocol V2, the protocol_version vfs option has to be used (see OPTIONS). -

OPTIONS with protocol V1 and V2.x

smb_traffic_analyzer:mode = STRING

If STRING matches to "unix_domain_socket", the module will +

This module is stackable.

OPTIONS

smb_traffic_analyzer:mode = STRING: If STRING matches to "unix_domain_socket", the module will use a unix domain socket located at /var/tmp/stadsocket, if STRING contains an different string or is not defined, the module will use an internet domain socket for data transfer.
smb_traffic_analyzer:host = STRING: The module will send the data to the system named with the hostname STRING.
smb_traffic_analyzer:port = STRING: The module will send the data using the TCP port given in STRING.
smb_traffic_analyzer:anonymize_prefix = STRING: The module will replace the user names with a prefix - given by STRING and a simple hash number. In version 2.x - of the protocol, the users SID will also be anonymized. + given by STRING and a simple hash number.
smb_traffic_analyzer:total_anonymization = STRING: If STRING matches to 'yes', the module will replace any user name with the string given by the option smb_traffic_analyzer:anonymize_prefix, without generating an additional hash number. This means that any transfer data will be mapped to a single user, leading to a total - anonymization of user related data. In version 2.x of the - protocol, the users SID will also be anonymized.
smb_traffic_analyzer:protocol_version = STRING: If STRING matches to V1 or is not given at all, the module - will use version 1 of the protocol. If STRING matches to "V2" - the module will use version 2 of the protocol. -

EXAMPLES

Running protocol V2 on share "example_share", using an internet socket.

-	[example_share]
-	path = /data/example
-	vfs_objects = smb_traffic_analyzer
-	smb_traffic_analyzer:protocol_version = V2
-	smb_traffic_analyzer:host = examplehost
-	smb_traffic_analyzer:port = 3491
-

The module running on share "example_share", using a unix domain socket

+ anonymization of user related data.

EXAMPLES

The module running on share "example_share", using a unix domain socket

 	[example_share]
 	path = /data/example
 	vfs objects = smb_traffic_analyzer
@@ -109,8 +49,8 @@
 	smb_traffic_analyzer:host = examplehost
 	smb_traffic_analyzer:port = 3491
 	smb_traffic_analyzer:anonymize_prefix = User
-

VERSION

This man page is correct for version 3.3 of the Samba suite. -

AUTHOR

The original Samba software and related utilities +

VERSION

This man page is correct for version 3.3 of the Samba suite. +

AUTHOR

The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

The original version of the VFS module and the -- cgit v1.2.3