Attachment #753 for bug #125

View | Details | Raw Unified | Return to bug 125 | Differences between

and this patch

Lines 85-91 SSHDOBJS=sshd.o auth-rhosts.o auth-passw Link Here

(-)Makefile.in (-1 / +2 lines)
85	monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o \	85	monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o \
86	auth-krb5.o \	86	auth-krb5.o \
87	auth2-gss.o gss-serv.o gss-serv-krb5.o \	87	auth2-gss.o gss-serv.o gss-serv-krb5.o \
88	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o	88	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o audit.o \
		89	audit-bsm.o
89		90
90	MANPAGES = scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out sshd_config.5.out ssh_config.5.out	91	MANPAGES = scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out sshd_config.5.out ssh_config.5.out
91	MANPAGES_IN = scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 sshd_config.5 ssh_config.5	92	MANPAGES_IN = scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 sshd_config.5 ssh_config.5

Lines 240-247 auth_log(Authctxt *authctxt, int authent Link Here

(-)auth.c (-2 / +8 lines)
240	info);	240	info);
241		241
242	#ifdef CUSTOM_FAILED_LOGIN	242	#ifdef CUSTOM_FAILED_LOGIN
243	if (authenticated == 0 && strcmp(method, "password") == 0)	243	if (authenticated == 0) {
244	record_failed_login(authctxt->user, "ssh");	244	if (strcmp(method, "password") == 0) {
		245	record_failed_login(authctxt->user, "ssh");
		246	audit_event(LOGIN_FAIL_BADPW);
		247	} else if (strcmp(method, "keyboard-interactive") == 0) {
		248	audit_event(LOGIN_FAIL_KBDINT);
		249	}
		250	}
245	#endif	251	#endif
246	}	252	}
247		253

Lines 130-135 int auth_shadow_pwexpired(Authctxt *); Link Here

(-)auth.h (+1 lines)
130	#endif	130	#endif
131		131
132	#include "auth-pam.h"	132	#include "auth-pam.h"
		133	#include "audit.h"
133	void disable_forwarding(void);	134	void disable_forwarding(void);
134		135
135	void do_authentication(Authctxt *);	136	void do_authentication(Authctxt *);

Lines 247-254 do_authloop(Authctxt *authctxt) Link Here

(-)auth1.c (-2 / +6 lines)
247	#else	247	#else
248	/* Special handling for root */	248	/* Special handling for root */
249	if (authenticated && authctxt->pw->pw_uid == 0 &&	249	if (authenticated && authctxt->pw->pw_uid == 0 &&
250	!auth_root_allowed(get_authname(type)))	250	!auth_root_allowed(get_authname(type))) {
251	authenticated = 0;	251	authenticated = 0;
		252	PRIVSEP(audit_event(ROOT_NOT_CONSOLE));
		253	}
252	#endif	254	#endif
253		255
254	#ifdef USE_PAM	256	#ifdef USE_PAM
Lines 283-290 do_authloop(Authctxt *authctxt) Link Here
283	if (authenticated)	285	if (authenticated)
284	return;	286	return;
285		287
286	if (authctxt->failures++ > options.max_authtries)	288	if (authctxt->failures++ > options.max_authtries) {
		289	PRIVSEP(audit_event(LOGIN_EXCEED_MAXTRIES));
287	packet_disconnect(AUTH_FAIL_MSG, authctxt->user);	290	packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
		291	}
288		292
289	packet_start(SSH_SMSG_FAILURE);	293	packet_start(SSH_SMSG_FAILURE);
290	packet_send();	294	packet_send();

Lines 167-172 input_userauth_request(int type, u_int32 Link Here

(-)auth2.c (-2 / +8 lines)
167	if (options.use_pam)	167	if (options.use_pam)
168	PRIVSEP(start_pam(authctxt));	168	PRIVSEP(start_pam(authctxt));
169	#endif	169	#endif
		170	PRIVSEP(audit_event(ILLEGAL_USER));
170	}	171	}
171	setproctitle("%s%s", authctxt->valid ? user : "unknown",	172	setproctitle("%s%s", authctxt->valid ? user : "unknown",
172	use_privsep ? " [net]" : "");	173	use_privsep ? " [net]" : "");
Lines 214-221 userauth_finish(Authctxt *authctxt, int Link Here
214		215
215	/* Special handling for root */	216	/* Special handling for root */
216	if (authenticated && authctxt->pw->pw_uid == 0 &&	217	if (authenticated && authctxt->pw->pw_uid == 0 &&
217	!auth_root_allowed(method))	218	!auth_root_allowed(method)) {
218	authenticated = 0;	219	authenticated = 0;
		220	PRIVSEP(audit_event(ROOT_NOT_CONSOLE));
		221	}
219		222
220	#ifdef USE_PAM	223	#ifdef USE_PAM
221	if (options.use_pam && authenticated) {	224	if (options.use_pam && authenticated) {
Lines 255-262 userauth_finish(Authctxt *authctxt, int Link Here
255	/* now we can break out */	258	/* now we can break out */
256	authctxt->success = 1;	259	authctxt->success = 1;
257	} else {	260	} else {
258	if (authctxt->failures++ > options.max_authtries)	261	if (authctxt->failures++ > options.max_authtries) {
		262	PRIVSEP(audit_event(LOGIN_EXCEED_MAXTRIES));
259	packet_disconnect(AUTH_FAIL_MSG, authctxt->user);	263	packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
		264	}
		265	PRIVSEP(audit_event(AUTH_FAILED));
260	methods = authmethods_get();	266	methods = authmethods_get();
261	packet_start(SSH2_MSG_USERAUTH_FAILURE);	267	packet_start(SSH2_MSG_USERAUTH_FAILURE);
262	packet_put_cstring(methods);	268	packet_put_cstring(methods);

Lines 874-879 AC_ARG_WITH(libedit, Link Here

(-)configure.ac (+16 lines)
874	fi ]	874	fi ]
875	)	875	)
876		876
		877	BSM_MSG="no"
		878	AC_ARG_WITH(bsmaudit,
		879	[ --with-bsmaudit Enable BSM audit support],
		880	[ if test "x$withval" != "no" ; then
		881	dnl Checks for headers, libs and functions
		882	AC_CHECK_HEADERS(bsm/audit.h, [],
		883	[AC_MSG_ERROR(BSM enabled and bsm/audit.h not found)])
		884	AC_CHECK_LIB(bsm, getaudit, [],
		885	[AC_MSG_ERROR(BSM enabled and required library not found)])
		886	AC_CHECK_FUNCS(getaudit getaudit_addr gettext, [],
		887	[AC_MSG_ERROR(BSM enabled and required function not found)])
		888	fi ]
		889	)
		890
877	dnl Checks for library functions. Please keep in alphabetical order	891	dnl Checks for library functions. Please keep in alphabetical order
878	AC_CHECK_FUNCS(\	892	AC_CHECK_FUNCS(\
879	arc4random __b64_ntop b64_ntop __b64_pton b64_pton bcopy \	893	arc4random __b64_ntop b64_ntop __b64_pton b64_pton bcopy \
Lines 1776-1781 fi Link Here
1776	TYPE_SOCKLEN_T	1790	TYPE_SOCKLEN_T
1777		1791
1778	AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>])	1792	AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>])
		1793
		1794	AC_CHECK_TYPES(in_addr_t,,,[#include <netinet/in.h>])
1779		1795
1780	AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [	1796	AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
1781	AC_TRY_COMPILE(	1797	AC_TRY_COMPILE(

Lines 288-293 struct sockaddr_un { Link Here

(-)defines.h (+9 lines)
288	};	288	};
289	#endif /* HAVE_SYS_UN_H */	289	#endif /* HAVE_SYS_UN_H */
290		290
		291	#ifndef HAVE_IN_ADDR_T
		292	typedef u_int32_t in_addr_t;
		293	#endif
		294
291	#if defined(BROKEN_SYS_TERMIO_H) && !defined(_STRUCT_WINSIZE)	295	#if defined(BROKEN_SYS_TERMIO_H) && !defined(_STRUCT_WINSIZE)
292	#define _STRUCT_WINSIZE	296	#define _STRUCT_WINSIZE
293	struct winsize {	297	struct winsize {
Lines 529-534 struct winsize { Link Here
529	#ifndef GETPGRP_VOID	533	#ifndef GETPGRP_VOID
530	# define getpgrp() getpgrp(0)	534	# define getpgrp() getpgrp(0)
531	#endif	535	#endif
		536
		537	#if defined(HAVE_BSM_AUDIT_H) && defined(HAVE_LIBBSM)
		538	# define USE_BSM_AUDIT
		539	#endif
		540	#define CUSTOM_FAILED_LOGIN
532		541
533	/* OPENSSL_free() is Free() in versions before OpenSSL 0.9.6 */	542	/* OPENSSL_free() is Free() in versions before OpenSSL 0.9.6 */
534	#if !defined(OPENSSL_VERSION_NUMBER) \|\| (OPENSSL_VERSION_NUMBER < 0x0090600f)	543	#if !defined(OPENSSL_VERSION_NUMBER) \|\| (OPENSSL_VERSION_NUMBER < 0x0090600f)

Lines 131-136 Link Here

(-)loginrec.c (+2 lines)
131	#include "loginrec.h"	131	#include "loginrec.h"
132	#include "log.h"	132	#include "log.h"
133	#include "atomicio.h"	133	#include "atomicio.h"
		134	#include "auth.h"
134		135
135	#ifdef HAVE_UTIL_H	136	#ifdef HAVE_UTIL_H
136	# include <util.h>	137	# include <util.h>
Lines 205-210 login_login(struct logininfo *li) Link Here
205	int	206	int
206	login_logout(struct logininfo *li)	207	login_logout(struct logininfo *li)
207	{	208	{
		209	audit_event(LOGOUT);
208	li->type = LTYPE_LOGOUT;	210	li->type = LTYPE_LOGOUT;
209	return (login_write(li));	211	return (login_write(li));
210	}	212	}

Lines 143-148 int mm_answer_gss_userok(int, Buffer *); Link Here

(-)monitor.c (+38 lines)
143	int mm_answer_gss_checkmic(int, Buffer *);	143	int mm_answer_gss_checkmic(int, Buffer *);
144	#endif	144	#endif
145		145
		146	#ifdef AUDIT_EVENTS
		147	int mm_answer_audit_event(int, Buffer *);
		148	#endif
		149
146	static Authctxt *authctxt;	150	static Authctxt *authctxt;
147	static BIGNUM ssh1_challenge = NULL; / used for ssh1 rsa auth */	151	static BIGNUM ssh1_challenge = NULL; / used for ssh1 rsa auth */
148		152
Lines 196-201 struct mon_table mon_dispatch_proto20[] Link Here
196	#endif	200	#endif
197	{MONITOR_REQ_KEYALLOWED, MON_ISAUTH, mm_answer_keyallowed},	201	{MONITOR_REQ_KEYALLOWED, MON_ISAUTH, mm_answer_keyallowed},
198	{MONITOR_REQ_KEYVERIFY, MON_AUTH, mm_answer_keyverify},	202	{MONITOR_REQ_KEYVERIFY, MON_AUTH, mm_answer_keyverify},
		203	#ifdef AUDIT_EVENTS
		204	{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
		205	#endif
199	#ifdef GSSAPI	206	#ifdef GSSAPI
200	{MONITOR_REQ_GSSSETUP, MON_ISAUTH, mm_answer_gss_setup_ctx},	207	{MONITOR_REQ_GSSSETUP, MON_ISAUTH, mm_answer_gss_setup_ctx},
201	{MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx},	208	{MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx},
Lines 239-244 struct mon_table mon_dispatch_proto15[] Link Here
239	{MONITOR_REQ_PAM_RESPOND, MON_ISAUTH, mm_answer_pam_respond},	246	{MONITOR_REQ_PAM_RESPOND, MON_ISAUTH, mm_answer_pam_respond},
240	{MONITOR_REQ_PAM_FREE_CTX, MON_ONCE\|MON_AUTHDECIDE, mm_answer_pam_free_ctx},	247	{MONITOR_REQ_PAM_FREE_CTX, MON_ONCE\|MON_AUTHDECIDE, mm_answer_pam_free_ctx},
241	#endif	248	#endif
		249	#ifdef AUDIT_EVENTS
		250	{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
		251	#endif
242	{0, 0, NULL}	252	{0, 0, NULL}
243	};	253	};
244		254
Lines 1490-1495 mm_answer_term(int sock, Buffer *req) Link Here
1490	/* Terminate process */	1500	/* Terminate process */
1491	exit(res);	1501	exit(res);
1492	}	1502	}
		1503
		1504	#ifdef AUDIT_EVENTS
		1505	/* Report that an audit event occurred */
		1506
		1507	int
		1508	mm_answer_audit_event(int socket, Buffer *m)
		1509	{
		1510	enum audit_event_type event;
		1511
		1512	debug3("%s", __func__);
		1513
		1514	event = buffer_get_int(m);
		1515	switch(event) {
		1516	case AUTH_FAILED:
		1517	case LOGIN_EXCEED_MAXTRIES:
		1518	case LOGIN_FAIL_BADPW:
		1519	case LOGIN_FAIL_KBDINT:
		1520	case ROOT_NOT_CONSOLE:
		1521	case ILLEGAL_USER:
		1522	audit_event(event);
		1523	break;
		1524	default:
		1525	fatal("Audit event type %d not permitted", event);
		1526	}
		1527
		1528	return (0);
		1529	}
		1530	#endif
1493		1531
1494	void	1532	void
1495	monitor_apply_keystate(struct monitor *pmonitor)	1533	monitor_apply_keystate(struct monitor *pmonitor)

Lines 46-51 enum monitor_reqtype { Link Here

(-)monitor.h (+1 lines)
46	MONITOR_REQ_PTYCLEANUP,	46	MONITOR_REQ_PTYCLEANUP,
47	MONITOR_REQ_SESSKEY, MONITOR_ANS_SESSKEY,	47	MONITOR_REQ_SESSKEY, MONITOR_ANS_SESSKEY,
48	MONITOR_REQ_SESSID,	48	MONITOR_REQ_SESSID,
		49	MONITOR_REQ_AUDIT_EVENT,
49	MONITOR_REQ_RSAKEYALLOWED, MONITOR_ANS_RSAKEYALLOWED,	50	MONITOR_REQ_RSAKEYALLOWED, MONITOR_ANS_RSAKEYALLOWED,
50	MONITOR_REQ_RSACHALLENGE, MONITOR_ANS_RSACHALLENGE,	51	MONITOR_REQ_RSACHALLENGE, MONITOR_ANS_RSACHALLENGE,
51	MONITOR_REQ_RSARESPONSE, MONITOR_ANS_RSARESPONSE,	52	MONITOR_REQ_RSARESPONSE, MONITOR_ANS_RSARESPONSE,




	return (success);
}

void
mm_audit_event(enum audit_event_type event)
{
#ifdef AUDIT_EVENTS
	Buffer m;

	debug3("%s entering", __func__);

	buffer_init(&m);
	buffer_put_int(&m, event);

	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_EVENT, &m);
	buffer_free(&m);
#endif /* AUDIT_EVENTS */
}

#ifdef GSSAPI
OM_uint32
mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID goid)

Lines 74-79 int mm_sshpam_respond(void *, u_int, cha Link Here

(-)monitor_wrap.h (+3 lines)
74	void mm_sshpam_free_ctx(void *);	74	void mm_sshpam_free_ctx(void *);
75	#endif	75	#endif
76		76
		77	#include "audit.h"
		78	void mm_audit_event(enum audit_event_type);
		79
77	struct Session;	80	struct Session;
78	void mm_terminate(void);	81	void mm_terminate(void);
79	int mm_pty_allocate(int , int , char *, int);	82	int mm_pty_allocate(int , int , char *, int);

Lines 570-575 do_exec_pty(Session s, const char comm Link Here

(-)session.c (+5 lines)
570	cray_init_job(s->pw); /* set up cray jid and tmpdir */	570	cray_init_job(s->pw); /* set up cray jid and tmpdir */
571	#endif /* _UNICOS */	571	#endif /* _UNICOS */
572	do_login(s, command);	572	do_login(s, command);
		573	if (s->tty != NULL)
		574	audit_save_ttyn(s->tty);
573	}	575	}
574	# ifdef LOGIN_NEEDS_UTMPX	576	# ifdef LOGIN_NEEDS_UTMPX
575	else	577	else
Lines 1231-1236 do_nologin(struct passwd *pw) Link Here
1231	while (fgets(buf, sizeof(buf), f))	1233	while (fgets(buf, sizeof(buf), f))
1232	fputs(buf, stderr);	1234	fputs(buf, stderr);
1233	fclose(f);	1235	fclose(f);
		1236	audit_event(NOLOGIN);
1234	fflush(NULL);	1237	fflush(NULL);
1235	exit(254);	1238	exit(254);
1236	}	1239	}
Lines 1428-1433 do_child(Session s, const char command Link Here
1428	do_motd();	1431	do_motd();
1429	#else /* HAVE_OSF_SIA */	1432	#else /* HAVE_OSF_SIA */
1430	do_nologin(pw);	1433	do_nologin(pw);
		1434	if (command != NULL)
		1435	audit_run_command(command);
1431	do_setusercontext(pw);	1436	do_setusercontext(pw);
1432	/*	1437	/*
1433	* PAM session modules in do_setusercontext may have	1438	* PAM session modules in do_setusercontext may have

Lines 1631-1637 main(int ac, char **av) Link Here

(-)sshd.c (-1 / +3 lines)
1631		1631
1632	remote_port = get_remote_port();	1632	remote_port = get_remote_port();
1633	remote_ip = get_remote_ipaddr();	1633	remote_ip = get_remote_ipaddr();
1634		1634	audit_connection_from(remote_ip, remote_port);
1635	#ifdef LIBWRAP	1635	#ifdef LIBWRAP
1636	/* Check whether logins are denied from this host. */	1636	/* Check whether logins are denied from this host. */
1637	if (packet_connection_is_on_socket()) {	1637	if (packet_connection_is_on_socket()) {
Lines 1704-1709 main(int ac, char **av) Link Here
1704	}	1704	}
1705		1705
1706	authenticated:	1706	authenticated:
		1707	audit_event(LOGIN_SUCCESS);
		1708
1707	/*	1709	/*
1708	* In privilege separation, we fork another child and prepare	1710	* In privilege separation, we fork another child and prepare
1709	* file descriptor passing.	1711	* file descriptor passing.




/* $Id$ */

/*
 * Copyright (c) 2004 Darren Tucker.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"
#ifndef AUDIT_EVENTS

#define DEBUG_AUDIT_HOOKS 1	/* XXX */

#include "audit.h"

#ifdef DEBUG_AUDIT_HOOKS
#include "log.h"
#include "auth.h"

extern Authctxt *the_authctxt;
#endif

/* Null implementations of audit functions */

void
audit_connection_from(const char *host, int port)
{
#ifdef DEBUG_AUDIT_HOOKS
	debug("%s: connection from %s port %d", __func__, host, port);
#endif
}

void
audit_event(enum audit_event_type event)
{
#ifdef DEBUG_AUDIT_HOOKS
	char *eventstr[] = {
		"AUTH_FAILED",
		"LOGIN_SUCCESS",
		"LOGIN_EXCEED_MAXTRIES",
		"LOGIN_FAIL_BADPW",
		"LOGIN_FAIL_KBDINT",
		"ILLEGAL_USER",
		"ROOT_NOT_CONSOLE",
		"NOLOGIN",
		"LOGOUT"
	};

	debug("%s: event %d (%s) for user %s", __func__, event, eventstr[event],
	    the_authctxt->user);
#endif
}

void
audit_save_ttyn(const char *ttyn)
{
#ifdef DEBUG_AUDIT_HOOKS
	debug("%s: user %s tty name %s", __func__, the_authctxt->user, ttyn);
#endif
}

void
audit_run_command(const char *command)
{
#ifdef DEBUG_AUDIT_HOOKS
	debug("%s: user %s command '%s'", __func__, the_authctxt->user,
	    command);
#endif
}

void
record_failed_login(const char *user, const char *ttyname)
{
#ifdef DEBUG_AUDIT_HOOKS
	debug("%s: (audit) user %s ttyname %s", __func__, user, ttyname);
#endif
}
#endif




/* $Id$ */

/*
 * Copyright (c) 2004 Darren Tucker.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "auth.h"

#ifndef SSHAUDIT_H
# define SSHAUDIT_H
enum audit_event_type {
	AUTH_FAILED,		/* merge with LOGIN_FAIL_BADPW? */
	LOGIN_SUCCESS,
	LOGIN_EXCEED_MAXTRIES,
	LOGIN_FAIL_BADPW,
	LOGIN_FAIL_KBDINT,
	ILLEGAL_USER,
	ROOT_NOT_CONSOLE,
	NOLOGIN,
	LOGOUT
};

void audit_init(Authctxt *ctxt);
void audit_connection_from(const char *host, int port);
void audit_event(enum audit_event_type event);
void audit_save_ttyn(const char *ttyn);
void audit_run_command(const char *command);
void record_failed_login(const char *, const char *);

#endif /* SSHAUDIT_H */

Return to bug 125

Lines 1103-1108 mm_auth_rsa_verify_response(Key *key, BI Link Here

(-)monitor_wrap.c (+16 lines)
1103	return (success);	1103	return (success);
1104	}	1104	}
1105		1105
		1106	void
		1107	mm_audit_event(enum audit_event_type event)
		1108	{
		1109	#ifdef AUDIT_EVENTS
		1110	Buffer m;
		1111
		1112	debug3("%s entering", __func__);
		1113
		1114	buffer_init(&m);
		1115	buffer_put_int(&m, event);
		1116
		1117	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_EVENT, &m);
		1118	buffer_free(&m);
		1119	#endif /* AUDIT_EVENTS */
		1120	}
		1121
1106	#ifdef GSSAPI	1122	#ifdef GSSAPI
1107	OM_uint32	1123	OM_uint32
1108	mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID goid)	1124	mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID goid)

Added Link Here

(-)audit.c (+96 lines)
1	/* $Id$ */
2
3	/*
4	* Copyright (c) 2004 Darren Tucker. All rights reserved.
5	*
6	* Redistribution and use in source and binary forms, with or without
7	* modification, are permitted provided that the following conditions
8	* are met:
9	* 1. Redistributions of source code must retain the above copyright
10	* notice, this list of conditions and the following disclaimer.
11	* 2. Redistributions in binary form must reproduce the above copyright
12	* notice, this list of conditions and the following disclaimer in the
13	* documentation and/or other materials provided with the distribution.
14	*
15	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25	*/
26
27	#include "includes.h"
28	#ifndef AUDIT_EVENTS
29
30	#define DEBUG_AUDIT_HOOKS 1 /* XXX */
31
32	#include "audit.h"
33
34	#ifdef DEBUG_AUDIT_HOOKS
35	#include "log.h"
36	#include "auth.h"
37
38	extern Authctxt *the_authctxt;
39	#endif
40
41	/* Null implementations of audit functions */
42
43	void
44	audit_connection_from(const char *host, int port)
45	{
46	#ifdef DEBUG_AUDIT_HOOKS
47	debug("%s: connection from %s port %d", __func__, host, port);
48	#endif
49	}
50
51	void
52	audit_event(enum audit_event_type event)
53	{
54	#ifdef DEBUG_AUDIT_HOOKS
55	char *eventstr[] = {
56	"AUTH_FAILED",
57	"LOGIN_SUCCESS",
58	"LOGIN_EXCEED_MAXTRIES",
59	"LOGIN_FAIL_BADPW",
60	"LOGIN_FAIL_KBDINT",
61	"ILLEGAL_USER",
62	"ROOT_NOT_CONSOLE",
63	"NOLOGIN",
64	"LOGOUT"
65	};
66
67	debug("%s: event %d (%s) for user %s", __func__, event, eventstr[event],
68	the_authctxt->user);
69	#endif
70	}
71
72	void
73	audit_save_ttyn(const char *ttyn)
74	{
75	#ifdef DEBUG_AUDIT_HOOKS
76	debug("%s: user %s tty name %s", __func__, the_authctxt->user, ttyn);
77	#endif
78	}
79
80	void
81	audit_run_command(const char *command)
82	{
83	#ifdef DEBUG_AUDIT_HOOKS
84	debug("%s: user %s command '%s'", __func__, the_authctxt->user,
85	command);
86	#endif
87	}
88
89	void
90	record_failed_login(const char user, const char ttyname)
91	{
92	#ifdef DEBUG_AUDIT_HOOKS
93	debug("%s: (audit) user %s ttyname %s", __func__, user, ttyname);
94	#endif
95	}
96	#endif

Added Link Here

(-)audit.h (+50 lines)
1	/* $Id$ */
2
3	/*
4	* Copyright (c) 2004 Darren Tucker. All rights reserved.
5	*
6	* Redistribution and use in source and binary forms, with or without
7	* modification, are permitted provided that the following conditions
8	* are met:
9	* 1. Redistributions of source code must retain the above copyright
10	* notice, this list of conditions and the following disclaimer.
11	* 2. Redistributions in binary form must reproduce the above copyright
12	* notice, this list of conditions and the following disclaimer in the
13	* documentation and/or other materials provided with the distribution.
14	*
15	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25	*/
26
27	#include "auth.h"
28
29	#ifndef SSHAUDIT_H
30	# define SSHAUDIT_H
31	enum audit_event_type {
32	AUTH_FAILED, /* merge with LOGIN_FAIL_BADPW? */
33	LOGIN_SUCCESS,
34	LOGIN_EXCEED_MAXTRIES,
35	LOGIN_FAIL_BADPW,
36	LOGIN_FAIL_KBDINT,
37	ILLEGAL_USER,
38	ROOT_NOT_CONSOLE,
39	NOLOGIN,
40	LOGOUT
41	};
42
43	void audit_init(Authctxt *ctxt);
44	void audit_connection_from(const char *host, int port);
45	void audit_event(enum audit_event_type event);
46	void audit_save_ttyn(const char *ttyn);
47	void audit_run_command(const char *command);
48	void record_failed_login(const char , const char );
49
50	#endif /* SSHAUDIT_H */