[2008/12/09 16:14:17, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 4/778336 [2008/12/09 16:14:17, 4] winbindd/winbindd_dual.c:fork_domain_child(1207) child daemon request 20 [2008/12/09 16:14:17, 10] winbindd/winbindd_dual.c:child_process_request(433) child_process_request: request fn LOOKUPSID [2008/12/09 16:14:17, 3] winbindd/winbindd_async.c:winbindd_dual_lookupsid(239) [ 4112]: lookupsid S-1-5-32-544 [2008/12/09 16:14:17, 10] winbindd/winbindd_passdb.c:sid_to_name(147) Converting SID S-1-5-32-544 [2008/12/09 16:14:17, 10] passdb/lookup_sid.c:lookup_sid(958) lookup_sid called for SID 'S-1-5-32-544' [2008/12/09 16:14:17, 10] passdb/lookup_sid.c:check_dom_sid_to_level(713) Accepting SID S-1-5-32 in level 1 [2008/12/09 16:14:17, 10] passdb/lookup_sid.c:lookup_rids(476) lookup_rids called for domain sid 'S-1-5-32' [2008/12/09 16:14:17, 10] passdb/lookup_sid.c:lookup_sid(993) Sid S-1-5-32-544 -> BUILTIN\Administrators(4) [2008/12/09 16:14:17, 10] winbindd/winbindd_cache.c:cache_store_response(2423) Storing response for pid 4115, len 3496 [2008/12/09 16:14:17, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 4/774647 [2008/12/09 16:14:17, 4] winbindd/winbindd_dual.c:fork_domain_child(1207) child daemon request 20 [2008/12/09 16:14:17, 10] winbindd/winbindd_dual.c:child_process_request(433) child_process_request: request fn LOOKUPSID [2008/12/09 16:14:17, 3] winbindd/winbindd_async.c:winbindd_dual_lookupsid(239) [ 4112]: lookupsid S-1-5-32-545 [2008/12/09 16:14:17, 10] winbindd/winbindd_passdb.c:sid_to_name(147) Converting SID S-1-5-32-545 [2008/12/09 16:14:17, 10] passdb/lookup_sid.c:lookup_sid(958) lookup_sid called for SID 'S-1-5-32-545' [2008/12/09 16:14:17, 10] passdb/lookup_sid.c:check_dom_sid_to_level(713) Accepting SID S-1-5-32 in level 1 [2008/12/09 16:14:17, 10] passdb/lookup_sid.c:lookup_rids(476) lookup_rids called for domain sid 'S-1-5-32' [2008/12/09 16:14:17, 10] passdb/lookup_sid.c:lookup_sid(993) Sid S-1-5-32-545 -> BUILTIN\Users(4) [2008/12/09 16:14:17, 10] winbindd/winbindd_cache.c:cache_store_response(2423) Storing response for pid 4115, len 3496 [2008/12/09 16:14:17, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 4/765349 [2008/12/09 16:14:18, 4] winbindd/winbindd_dual.c:fork_domain_child(1207) child daemon request 20 [2008/12/09 16:14:18, 10] winbindd/winbindd_dual.c:child_process_request(433) child_process_request: request fn LOOKUPSID [2008/12/09 16:14:18, 3] winbindd/winbindd_async.c:winbindd_dual_lookupsid(239) [ 4112]: lookupsid S-1-5-32-546 [2008/12/09 16:14:18, 10] winbindd/winbindd_passdb.c:sid_to_name(147) Converting SID S-1-5-32-546 [2008/12/09 16:14:18, 10] passdb/lookup_sid.c:lookup_sid(958) lookup_sid called for SID 'S-1-5-32-546' [2008/12/09 16:14:18, 10] passdb/lookup_sid.c:check_dom_sid_to_level(713) Accepting SID S-1-5-32 in level 1 [2008/12/09 16:14:18, 10] passdb/lookup_sid.c:lookup_rids(476) lookup_rids called for domain sid 'S-1-5-32' [2008/12/09 16:14:18, 10] passdb/lookup_sid.c:lookup_sid(993) Sid S-1-5-32-546 -> BUILTIN\Guests(4) [2008/12/09 16:14:18, 10] winbindd/winbindd_cache.c:cache_store_response(2423) Storing response for pid 4115, len 3496 [2008/12/09 16:14:18, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 4/5449 [2008/12/09 16:14:22, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 0/583 [2008/12/09 16:14:22, 10] lib/events.c:run_events(263) Running event "check_domain_online_handler" 84cf3c8 [2008/12/09 16:14:22, 10] winbindd/winbindd_cm.c:check_domain_online_handler(259) check_domain_online_handler: called for domain AHUS (online = False) [2008/12/09 16:14:22, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 84cf3c8 "check_domain_online_handler" [2008/12/09 16:14:22, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 294/999943 [2008/12/09 16:14:22, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 294/966865 [2008/12/09 16:14:22, 10] lib/messages_local.c:message_dispatch(419) message_dispatch: received_signal = 1 [2008/12/09 16:14:22, 10] lib/messages_local.c:messaging_tdb_fetch(174) messaging_tdb_fetch: result: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : 0x00000406 (1030) dest: struct server_id id : 0x00001013 (4115) src: struct server_id id : 0x00001017 (4119) buf : DATA_BLOB length=5 [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 41 48 55 53 00 AHUS. [2008/12/09 16:14:22, 5] winbindd/winbindd_cm.c:msg_try_to_go_online(136) msg_try_to_go_online: received for domain AHUS. [2008/12/09 16:14:22, 8] winbindd/winbindd_cm.c:connection_ok(1563) connection_ok: Connection to for domain AHUS has NULL cli! [2008/12/09 16:14:22, 10] lib/gencache.c:gencache_get(208) Returning valid cache entry: key = SAF/DOMAIN/AHUS, value = 10.132.16.21, timeout = Tue Dec 9 16:29:18 2008 [2008/12/09 16:14:22, 5] libsmb/namequery.c:saf_fetch(138) saf_fetch: Returning "10.132.16.21" for "AHUS" domain [2008/12/09 16:14:22, 10] winbindd/winbindd_cm.c:cm_open_connection(1398) cm_open_connection: saf_servername is '10.132.16.21' for domain AHUS [2008/12/09 16:14:22, 5] libads/ldap.c:ads_try_connect(188) ads_try_connect: sending CLDAP request to 10.132.16.21 (realm: AHUS.NO) r : union nbt_cldap_netlogon(case 6) logon5: struct nbt_cldap_netlogon_5 type : NETLOGON_RESPONSE_FROM_PDC2 (23) sbz : 0x0000 (0) server_type : 0x000001bc (444) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 0: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 0: NBT_SERVER_FULL_SECRET_DOMAIN_6 domain_uuid : d36df92d-628a-435e-bede-27cb29aacda1 forest : 'ahus.no' dns_domain : 'ahus.no' pdc_dns_name : 'bredde.ahus.no' domain : 'AHUS' pdc_name : 'BREDDE' user_name : '' server_site : 'SIAADM' client_site : 'SIAADM' nt_version : 0x00000005 (5) 1: NETLOGON_VERSION_1 0: NETLOGON_VERSION_5 1: NETLOGON_VERSION_5EX 0: NETLOGON_VERSION_5EX_WITH_IP 0: NETLOGON_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_VERSION_AVOID_NT4_EMUL 0: NETLOGON_VERSION_PDC 0: NETLOGON_VERSION_IP 0: NETLOGON_VERSION_LOCAL 0: NETLOGON_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2008/12/09 16:14:22, 10] libads/dns.c:sitename_store(778) sitename_store: realm = [AHUS], sitename = [SIAADM], expire = [2147483647] [2008/12/09 16:14:22, 10] lib/gencache.c:gencache_set(131) Adding cache entry with key = AD_SITENAME/DOMAIN/AHUS; value = SIAADM and timeout = Tue Jan 19 04:14:07 2038 (918647985 seconds ahead) [2008/12/09 16:14:22, 10] libads/dns.c:sitename_store(778) sitename_store: realm = [ahus.no], sitename = [SIAADM], expire = [2147483647] [2008/12/09 16:14:22, 10] lib/gencache.c:gencache_set(131) Adding cache entry with key = AD_SITENAME/DOMAIN/AHUS.NO; value = SIAADM and timeout = Tue Jan 19 04:14:07 2038 (918647985 seconds ahead) [2008/12/09 16:14:22, 5] libsmb/namecache.c:namecache_store(143) namecache_store: storing 1 address for bredde.ahus.no#20: 10.132.16.21 [2008/12/09 16:14:22, 10] lib/gencache.c:gencache_set(131) Adding cache entry with key = NBT/BREDDE.AHUS.NO#20; value = 10.132.16.21:0 and timeout = Tue Dec 9 16:25:22 2008 (660 seconds ahead) [2008/12/09 16:14:22, 10] winbindd/winbindd_cm.c:dcip_to_name(1077) dcip_to_name: flags = 0x1bc [2008/12/09 16:14:22, 10] libads/ldap.c:ads_closest_dc(155) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2008/12/09 16:14:22, 10] lib/gencache.c:gencache_get(208) Returning valid cache entry: key = AD_SITENAME/DOMAIN/AHUS.NO, value = SIAADM, timeout = Tue Jan 19 04:14:07 2038 [2008/12/09 16:14:22, 5] libads/dns.c:sitename_fetch(817) sitename_fetch: Returning sitename for AHUS.NO: "SIAADM" [2008/12/09 16:14:22, 10] libads/kerberos.c:create_local_private_krb5_conf_for_domain(871) create_local_private_krb5_conf_for_domain: fname = /var/lock/samba/smb_krb5/krb5.conf.AHUS, realm = AHUS.NO, domain = AHUS [2008/12/09 16:14:22, 10] lib/gencache.c:gencache_get(208) Returning valid cache entry: key = SAF/DOMAIN/AHUS.NO, value = 10.132.16.21, timeout = Tue Dec 9 16:29:18 2008 [2008/12/09 16:14:22, 5] libsmb/namequery.c:saf_fetch(138) saf_fetch: Returning "10.132.16.21" for "AHUS.NO" domain [2008/12/09 16:14:22, 3] libsmb/namequery.c:get_dc_list(1909) get_dc_list: preferred server list: "10.132.16.21, *" [2008/12/09 16:14:22, 10] libsmb/namequery.c:internal_resolve_name(1443) internal_resolve_name: looking up AHUS.NO#1c (sitename SIAADM) [2008/12/09 16:14:22, 10] lib/gencache.c:gencache_get(208) Returning valid cache entry: key = NBT/AHUS.NO#1C, value = 10.132.16.21:389, timeout = Tue Dec 9 16:22:09 2008 [2008/12/09 16:14:22, 5] libsmb/namecache.c:namecache_fetch(233) name AHUS.NO#1C found. [2008/12/09 16:14:22, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2008/12/09 16:14:22, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2008/12/09 16:14:22, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2008/12/09 16:14:22, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2008/12/09 16:14:22, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2008/12/09 16:14:22, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2008/12/09 16:14:22, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2008/12/09 16:14:22, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2008/12/09 16:14:22, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2008/12/09 16:14:22, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2008/12/09 16:14:22, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2008/12/09 16:14:22, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2008/12/09 16:14:22, 8] libsmb/namequery.c:get_dc_list(1930) Adding 1 DC's from auto lookup [2008/12/09 16:14:22, 10] libsmb/namequery.c:remove_duplicate_addrs2(520) remove_duplicate_addrs2: looking for duplicate address/port pairs [2008/12/09 16:14:22, 4] libsmb/namequery.c:get_dc_list(2042) get_dc_list: returning 1 ip addresses in an ordered list [2008/12/09 16:14:22, 4] libsmb/namequery.c:get_dc_list(2043) get_dc_list: 10.132.16.21:389 [2008/12/09 16:14:22, 10] lib/gencache.c:gencache_get(208) Returning valid cache entry: key = SAF/DOMAIN/AHUS.NO, value = 10.132.16.21, timeout = Tue Dec 9 16:29:18 2008 [2008/12/09 16:14:22, 5] libsmb/namequery.c:saf_fetch(138) saf_fetch: Returning "10.132.16.21" for "AHUS.NO" domain [2008/12/09 16:14:22, 3] libsmb/namequery.c:get_dc_list(1909) get_dc_list: preferred server list: "10.132.16.21, *" [2008/12/09 16:14:22, 10] libsmb/namequery.c:internal_resolve_name(1443) internal_resolve_name: looking up AHUS.NO#1c (sitename (null)) [2008/12/09 16:14:22, 10] lib/gencache.c:gencache_get(208) Returning valid cache entry: key = NBT/AHUS.NO#1C, value = 10.132.16.21:389, timeout = Tue Dec 9 16:22:09 2008 [2008/12/09 16:14:22, 5] libsmb/namecache.c:namecache_fetch(233) name AHUS.NO#1C found. [2008/12/09 16:14:22, 8] libsmb/namequery.c:get_dc_list(1930) Adding 1 DC's from auto lookup [2008/12/09 16:14:22, 10] libsmb/namequery.c:remove_duplicate_addrs2(520) remove_duplicate_addrs2: looking for duplicate address/port pairs [2008/12/09 16:14:22, 4] libsmb/namequery.c:get_dc_list(2042) get_dc_list: returning 1 ip addresses in an ordered list [2008/12/09 16:14:22, 4] libsmb/namequery.c:get_dc_list(2043) get_dc_list: 10.132.16.21:389 [2008/12/09 16:14:22, 10] libads/kerberos.c:get_kdc_ip_string(820) get_kdc_ip_string: Returning kdc = 10.132.16.21 [2008/12/09 16:14:22, 5] libads/kerberos.c:create_local_private_krb5_conf_for_domain(946) create_local_private_krb5_conf_for_domain: wrote file /var/lock/samba/smb_krb5/krb5.conf.AHUS with realm AHUS.NO KDC list = kdc = 10.132.16.21 [2008/12/09 16:14:22, 10] libsmb/namequery.c:saf_store(75) saf_store: domain = [AHUS], server = [bredde.ahus.no], expire = [1228836562] [2008/12/09 16:14:22, 10] lib/gencache.c:gencache_set(131) Adding cache entry with key = SAF/DOMAIN/AHUS; value = bredde.ahus.no and timeout = Tue Dec 9 16:29:22 2008 (900 seconds ahead) [2008/12/09 16:14:22, 10] libsmb/namequery.c:saf_store(75) saf_store: domain = [AHUS.NO], server = [bredde.ahus.no], expire = [1228836562] [2008/12/09 16:14:22, 10] lib/gencache.c:gencache_set(131) Adding cache entry with key = SAF/DOMAIN/AHUS.NO; value = bredde.ahus.no and timeout = Tue Dec 9 16:29:22 2008 (900 seconds ahead) [2008/12/09 16:14:22, 10] winbindd/winbindd_cm.c:cm_open_connection(1430) cm_open_connection: dcname is 'bredde.ahus.no' for domain AHUS [2008/12/09 16:14:22, 10] lib/gencache.c:gencache_get(208) Returning valid cache entry: key = AD_SITENAME/DOMAIN/AHUS.NO, value = SIAADM, timeout = Tue Jan 19 04:14:07 2038 [2008/12/09 16:14:22, 5] libads/dns.c:sitename_fetch(817) sitename_fetch: Returning sitename for AHUS.NO: "SIAADM" [2008/12/09 16:14:22, 10] libsmb/namequery.c:internal_resolve_name(1443) internal_resolve_name: looking up bredde.ahus.no#20 (sitename SIAADM) [2008/12/09 16:14:22, 10] lib/gencache.c:gencache_get(208) Returning valid cache entry: key = NBT/BREDDE.AHUS.NO#20, value = 10.132.16.21:0, timeout = Tue Dec 9 16:25:22 2008 [2008/12/09 16:14:22, 5] libsmb/namecache.c:namecache_fetch(233) name bredde.ahus.no#20 found. [2008/12/09 16:14:22, 10] winbindd/winbindd_cm.c:cm_prepare_connection(753) cm_prepare_connection: connecting to DC bredde.ahus.no for domain AHUS [2008/12/09 16:14:22, 6] libsmb/clientgen.c:write_socket(236) write_socket(23,194) [2008/12/09 16:14:22, 6] libsmb/clientgen.c:write_socket(239) write_socket(23,194) wrote 194 [2008/12/09 16:14:22, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118) got smb length of 172 [2008/12/09 16:14:22, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:22, 5] lib/util.c:show_msg(652) size=172 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=4115 smb_uid=0 smb_mid=1 smt_wct=17 smb_vwv[ 0]= 9 (0x9) smb_vwv[ 1]=12815 (0x320F) smb_vwv[ 2]= 256 (0x100) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 65 (0x41) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 256 (0x100) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]=64768 (0xFD00) smb_vwv[10]= 499 (0x1F3) smb_vwv[11]=14464 (0x3880) smb_vwv[12]=56613 (0xDD25) smb_vwv[13]= 4349 (0x10FD) smb_vwv[14]=51546 (0xC95A) smb_vwv[15]=50177 (0xC401) smb_vwv[16]= 255 (0xFF) smb_bcc=103 [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 4C 6D C3 39 67 44 D4 4A 80 17 B5 86 E4 28 48 2E Lm.9gD.J .....(H. [010] 60 55 06 06 2B 06 01 05 05 02 A0 4B 30 49 A0 30 `U..+... ...K0I.0 [020] 30 2E 06 09 2A 86 48 82 F7 12 01 02 02 06 09 2A 0...*.H. .......* [030] 86 48 86 F7 12 01 02 02 06 0A 2A 86 48 86 F7 12 .H...... ..*.H... [040] 01 02 02 03 06 0A 2B 06 01 04 01 82 37 02 02 0A ......+. ....7... [050] A3 15 30 13 A0 11 1B 0F 62 72 65 64 64 65 24 40 ..0..... bredde$@ [060] 41 48 55 53 2E 4E 4F AHUS.NO [2008/12/09 16:14:22, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:22, 5] lib/util.c:show_msg(652) size=172 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=4115 smb_uid=0 smb_mid=1 smt_wct=17 smb_vwv[ 0]= 9 (0x9) smb_vwv[ 1]=12815 (0x320F) smb_vwv[ 2]= 256 (0x100) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 65 (0x41) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 256 (0x100) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]=64768 (0xFD00) smb_vwv[10]= 499 (0x1F3) smb_vwv[11]=14464 (0x3880) smb_vwv[12]=56613 (0xDD25) smb_vwv[13]= 4349 (0x10FD) smb_vwv[14]=51546 (0xC95A) smb_vwv[15]=50177 (0xC401) smb_vwv[16]= 255 (0xFF) smb_bcc=103 [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 4C 6D C3 39 67 44 D4 4A 80 17 B5 86 E4 28 48 2E Lm.9gD.J .....(H. [010] 60 55 06 06 2B 06 01 05 05 02 A0 4B 30 49 A0 30 `U..+... ...K0I.0 [020] 30 2E 06 09 2A 86 48 82 F7 12 01 02 02 06 09 2A 0...*.H. .......* [030] 86 48 86 F7 12 01 02 02 06 0A 2A 86 48 86 F7 12 .H...... ..*.H... [040] 01 02 02 03 06 0A 2B 06 01 04 01 82 37 02 02 0A ......+. ....7... [050] A3 15 30 13 A0 11 1B 0F 62 72 65 64 64 65 24 40 ..0..... bredde$@ [060] 41 48 55 53 2E 4E 4F AHUS.NO [2008/12/09 16:14:22, 5] winbindd/winbindd_cm.c:cm_prepare_connection(831) connecting to bredde.ahus.no from LORDVADER with kerberos principal [LORDVADER$@AHUS.NO] and realm [AHUS.NO] [2008/12/09 16:14:22, 3] libsmb/cliconnect.c:cli_session_setup_spnego(804) Doing spnego session setup (blob length=103) [2008/12/09 16:14:22, 3] libsmb/cliconnect.c:cli_session_setup_spnego(831) got OID=1 2 840 48018 1 2 2 [2008/12/09 16:14:22, 3] libsmb/cliconnect.c:cli_session_setup_spnego(831) got OID=1 2 840 113554 1 2 2 [2008/12/09 16:14:22, 3] libsmb/cliconnect.c:cli_session_setup_spnego(831) got OID=1 2 840 113554 1 2 2 3 [2008/12/09 16:14:22, 3] libsmb/cliconnect.c:cli_session_setup_spnego(831) got OID=1 3 6 1 4 1 311 2 2 10 [2008/12/09 16:14:22, 3] libsmb/cliconnect.c:cli_session_setup_spnego(839) got principal=bredde$@AHUS.NO [2008/12/09 16:14:22, 10] libads/kerberos.c:kerberos_kinit_password_ext(217) kerberos_kinit_password: as LORDVADER$@AHUS.NO using [MEMORY:cliconnect] as ccache and config [/var/lock/samba/smb_krb5/krb5.conf.AHUS] [2008/12/09 16:14:22, 2] libsmb/cliconnect.c:cli_session_setup_kerberos(619) Doing kerberos session setup [2008/12/09 16:14:22, 4] libsmb/clikrb5.c:ads_krb5_mk_req(688) ads_krb5_mk_req: Advancing clock by 76 seconds to cope with clock skew [2008/12/09 16:14:22, 3] libsmb/clikrb5.c:ads_cleanup_expired_creds(604) ads_cleanup_expired_creds: Ticket in ccache[MEMORY:cliconnect] expiration Wed, 10 Dec 2008 02:14:22 CET [2008/12/09 16:14:22, 10] libsmb/clikrb5.c:ads_krb5_mk_req(702) ads_krb5_mk_req: Ticket (bredde$@AHUS.NO) in ccache (MEMORY:cliconnect) is valid until: (Wed, 10 Dec 2008 02:14:22 CET - 1228871662) [2008/12/09 16:14:22, 10] libsmb/clikrb5.c:get_krb5_smb_session_key(873) Got KRB5 session key of length 16 [2008/12/09 16:14:22, 5] libsmb/smb_signing.c:set_smb_signing_real_common(140) Mandatory SMB signing enabled! [2008/12/09 16:14:22, 5] libsmb/smb_signing.c:set_smb_signing_real_common(144) SMB signing enabled! [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:cli_simple_set_signing(494) cli_simple_set_signing: user_session_key [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] E4 CD 64 0F 6B F2 A3 5B E7 C9 09 58 C2 CA E6 0D ..d.k..[ ...X.... [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:cli_simple_set_signing(502) cli_simple_set_signing: NULL response_data [2008/12/09 16:14:22, 10] libsmb/cliconnect.c:cli_session_setup_blob(578) cli_session_setup_blob: Remaining (0) sending (1147) current (1147) [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 0 [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 67 B7 A6 2D 34 D2 02 71 g..-4..q [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 1 mid = 2 [2008/12/09 16:14:22, 6] libsmb/clientgen.c:write_socket(236) write_socket(23,1232) [2008/12/09 16:14:22, 6] libsmb/clientgen.c:write_socket(239) write_socket(23,1232) wrote 1232 [2008/12/09 16:14:22, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118) got smb length of 197 [2008/12/09 16:14:22, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:22, 5] lib/util.c:show_msg(652) size=197 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=0 smb_pid=4115 smb_uid=51202 smb_mid=2 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 197 (0xC5) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 26 (0x1A) smb_bcc=154 [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] A1 18 30 16 A0 03 0A 01 00 A1 0B 06 09 2A 86 48 ..0..... .....*.H [010] 82 F7 12 01 02 02 A2 02 04 00 3D 57 00 69 00 6E ........ ..=W.i.n [020] 00 64 00 6F 00 77 00 73 00 20 00 53 00 65 00 72 .d.o.w.s . .S.e.r [030] 00 76 00 65 00 72 00 20 00 32 00 30 00 30 00 33 .v.e.r. .2.0.0.3 [040] 00 20 00 33 00 37 00 39 00 30 00 20 00 53 00 65 . .3.7.9 .0. .S.e [050] 00 72 00 76 00 69 00 63 00 65 00 20 00 50 00 61 .r.v.i.c .e. .P.a [060] 00 63 00 6B 00 20 00 31 00 00 00 57 00 69 00 6E .c.k. .1 ...W.i.n [070] 00 64 00 6F 00 77 00 73 00 20 00 53 00 65 00 72 .d.o.w.s . .S.e.r [080] 00 76 00 65 00 72 00 20 00 32 00 30 00 30 00 33 .v.e.r. .2.0.0.3 [090] 00 20 00 35 00 2E 00 32 00 00 . .5...2 .. [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 1 mid = 2 [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 1 [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 1: got good SMB signature of [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 77 30 23 EE AF 55 8E B8 w0#..U.. [2008/12/09 16:14:22, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:22, 5] lib/util.c:show_msg(652) size=197 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=0 smb_pid=4115 smb_uid=51202 smb_mid=2 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 197 (0xC5) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 26 (0x1A) smb_bcc=154 [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] A1 18 30 16 A0 03 0A 01 00 A1 0B 06 09 2A 86 48 ..0..... .....*.H [010] 82 F7 12 01 02 02 A2 02 04 00 3D 57 00 69 00 6E ........ ..=W.i.n [020] 00 64 00 6F 00 77 00 73 00 20 00 53 00 65 00 72 .d.o.w.s . .S.e.r [030] 00 76 00 65 00 72 00 20 00 32 00 30 00 30 00 33 .v.e.r. .2.0.0.3 [040] 00 20 00 33 00 37 00 39 00 30 00 20 00 53 00 65 . .3.7.9 .0. .S.e [050] 00 72 00 76 00 69 00 63 00 65 00 20 00 50 00 61 .r.v.i.c .e. .P.a [060] 00 63 00 6B 00 20 00 31 00 00 00 57 00 69 00 6E .c.k. .1 ...W.i.n [070] 00 64 00 6F 00 77 00 73 00 20 00 53 00 65 00 72 .d.o.w.s . .S.e.r [080] 00 76 00 65 00 72 00 20 00 32 00 30 00 30 00 33 .v.e.r. .2.0.0.3 [090] 00 20 00 35 00 2E 00 32 00 00 . .5...2 .. [2008/12/09 16:14:22, 10] libsmb/clientgen.c:cli_init_creds(429) cli_init_creds: user LORDVADER$ domain AHUS [2008/12/09 16:14:22, 10] libsmb/namequery.c:saf_store(75) saf_store: domain = [AHUS], server = [bredde.ahus.no], expire = [1228836562] [2008/12/09 16:14:22, 10] lib/gencache.c:gencache_set(131) Adding cache entry with key = SAF/DOMAIN/AHUS; value = bredde.ahus.no and timeout = Tue Dec 9 16:29:22 2008 (900 seconds ahead) [2008/12/09 16:14:22, 10] libsmb/namequery.c:saf_store(75) saf_store: domain = [AHUS.NO], server = [bredde.ahus.no], expire = [1228836562] [2008/12/09 16:14:22, 10] lib/gencache.c:gencache_set(131) Adding cache entry with key = SAF/DOMAIN/AHUS.NO; value = bredde.ahus.no and timeout = Tue Dec 9 16:29:22 2008 (900 seconds ahead) [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 2 [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 48 5B A3 0D F0 F0 94 84 H[...... [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 3 mid = 3 [2008/12/09 16:14:22, 6] libsmb/clientgen.c:write_socket(236) write_socket(23,96) [2008/12/09 16:14:22, 6] libsmb/clientgen.c:write_socket(239) write_socket(23,96) wrote 96 [2008/12/09 16:14:22, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118) got smb length of 56 [2008/12/09 16:14:22, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:22, 5] lib/util.c:show_msg(652) size=56 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=3 smt_wct=7 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 56 (0x38) smb_vwv[ 2]= 1 (0x1) smb_vwv[ 3]= 511 (0x1FF) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 511 (0x1FF) smb_vwv[ 6]= 0 (0x0) smb_bcc=7 [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 49 50 43 00 00 00 00 IPC.... [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 3 mid = 3 [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 3 [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 3: got good SMB signature of [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 5C 85 16 4B BD 83 D3 13 \..K.... [2008/12/09 16:14:22, 10] winbindd/winbindd_cache.c:set_global_winbindd_state_online(2859) set_global_winbindd_state_online: online requested. [2008/12/09 16:14:22, 10] winbindd/winbindd_cache.c:set_global_winbindd_state_online(2862) set_global_winbindd_state_online: rejecting. [2008/12/09 16:14:22, 10] winbindd/winbindd_cm.c:set_domain_online(385) set_domain_online: called for domain AHUS [2008/12/09 16:14:22, 10] lib/messages_local.c:messaging_tdb_store(215) messaging_tdb_store: array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : 0x00000403 (1027) dest: struct server_id id : 0x00001012 (4114) src: struct server_id id : 0x00001013 (4115) buf : DATA_BLOB length=5 [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 41 48 55 53 00 AHUS. [2008/12/09 16:14:22, 10] winbindd/winbindd_cm.c:set_dc_type_and_flags(1917) set_dc_type_and_flags: setting up flags for primary domain [2008/12/09 16:14:22, 5] winbindd/winbindd_cm.c:set_dc_type_and_flags_connect(1765) set_dc_type_and_flags_connect: domain AHUS [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 4 [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] A1 86 39 72 42 B1 AA BA ..9rB... [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 5 mid = 4 [2008/12/09 16:14:22, 6] libsmb/clientgen.c:write_socket(236) write_socket(23,104) [2008/12/09 16:14:22, 6] libsmb/clientgen.c:write_socket(239) write_socket(23,104) wrote 104 [2008/12/09 16:14:22, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118) got smb length of 103 [2008/12/09 16:14:22, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:22, 5] lib/util.c:show_msg(652) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=4 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 103 (0x67) smb_vwv[ 2]= 2304 (0x900) smb_vwv[ 3]= 448 (0x1C0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 16 (0x10) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 5 mid = 4 [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 5 [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 5: got good SMB signature of [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] C8 86 2C 29 F1 7A EC 8D ..,).z.. [2008/12/09 16:14:22, 5] rpc_client/cli_pipe.c:rpc_pipe_bind(2049) Bind RPC Pipe[c009]: \lsarpc auth_type 0, auth_level 0 [2008/12/09 16:14:22, 5] rpc_client/cli_pipe.c:valid_pipe_name(1650) Bind Abstract Syntax: [000] 6A 28 19 39 0C B1 D0 11 9B A8 00 C0 4F D9 2E F5 j(.9.... ....O... [010] 00 00 00 00 .... [2008/12/09 16:14:22, 5] rpc_client/cli_pipe.c:valid_pipe_name(1653) Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [010] 02 00 00 00 .... [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0b [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0048 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000001 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_rb [2008/12/09 16:14:22, 6] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_bba [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0010 max_tsize: 10b8 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0012 max_rsize: 10b8 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0014 assoc_gid: 00000000 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0018 num_contexts: 01 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 001c context_id : 0000 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 001e num_transfer_syntaxes: 01 [2008/12/09 16:14:22, 6] rpc_parse/parse_prs.c:prs_debug(88) 00001f smb_io_rpc_iface [2008/12/09 16:14:22, 7] rpc_parse/parse_prs.c:prs_debug(88) 000020 smb_io_uuid uuid [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0020 data : 3919286a [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0024 data : b10c [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0026 data : 11d0 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0028 data : 9b a8 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 002a data : 00 c0 4f d9 2e f5 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0030 version: 00000000 [2008/12/09 16:14:22, 6] rpc_parse/parse_prs.c:prs_debug(88) 000034 smb_io_rpc_iface [2008/12/09 16:14:22, 7] rpc_parse/parse_prs.c:prs_debug(88) 000034 smb_io_uuid uuid [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0034 data : 8a885d04 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0038 data : 1ceb [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 003a data : 11c9 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003c data : 9f e8 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003e data : 08 00 2b 10 48 60 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0044 version: 00000002 [2008/12/09 16:14:22, 5] rpc_client/cli_pipe.c:rpc_api_pipe(769) rpc_api_pipe: Remote machine bredde.ahus.no pipe \lsarpc fnum 0xc009 [2008/12/09 16:14:22, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:22, 5] lib/util.c:show_msg(652) size=154 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=5 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 72 (0x48) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 72 (0x48) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=49161 (0xC009) smb_bcc=87 [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 .......H ........ [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 6A ........ .......j [030] 28 19 39 0C B1 D0 11 9B A8 00 C0 4F D9 2E F5 00 (.9..... ...O.... [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ [050] 10 48 60 02 00 00 00 .H`.... [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 6 [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] A2 12 3F B3 20 E3 D0 D3 ..?. ... [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 7 mid = 5 [2008/12/09 16:14:22, 6] libsmb/clientgen.c:write_socket(236) write_socket(23,158) [2008/12/09 16:14:22, 6] libsmb/clientgen.c:write_socket(239) write_socket(23,158) wrote 158 [2008/12/09 16:14:22, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118) got smb length of 124 [2008/12/09 16:14:22, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:22, 5] lib/util.c:show_msg(652) size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=5 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 68 (0x44) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=69 [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 48 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 H....... .D...... [010] 00 B8 10 B8 10 BE 61 22 00 0C 00 5C 50 49 50 45 ......a" ...\PIPE [020] 5C 6C 73 61 73 73 00 B3 FB 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 7 mid = 5 [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 7 [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 7: got good SMB signature of [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 76 19 9E 30 EA F7 C6 08 v..0.... [2008/12/09 16:14:22, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:22, 5] lib/util.c:show_msg(652) size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=5 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 68 (0x44) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=69 [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 48 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 H....... .D...... [010] 00 B8 10 B8 10 BE 61 22 00 0C 00 5C 50 49 50 45 ......a" ...\PIPE [020] 5C 6C 73 61 73 73 00 B3 FB 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 7 mid = 5 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr rpc_hdr [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0c [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0044 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000001 [2008/12/09 16:14:22, 10] rpc_client/cli_pipe.c:rpc_api_pipe(842) rpc_api_pipe: got PDU len of 68 at offset 0 [2008/12/09 16:14:22, 10] rpc_client/cli_pipe.c:rpc_api_pipe(893) rpc_api_pipe: Remote machine bredde.ahus.no pipe \lsarpc fnum 0xc009 returned 68 bytes. [2008/12/09 16:14:22, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2086) rpc_pipe_bind: Remote machine bredde.ahus.no pipe \lsarpc fnum 0xc009 bind request returned ok. [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0c [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0044 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000001 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_ba [2008/12/09 16:14:22, 6] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_bba [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0010 max_tsize: 10b8 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0012 max_rsize: 10b8 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0014 assoc_gid: 002261be [2008/12/09 16:14:22, 6] rpc_parse/parse_prs.c:prs_debug(88) 000018 smb_io_rpc_addr_str [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0018 len: 000c [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 001a str: \PIPE\lsass. [2008/12/09 16:14:22, 6] rpc_parse/parse_prs.c:prs_debug(88) 000026 smb_io_rpc_results [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0028 num_results: 01 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 002c result : 0000 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 002e reason : 0000 [2008/12/09 16:14:22, 6] rpc_parse/parse_prs.c:prs_debug(88) 000030 smb_io_rpc_iface [2008/12/09 16:14:22, 7] rpc_parse/parse_prs.c:prs_debug(88) 000030 smb_io_uuid uuid [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0030 data : 8a885d04 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0034 data : 1ceb [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0036 data : 11c9 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0038 data : 9f e8 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003a data : 08 00 2b 10 48 60 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0040 version: 00000002 [2008/12/09 16:14:22, 5] rpc_client/cli_pipe.c:check_bind_response(1704) check_bind_response: accepted! [2008/12/09 16:14:22, 10] rpc_client/cli_pipe.c:cli_rpc_pipe_open_noauth(2282) cli_rpc_pipe_open_noauth: opened pipe \lsarpc to machine bredde.ahus.no and bound anonymously. dssetup_DsRoleGetPrimaryDomainInformation: struct dssetup_DsRoleGetPrimaryDomainInformation in: struct dssetup_DsRoleGetPrimaryDomainInformation level : DS_ROLE_BASIC_INFORMATION (1) [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 001a [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000002 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_req hdr_req [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 00000002 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0016 opnum : 0000 [2008/12/09 16:14:22, 5] rpc_client/cli_pipe.c:rpc_api_pipe(769) rpc_api_pipe: Remote machine bredde.ahus.no pipe \lsarpc fnum 0xc009 [2008/12/09 16:14:22, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:22, 5] lib/util.c:show_msg(652) size=108 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=6 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 26 (0x1A) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 26 (0x1A) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=49161 (0xC009) smb_bcc=41 [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 1A 00 00 00 02 00 00 00 02 ........ ........ [020] 00 00 00 00 00 00 00 01 00 ........ . [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 8 [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 0F 1B 47 37 02 74 F6 68 ..G7.t.h [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 9 mid = 6 [2008/12/09 16:14:22, 6] libsmb/clientgen.c:write_socket(236) write_socket(23,112) [2008/12/09 16:14:22, 6] libsmb/clientgen.c:write_socket(239) write_socket(23,112) wrote 112 [2008/12/09 16:14:22, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118) got smb length of 208 [2008/12/09 16:14:22, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:22, 5] lib/util.c:show_msg(652) size=208 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=6 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 152 (0x98) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 152 (0x98) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=153 [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 1A 05 00 02 03 10 00 00 00 98 00 00 00 02 00 00 ........ ........ [010] 00 80 00 00 00 00 00 00 00 00 00 02 00 01 00 00 ........ ........ [020] 00 04 00 00 00 01 00 00 01 04 00 02 00 08 00 02 ........ ........ [030] 00 0C 00 02 00 2D F9 6D D3 8A 62 5E 43 BE DE 27 .....-.m ..b^C..' [040] CB 29 AA CD A1 05 00 00 00 00 00 00 00 05 00 00 .)...... ........ [050] 00 41 00 48 00 55 00 53 00 00 00 55 7A 08 00 00 .A.H.U.S ...Uz... [060] 00 00 00 00 00 08 00 00 00 61 00 68 00 75 00 73 ........ .a.h.u.s [070] 00 2E 00 6E 00 6F 00 00 00 08 00 00 00 00 00 00 ...n.o.. ........ [080] 00 08 00 00 00 61 00 68 00 75 00 73 00 2E 00 6E .....a.h .u.s...n [090] 00 6F 00 00 00 00 00 00 00 .o...... . [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 9 mid = 6 [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 9 [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 9: got good SMB signature of [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 13 2C 8C 30 31 A8 C6 FE .,.01... [2008/12/09 16:14:22, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:22, 5] lib/util.c:show_msg(652) size=208 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=6 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 152 (0x98) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 152 (0x98) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=153 [2008/12/09 16:14:22, 10] lib/util.c:dump_data(2223) [000] 1A 05 00 02 03 10 00 00 00 98 00 00 00 02 00 00 ........ ........ [010] 00 80 00 00 00 00 00 00 00 00 00 02 00 01 00 00 ........ ........ [020] 00 04 00 00 00 01 00 00 01 04 00 02 00 08 00 02 ........ ........ [030] 00 0C 00 02 00 2D F9 6D D3 8A 62 5E 43 BE DE 27 .....-.m ..b^C..' [040] CB 29 AA CD A1 05 00 00 00 00 00 00 00 05 00 00 .)...... ........ [050] 00 41 00 48 00 55 00 53 00 00 00 55 7A 08 00 00 .A.H.U.S ...Uz... [060] 00 00 00 00 00 08 00 00 00 61 00 68 00 75 00 73 ........ .a.h.u.s [070] 00 2E 00 6E 00 6F 00 00 00 08 00 00 00 00 00 00 ...n.o.. ........ [080] 00 08 00 00 00 61 00 68 00 75 00 73 00 2E 00 6E .....a.h .u.s...n [090] 00 6F 00 00 00 00 00 00 00 .o...... . [2008/12/09 16:14:22, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 9 mid = 6 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr rpc_hdr [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 02 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0098 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000002 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_resp rpc_hdr_resp [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 00000080 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0016 cancel_ct : 00 [2008/12/09 16:14:22, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0017 reserved : 00 [2008/12/09 16:14:22, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(576) cli_pipe_validate_current_pdu: got pdu len 152, data_len 128, ss_len 0 [2008/12/09 16:14:22, 10] rpc_client/cli_pipe.c:rpc_api_pipe(842) rpc_api_pipe: got PDU len of 152 at offset 0 [2008/12/09 16:14:22, 10] rpc_client/cli_pipe.c:rpc_api_pipe(893) rpc_api_pipe: Remote machine bredde.ahus.no pipe \lsarpc fnum 0xc009 returned 256 bytes. dssetup_DsRoleGetPrimaryDomainInformation: struct dssetup_DsRoleGetPrimaryDomainInformation out: struct dssetup_DsRoleGetPrimaryDomainInformation info : * info : union dssetup_DsRoleInfo(case 1) basic: struct dssetup_DsRolePrimaryDomInfoBasic role : DS_ROLE_BACKUP_DC (4) flags : 0x01000001 (16777217) 1: DS_ROLE_PRIMARY_DS_RUNNING 0: DS_ROLE_PRIMARY_DS_MIXED_MODE 0: DS_ROLE_UPGRADE_IN_PROGRESS 1: DS_ROLE_PRIMARY_DOMAIN_GUID_PRESENT domain : * domain : 'AHUS' dns_domain : * dns_domain : 'ahus.no' forest : * forest : 'ahus.no' domain_guid : d36df92d-628a-435e-bede-27cb29aacda1 result : WERR_OK [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 10 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 99 BD 21 82 78 51 A5 77 ..!.xQ.w [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 11 mid = 7 [2008/12/09 16:14:23, 6] libsmb/clientgen.c:write_socket(236) write_socket(23,45) [2008/12/09 16:14:23, 6] libsmb/clientgen.c:write_socket(239) write_socket(23,45) wrote 45 [2008/12/09 16:14:23, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118) got smb length of 35 [2008/12/09 16:14:23, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:23, 5] lib/util.c:show_msg(652) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=7 smt_wct=0 smb_bcc=0 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 11 mid = 7 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 11 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 11: got good SMB signature of [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 08 8E 70 33 53 D7 F6 FF ..p3S... [2008/12/09 16:14:23, 10] libsmb/clientgen.c:cli_rpc_pipe_close(567) cli_rpc_pipe_close: closed pipe \lsarpc to machine bredde.ahus.no [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 12 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] EB EA 43 90 41 72 8A B1 ..C.Ar.. [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 13 mid = 8 [2008/12/09 16:14:23, 6] libsmb/clientgen.c:write_socket(236) write_socket(23,104) [2008/12/09 16:14:23, 6] libsmb/clientgen.c:write_socket(239) write_socket(23,104) wrote 104 [2008/12/09 16:14:23, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118) got smb length of 103 [2008/12/09 16:14:23, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:23, 5] lib/util.c:show_msg(652) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=8 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 103 (0x67) smb_vwv[ 2]= 2816 (0xB00) smb_vwv[ 3]= 448 (0x1C0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 16 (0x10) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 13 mid = 8 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 13 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 13: got good SMB signature of [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] A2 5C F8 32 D7 DC AB CB .\.2.... [2008/12/09 16:14:23, 5] rpc_client/cli_pipe.c:rpc_pipe_bind(2049) Bind RPC Pipe[c00b]: \lsarpc auth_type 0, auth_level 0 [2008/12/09 16:14:23, 5] rpc_client/cli_pipe.c:valid_pipe_name(1650) Bind Abstract Syntax: [000] 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB xW4.4... ...#Eg.. [010] 00 00 00 00 .... [2008/12/09 16:14:23, 5] rpc_client/cli_pipe.c:valid_pipe_name(1653) Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [010] 02 00 00 00 .... [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0b [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0048 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000003 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_rb [2008/12/09 16:14:23, 6] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_bba [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0010 max_tsize: 10b8 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0012 max_rsize: 10b8 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0014 assoc_gid: 00000000 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0018 num_contexts: 01 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 001c context_id : 0000 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 001e num_transfer_syntaxes: 01 [2008/12/09 16:14:23, 6] rpc_parse/parse_prs.c:prs_debug(88) 00001f smb_io_rpc_iface [2008/12/09 16:14:23, 7] rpc_parse/parse_prs.c:prs_debug(88) 000020 smb_io_uuid uuid [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0020 data : 12345778 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0024 data : 1234 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0026 data : abcd [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0028 data : ef 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 002a data : 01 23 45 67 89 ab [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0030 version: 00000000 [2008/12/09 16:14:23, 6] rpc_parse/parse_prs.c:prs_debug(88) 000034 smb_io_rpc_iface [2008/12/09 16:14:23, 7] rpc_parse/parse_prs.c:prs_debug(88) 000034 smb_io_uuid uuid [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0034 data : 8a885d04 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0038 data : 1ceb [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 003a data : 11c9 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003c data : 9f e8 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003e data : 08 00 2b 10 48 60 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0044 version: 00000002 [2008/12/09 16:14:23, 5] rpc_client/cli_pipe.c:rpc_api_pipe(769) rpc_api_pipe: Remote machine bredde.ahus.no pipe \lsarpc fnum 0xc00b [2008/12/09 16:14:23, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:23, 5] lib/util.c:show_msg(652) size=154 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=9 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 72 (0x48) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 72 (0x48) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=49163 (0xC00B) smb_bcc=87 [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 0B 03 10 00 00 00 48 00 00 00 03 00 00 00 B8 .......H ........ [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 ........ .......x [030] 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 W4.4.... ..#Eg... [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ [050] 10 48 60 02 00 00 00 .H`.... [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 14 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 5E 5D 57 A1 32 D7 1C 4F ^]W.2..O [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 15 mid = 9 [2008/12/09 16:14:23, 6] libsmb/clientgen.c:write_socket(236) write_socket(23,158) [2008/12/09 16:14:23, 6] libsmb/clientgen.c:write_socket(239) write_socket(23,158) wrote 158 [2008/12/09 16:14:23, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118) got smb length of 124 [2008/12/09 16:14:23, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:23, 5] lib/util.c:show_msg(652) size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=9 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 68 (0x44) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=69 [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 48 05 00 0C 03 10 00 00 00 44 00 00 00 03 00 00 H....... .D...... [010] 00 B8 10 B8 10 C1 61 22 00 0C 00 5C 50 49 50 45 ......a" ...\PIPE [020] 5C 6C 73 61 73 73 00 02 00 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 15 mid = 9 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 15 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 15: got good SMB signature of [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] F5 48 95 49 30 4D 2F 15 .H.I0M/. [2008/12/09 16:14:23, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:23, 5] lib/util.c:show_msg(652) size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=9 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 68 (0x44) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=69 [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 48 05 00 0C 03 10 00 00 00 44 00 00 00 03 00 00 H....... .D...... [010] 00 B8 10 B8 10 C1 61 22 00 0C 00 5C 50 49 50 45 ......a" ...\PIPE [020] 5C 6C 73 61 73 73 00 02 00 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 15 mid = 9 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr rpc_hdr [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0c [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0044 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000003 [2008/12/09 16:14:23, 10] rpc_client/cli_pipe.c:rpc_api_pipe(842) rpc_api_pipe: got PDU len of 68 at offset 0 [2008/12/09 16:14:23, 10] rpc_client/cli_pipe.c:rpc_api_pipe(893) rpc_api_pipe: Remote machine bredde.ahus.no pipe \lsarpc fnum 0xc00b returned 68 bytes. [2008/12/09 16:14:23, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2086) rpc_pipe_bind: Remote machine bredde.ahus.no pipe \lsarpc fnum 0xc00b bind request returned ok. [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0c [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0044 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000003 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_ba [2008/12/09 16:14:23, 6] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_bba [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0010 max_tsize: 10b8 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0012 max_rsize: 10b8 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0014 assoc_gid: 002261c1 [2008/12/09 16:14:23, 6] rpc_parse/parse_prs.c:prs_debug(88) 000018 smb_io_rpc_addr_str [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0018 len: 000c [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 001a str: \PIPE\lsass. [2008/12/09 16:14:23, 6] rpc_parse/parse_prs.c:prs_debug(88) 000026 smb_io_rpc_results [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0028 num_results: 01 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 002c result : 0000 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 002e reason : 0000 [2008/12/09 16:14:23, 6] rpc_parse/parse_prs.c:prs_debug(88) 000030 smb_io_rpc_iface [2008/12/09 16:14:23, 7] rpc_parse/parse_prs.c:prs_debug(88) 000030 smb_io_uuid uuid [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0030 data : 8a885d04 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0034 data : 1ceb [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0036 data : 11c9 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0038 data : 9f e8 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003a data : 08 00 2b 10 48 60 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0040 version: 00000002 [2008/12/09 16:14:23, 5] rpc_client/cli_pipe.c:check_bind_response(1704) check_bind_response: accepted! [2008/12/09 16:14:23, 10] rpc_client/cli_pipe.c:cli_rpc_pipe_open_noauth(2282) cli_rpc_pipe_open_noauth: opened pipe \lsarpc to machine bredde.ahus.no and bound anonymously. [2008/12/09 16:14:23, 5] rpc_client/init_lsa.c:init_lsa_sec_qos(70) init_lsa_sec_qos [2008/12/09 16:14:23, 5] rpc_client/init_lsa.c:init_lsa_obj_attr(90) init_lsa_obj_attr lsa_OpenPolicy2: struct lsa_OpenPolicy2 in: struct lsa_OpenPolicy2 system_name : * system_name : '' attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0050 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000004 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_req hdr_req [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 00000038 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0016 opnum : 002c [2008/12/09 16:14:23, 5] rpc_client/cli_pipe.c:rpc_api_pipe(769) rpc_api_pipe: Remote machine bredde.ahus.no pipe \lsarpc fnum 0xc00b [2008/12/09 16:14:23, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:23, 5] lib/util.c:show_msg(652) size=162 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=10 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 80 (0x50) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 80 (0x50) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=49163 (0xC00B) smb_bcc=95 [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 50 00 00 00 04 00 00 00 38 .......P .......8 [020] 00 00 00 00 00 2C 00 00 00 02 00 01 00 00 00 00 .....,.. ........ [030] 00 00 00 01 00 00 00 00 00 00 00 18 00 00 00 00 ........ ........ [040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 ........ ........ [050] 00 02 00 0C 00 00 00 02 00 01 00 00 00 00 02 ........ ....... [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 16 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 1C 82 DB FF 0F A7 63 C7 ......c. [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 17 mid = 10 [2008/12/09 16:14:23, 6] libsmb/clientgen.c:write_socket(236) write_socket(23,166) [2008/12/09 16:14:23, 6] libsmb/clientgen.c:write_socket(239) write_socket(23,166) wrote 166 [2008/12/09 16:14:23, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118) got smb length of 104 [2008/12/09 16:14:23, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:23, 5] lib/util.c:show_msg(652) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=10 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 50 05 00 02 03 10 00 00 00 30 00 00 00 04 00 00 P....... .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 B1 A9 22 ........ ......." [020] E6 EB E9 E3 48 BC E6 14 46 0E 01 D9 D4 00 00 00 ....H... F....... [030] 00 . [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 17 mid = 10 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 17 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 17: got good SMB signature of [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 62 08 46 34 53 BD A9 84 b.F4S... [2008/12/09 16:14:23, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:23, 5] lib/util.c:show_msg(652) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=10 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 50 05 00 02 03 10 00 00 00 30 00 00 00 04 00 00 P....... .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 B1 A9 22 ........ ......." [020] E6 EB E9 E3 48 BC E6 14 46 0E 01 D9 D4 00 00 00 ....H... F....... [030] 00 . [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 17 mid = 10 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr rpc_hdr [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 02 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0030 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000004 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_resp rpc_hdr_resp [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 00000018 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0016 cancel_ct : 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0017 reserved : 00 [2008/12/09 16:14:23, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(576) cli_pipe_validate_current_pdu: got pdu len 48, data_len 24, ss_len 0 [2008/12/09 16:14:23, 10] rpc_client/cli_pipe.c:rpc_api_pipe(842) rpc_api_pipe: got PDU len of 48 at offset 0 [2008/12/09 16:14:23, 10] rpc_client/cli_pipe.c:rpc_api_pipe(893) rpc_api_pipe: Remote machine bredde.ahus.no pipe \lsarpc fnum 0xc00b returned 48 bytes. lsa_OpenPolicy2: struct lsa_OpenPolicy2 out: struct lsa_OpenPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : e622a9b1-e9eb-48e3-bce6-14460e01d9d4 result : NT_STATUS_OK lsa_QueryInfoPolicy2: struct lsa_QueryInfoPolicy2 in: struct lsa_QueryInfoPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : e622a9b1-e9eb-48e3-bce6-14460e01d9d4 level : LSA_POLICY_INFO_DNS (12) [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 002e [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000005 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_req hdr_req [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 00000016 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0016 opnum : 002e [2008/12/09 16:14:23, 5] rpc_client/cli_pipe.c:rpc_api_pipe(769) rpc_api_pipe: Remote machine bredde.ahus.no pipe \lsarpc fnum 0xc00b [2008/12/09 16:14:23, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:23, 5] lib/util.c:show_msg(652) size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=11 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 46 (0x2E) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 46 (0x2E) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=49163 (0xC00B) smb_bcc=61 [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 2E 00 00 00 05 00 00 00 16 ........ ........ [020] 00 00 00 00 00 2E 00 00 00 00 00 B1 A9 22 E6 EB ........ .....".. [030] E9 E3 48 BC E6 14 46 0E 01 D9 D4 0C 00 ..H...F. ..... [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 18 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 41 E5 61 CB 87 15 8C FD A.a..... [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 19 mid = 11 [2008/12/09 16:14:23, 6] libsmb/clientgen.c:write_socket(236) write_socket(23,132) [2008/12/09 16:14:23, 6] libsmb/clientgen.c:write_socket(239) write_socket(23,132) wrote 132 [2008/12/09 16:14:23, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118) got smb length of 240 [2008/12/09 16:14:23, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:23, 5] lib/util.c:show_msg(652) size=240 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=11 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 184 (0xB8) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 184 (0xB8) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=185 [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 2E 05 00 02 03 10 00 00 00 B8 00 00 00 05 00 00 ........ ........ [010] 00 A0 00 00 00 00 00 00 00 00 00 02 00 0C 00 00 ........ ........ [020] 00 08 00 0A 00 04 00 02 00 0E 00 10 00 08 00 02 ........ ........ [030] 00 0E 00 10 00 0C 00 02 00 2D F9 6D D3 8A 62 5E ........ .-.m..b^ [040] 43 BE DE 27 CB 29 AA CD A1 10 00 02 00 05 00 00 C..'.).. ........ [050] 00 00 00 00 00 04 00 00 00 41 00 48 00 55 00 53 ........ .A.H.U.S [060] 00 08 00 00 00 00 00 00 00 07 00 00 00 61 00 68 ........ .....a.h [070] 00 75 00 73 00 2E 00 6E 00 6F 00 00 00 08 00 00 .u.s...n .o...... [080] 00 00 00 00 00 07 00 00 00 61 00 68 00 75 00 73 ........ .a.h.u.s [090] 00 2E 00 6E 00 6F 00 00 00 04 00 00 00 01 04 00 ...n.o.. ........ [0A0] 00 00 00 00 05 15 00 00 00 A6 5F B8 2F A0 A6 2D ........ .._./..- [0B0] 48 17 EF 24 40 00 00 00 00 H..$@... . [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 19 mid = 11 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 19 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 19: got good SMB signature of [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 26 CC 65 BE 74 5B 37 98 &.e.t[7. [2008/12/09 16:14:23, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:23, 5] lib/util.c:show_msg(652) size=240 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=11 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 184 (0xB8) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 184 (0xB8) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=185 [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 2E 05 00 02 03 10 00 00 00 B8 00 00 00 05 00 00 ........ ........ [010] 00 A0 00 00 00 00 00 00 00 00 00 02 00 0C 00 00 ........ ........ [020] 00 08 00 0A 00 04 00 02 00 0E 00 10 00 08 00 02 ........ ........ [030] 00 0E 00 10 00 0C 00 02 00 2D F9 6D D3 8A 62 5E ........ .-.m..b^ [040] 43 BE DE 27 CB 29 AA CD A1 10 00 02 00 05 00 00 C..'.).. ........ [050] 00 00 00 00 00 04 00 00 00 41 00 48 00 55 00 53 ........ .A.H.U.S [060] 00 08 00 00 00 00 00 00 00 07 00 00 00 61 00 68 ........ .....a.h [070] 00 75 00 73 00 2E 00 6E 00 6F 00 00 00 08 00 00 .u.s...n .o...... [080] 00 00 00 00 00 07 00 00 00 61 00 68 00 75 00 73 ........ .a.h.u.s [090] 00 2E 00 6E 00 6F 00 00 00 04 00 00 00 01 04 00 ...n.o.. ........ [0A0] 00 00 00 00 05 15 00 00 00 A6 5F B8 2F A0 A6 2D ........ .._./..- [0B0] 48 17 EF 24 40 00 00 00 00 H..$@... . [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 19 mid = 11 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr rpc_hdr [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 02 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 00b8 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000005 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_resp rpc_hdr_resp [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 000000a0 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0016 cancel_ct : 00 [2008/12/09 16:14:23, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0017 reserved : 00 [2008/12/09 16:14:23, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(576) cli_pipe_validate_current_pdu: got pdu len 184, data_len 160, ss_len 0 [2008/12/09 16:14:23, 10] rpc_client/cli_pipe.c:rpc_api_pipe(842) rpc_api_pipe: got PDU len of 184 at offset 0 [2008/12/09 16:14:23, 10] rpc_client/cli_pipe.c:rpc_api_pipe(893) rpc_api_pipe: Remote machine bredde.ahus.no pipe \lsarpc fnum 0xc00b returned 320 bytes. lsa_QueryInfoPolicy2: struct lsa_QueryInfoPolicy2 out: struct lsa_QueryInfoPolicy2 info : * info : * info : union lsa_PolicyInformation(case 12) dns: struct lsa_DnsDomainInfo name: struct lsa_StringLarge length : 0x0008 (8) size : 0x000a (10) string : * string : 'AHUS' dns_domain: struct lsa_StringLarge length : 0x000e (14) size : 0x0010 (16) string : * string : 'ahus.no' dns_forest: struct lsa_StringLarge length : 0x000e (14) size : 0x0010 (16) string : * string : 'ahus.no' domain_guid : d36df92d-628a-435e-bede-27cb29aacda1 sid : * sid : S-1-5-21-800612262-1210951328-1076162327 result : NT_STATUS_OK [2008/12/09 16:14:23, 5] winbindd/winbindd_cm.c:set_dc_type_and_flags_connect(1895) set_dc_type_and_flags_connect: domain AHUS is in native mode. [2008/12/09 16:14:23, 5] winbindd/winbindd_cm.c:set_dc_type_and_flags_connect(1898) set_dc_type_and_flags_connect: domain AHUS is running active directory. [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 20 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] 2D B4 6E 4E 65 92 7E ED -.nNe.~. [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 21 mid = 12 [2008/12/09 16:14:23, 6] libsmb/clientgen.c:write_socket(236) write_socket(23,45) [2008/12/09 16:14:23, 6] libsmb/clientgen.c:write_socket(239) write_socket(23,45) wrote 45 [2008/12/09 16:14:23, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118) got smb length of 35 [2008/12/09 16:14:23, 5] lib/util.c:show_msg(642) [2008/12/09 16:14:23, 5] lib/util.c:show_msg(652) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=4103 smb_pid=4115 smb_uid=51202 smb_mid=12 smt_wct=0 smb_bcc=0 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 21 mid = 12 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 21 [2008/12/09 16:14:23, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 21: got good SMB signature of [2008/12/09 16:14:23, 10] lib/util.c:dump_data(2223) [000] F4 2B FB D5 65 21 FF 3C .+..e!.< [2008/12/09 16:14:23, 10] libsmb/clientgen.c:cli_rpc_pipe_close(567) cli_rpc_pipe_close: closed pipe \lsarpc to machine bredde.ahus.no [2008/12/09 16:14:23, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 294/606497 [2008/12/09 16:19:17, 10] winbindd/winbindd_dual.c:fork_domain_child(1161) fork_domain_child: domain BUILTIN no longer in 'startup' mode. [2008/12/09 16:19:17, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 0/43599 [2008/12/09 16:19:17, 10] lib/events.c:run_events(263) Running event "async_request_timeout" 84ca6d8 [2008/12/09 16:19:17, 0] winbindd/winbindd_dual.c:async_request_timeout_handler(182) async_request_timeout_handler: child pid 4113 is not responding. Closing connection to it. [2008/12/09 16:19:17, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 84ca6d8 "async_request_timeout" [2008/12/09 16:19:17, 5] winbindd/winbindd_dual.c:async_reply_recv(264) Could not receive async reply from child pid 4113 [2008/12/09 16:19:17, 5] winbindd/winbindd_util.c:init_child_recv(617) Received child initialization response for domain AHUS [2008/12/09 16:19:17, 3] winbindd/winbindd_util.c:init_child_recv(620) Could not init child [2008/12/09 16:19:17, 5] winbindd/winbindd_dual.c:domain_init_recv(368) Domain init returned an error [2008/12/09 16:19:17, 1] winbindd/winbindd_util.c:trustdom_recv(260) Could not receive trustdoms