SAMBA attempting to login as guest or anonymous to Windows IPC$ share

[BeaconMRat]

I am having a hard time figuring this out and was hoping someone could give me a hand with this. Several of my CentOS 5.10 servers are causing a lot of 531 log on failures on all of my windows servers (all versions). Iv WireSharked this and can see the attempt to connect attempt to \\SERVERNAME\IPC$ as Guest however I am still unable to figure out exactly how to stop it from happening. Below is the audit failure I am seeing on the windows server and attached is the pcap. Any advice and assistance with this would be greatly appreciated.

Logon Failure:
Reason: Account currently disabled
User Name: GUEST
Domain: BTI
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: SG_WEB
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 10.21.4.134
Source Port: 0
Attached Files

• sg_web capture.zip (6.3 KB)

Continue reading...