Attachment 95 Details for Bug 2 – Solaris BSM audit patches against OpenSSH 3.1p1

[patch] Solaris BSM audit patches against OpenSSH 3.1p1

openssh-3.1p1-bsm.diff (text/plain), 18.22 KB, created by Darren J Moffat on 2002-05-10 09:11:18 AEST

(hide)

Description:

Filename:

MIME Type:

Creator: Darren J Moffat

Created: 2002-05-10 09:11:18 AEST

Size: 18.22 KB

patch

obsolete

>diff -Pru openssh-3.1p1/INSTALL openssh-3.1p1-bsm/INSTALL
>--- openssh-3.1p1/INSTALL	Thu Dec 27 14:57:34 2001
>+++ openssh-3.1p1-bsm/INSTALL	Thu May  9 15:51:51 2002
>@@ -95,6 +95,19 @@
> configuration will work with sshd (sshd will match the other service
> name).
> 
>+If you are using BSM auditing on Solaris you need update audit_event(4)
>+for praudit(1m) to give sensible output, the following line needs to be
>+added to /etc/security/audit_event, if the contrib/buildpkg.sh
>+script is used then the included postinstall script will do this:
>+
>+	32800:AUE_openssh:OpenSSH login:lo
>+
>+The BSM audit event range that is available for third party TCB
>+applications is 32768 - 65535.  Event number 32800 has been choosen for
>+AUE_openssh.  There is no official registry of 3rd party event numbers,
>+if this number is already in use on your system then change the value
>+of AUE_openssh in bsmaudit.h and rebuild.
>+
> There are a few other options to the configure script:
> 
> --with-rsh=PATH allows you to specify the path to your rsh program. 
>diff -Pru openssh-3.1p1/auth1.c openssh-3.1p1-bsm/auth1.c
>--- openssh-3.1p1/auth1.c	Thu Feb 14 01:39:50 2002
>+++ openssh-3.1p1-bsm/auth1.c	Thu May  9 15:00:06 2002
>@@ -102,6 +102,10 @@
> 
> 	client_user = NULL;
> 
>+#ifdef HAVE_BSM_AUDIT_H
>+	audit_sshd_save_pw(pw);
>+#endif /* HAVE_BSM_AUDIT_H */
>+
> 	for (;;) {
> 		/* default to fail */
> 		authenticated = 0;
>@@ -317,8 +321,12 @@
> #else
> 		/* Special handling for root */
> 		if (authenticated && authctxt->pw->pw_uid == 0 &&
>-		    !auth_root_allowed(get_authname(type)))
>+		    !auth_root_allowed(get_authname(type))) {
> 			authenticated = 0;
>+#ifdef HAVE_BSM_AUDIT_H
>+			audit_sshd_not_console();
>+#endif /* HAVE_BSM_AUDIT_H */
>+		}
> #endif
> #ifdef USE_PAM
> 		if (authenticated && !do_pam_account(pw->pw_name, client_user))
>@@ -342,8 +350,14 @@
> 			    get_canonical_hostname(options.verify_reverse_mapping),
> 			    "ssh");
> #endif /* WITH_AIXAUTHENTICATE */
>+#ifdef HAVE_BSM_AUDIT_H
>+			audit_sshd_maxtrys();
>+#endif /* HAVE_BSM_AUDIT_H */
> 			packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
> 		}
>+#ifdef HAVE_BSM_AUDIT_H
>+		audit_sshd_bad_pw();
>+#endif /* HAVE_BSM_AUDIT_H */
> 
> 		packet_start(SSH_SMSG_FAILURE);
> 		packet_send();
>diff -Pru openssh-3.1p1/auth2.c openssh-3.1p1-bsm/auth2.c
>--- openssh-3.1p1/auth2.c	Tue Feb 26 10:09:43 2002
>+++ openssh-3.1p1-bsm/auth2.c	Thu May  9 15:04:13 2002
>@@ -185,6 +185,9 @@
> 		/* setup auth context */
> 		struct passwd *pw = NULL;
> 		pw = getpwnam(user);
>+#ifdef HAVE_BSM_AUDIT_H
>+		audit_sshd_save_pw(pw);
>+#endif /* HAVE_BSM_AUDIT_H */
> 		if (pw && allowed_user(pw) && strcmp(service, "ssh-connection")==0) {
> 			authctxt->pw = pwcopy(pw);
> 			authctxt->valid = 1;
>@@ -197,6 +200,9 @@
> #ifdef USE_PAM
> 			start_pam("NOUSER");
> #endif
>+#ifdef HAVE_BSM_AUDIT_H
>+			audit_sshd_bad_pw();
>+#endif /* HAVE_BSM_AUDIT_H */
> 		}
> 		setproctitle("%s", pw ? user : "unknown");
> 		authctxt->user = xstrdup(user);
>@@ -236,8 +242,12 @@
> 
> 	/* Special handling for root */
> 	if (authenticated && authctxt->pw->pw_uid == 0 &&
>-	    !auth_root_allowed(method))
>+	    !auth_root_allowed(method)) {
> 		authenticated = 0;
>+#ifdef HAVE_BSM_AUDIT_H
>+		audit_sshd_not_console();
>+#endif /* HAVE_BSM_AUDIT_H */
>+	}
> 
> #ifdef USE_PAM
> 	if (authenticated && authctxt->user && !do_pam_account(authctxt->user,
>@@ -353,13 +363,17 @@
> 	    check_nt_auth(1, authctxt->pw) &&
> #endif
> #ifdef USE_PAM
>-	    auth_pam_password(authctxt->pw, password) == 1)
>+	    auth_pam_password(authctxt->pw, password) == 1) {
> #elif defined(HAVE_OSF_SIA)
>-	    auth_sia_password(authctxt->user, password) == 1)
>+	    auth_sia_password(authctxt->user, password) == 1) {
> #else /* !USE_PAM && !HAVE_OSF_SIA */
>-	    auth_password(authctxt, password) == 1)
>+	    auth_password(authctxt, password) == 1) {
> #endif /* USE_PAM */
> 		authenticated = 1;
>+#ifdef HAVE_BSM_AUDIT_H
>+		audit_sshd_bad_pw();
>+#endif /* HAVE_BSM_AUDIT_H */
>+	}
> 	memset(password, 0, len);
> 	xfree(password);
> 	return authenticated;
>@@ -390,6 +404,12 @@
> 	if (check_nt_auth(0, authctxt->pw) == 0)
> 		return(0);
> #endif
>+#ifdef HAVE_BSM_AUDIT_H
>+	if (!authenticated) {
>+		audit_sshd_bad_pw();
>+	}
>+#endif /* HAVE_BSM_AUDIT_H */
>+
> 	return authenticated;
> }
> 
>diff -Pru openssh-3.1p1/bsmaudit.c openssh-3.1p1-bsm/bsmaudit.c
>--- openssh-3.1p1/bsmaudit.c	Wed Dec 31 16:00:00 1969
>+++ openssh-3.1p1-bsm/bsmaudit.c	Thu May  9 15:09:44 2002
>@@ -0,0 +1,334 @@
>+/*
>+ * Copyright 1988-2002 Sun Microsystems, Inc.  All rights reserved.
>+ * Use is subject to license terms.
>+ *
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
>+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
>+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
>+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
>+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
>+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
>+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
>+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
>+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ *
>+ */
>+#pragma ident	"@(#)bsmaudit.c	1.1	01/09/17 SMI"
>+
>+#include <sys/systeminfo.h>
>+#include <sys/param.h>
>+#include <sys/types.h>
>+#include <sys/socket.h>
>+#include <sys/systeminfo.h>
>+#include <sys/stat.h>
>+#include <sys/wait.h>
>+#include <netinet/in.h>
>+#include <netdb.h>
>+#include <signal.h>
>+
>+#include <pwd.h>
>+#include <shadow.h>
>+#include <utmpx.h>
>+#include <unistd.h>
>+#include <string.h>
>+
>+#include <bsm/audit.h>
>+#include <bsm/libbsm.h>
>+#include <bsm/audit_uevents.h>
>+#include <bsm/audit_record.h>
>+#include "bsmaudit.h"
>+
>+#include <locale.h>
>+
>+#include "includes.h"
>+#include "ssh.h"
>+#include "log.h"
>+
>+static void audit_sshd_record(int typ, char *string, au_event_t event_no);
>+static void audit_sshd_session_setup(void);
>+static int selected(char *nam, uid_t uid, au_event_t event, int sf);
>+
>+static void get_terminal_id();
>+
>+extern int	cannot_audit(int);
>+extern void	aug_init(void);
>+extern dev_t	aug_get_port(void);
>+extern int 	aug_get_machine(char *, uint32_t *, uint32_t *);
>+extern void	aug_save_auid(au_id_t);
>+extern void	aug_save_uid(uid_t);
>+extern void	aug_save_euid(uid_t);
>+extern void	aug_save_gid(gid_t);
>+extern void	aug_save_egid(gid_t);
>+extern void	aug_save_pid(pid_t);
>+extern void	aug_save_asid(au_asid_t);
>+extern void	aug_save_tid(dev_t, unsigned int);
>+extern void	aug_save_tid_ex(dev_t, uint32_t *, uint32_t);
>+extern int	aug_save_me(void);
>+extern int	aug_save_namask(void);
>+extern void	aug_save_event(au_event_t);
>+extern void	aug_save_sorf(int);
>+extern void	aug_save_text(char *);
>+extern void	aug_save_text1(char *);
>+extern void	aug_save_text2(char *);
>+extern void	aug_save_na(int);
>+extern void	aug_save_user(char *);
>+extern void	aug_save_path(char *);
>+extern int	aug_save_policy(void);
>+extern void	aug_save_afunc(int (*)(int));
>+extern int	aug_audit(void);
>+extern int	aug_na_selected(void);
>+extern int	aug_selected(void);
>+extern int	aug_daemon_session(void);
>+
>+static char	sav_ttyn[512];
>+static char	sav_name[512];
>+static uid_t	sav_uid;
>+static gid_t	sav_gid;
>+static dev_t	sav_port;
>+static uint32_t	sav_machine[4];
>+static uint32_t	sav_iptype;
>+static char	sav_host[MAXHOSTNAMELEN];
>+static char	*sav_cmd;
>+
>+void
>+audit_sshd_save_port(int port)
>+{
>+	if (cannot_audit(0)) {
>+		return;
>+	}
>+	sav_port = port;
>+}
>+
>+void
>+audit_sshd_save_host(const char *host)
>+{
>+	if (cannot_audit(0)) {
>+		return;
>+	}
>+	(void) strlcpy(sav_host, host, sizeof (sav_host));
>+	(void) aug_get_machine(sav_host, &sav_machine[0], &sav_iptype);
>+}
>+
>+void
>+audit_sshd_save_command(const char *command)
>+{
>+	if (cannot_audit(0)) {
>+		return;
>+	}
>+	sav_cmd = strdup(command);
>+}
>+
>+void
>+audit_sshd_save_ttyn(const char *ttyn)
>+{
>+	if (cannot_audit(0)) {
>+		return;
>+	}
>+	(void) strlcpy(sav_ttyn, ttyn, sizeof (sav_ttyn));
>+}
>+
>+void
>+audit_sshd_save_pw(struct passwd *pwd)
>+{
>+	if (cannot_audit(0)) {
>+		return;
>+	}
>+	if (pwd == NULL) {
>+		sav_name[0] = '\0';
>+		sav_uid = -1;
>+		sav_gid = -1;
>+	} else {
>+		(void) strlcpy(sav_name, pwd->pw_name, sizeof (sav_name));
>+		sav_uid = pwd->pw_uid;
>+		sav_gid = pwd->pw_gid;
>+	}
>+}
>+
>+void
>+audit_sshd_nologin(void)
>+{
>+	if (cannot_audit(0)) {
>+		return;
>+	}
>+	audit_sshd_record(1, gettext("logins disabled by /etc/nologin"),
>+	    AUE_openssh);
>+}
>+
>+void
>+audit_sshd_maxtrys(void)
>+{
>+	if (cannot_audit(0)) {
>+		return;
>+	}
>+	audit_sshd_record(1, gettext("maxtrys"), AUE_openssh);
>+}
>+
>+void
>+audit_sshd_not_console(void)
>+{
>+	if (cannot_audit(0)) {
>+		return;
>+	}
>+	audit_sshd_record(2, gettext("not_console"), AUE_openssh);
>+}
>+
>+void
>+audit_sshd_bad_pw(void)
>+{
>+	if (cannot_audit(0)) {
>+		return;
>+	}
>+	if (sav_uid == -1) {
>+		audit_sshd_record(3, gettext("invalid user name"), AUE_openssh);
>+	} else {
>+		audit_sshd_record(4, gettext("invalid password or publickey"),
>+		    AUE_openssh);
>+	}
>+}
>+
>+void
>+audit_sshd_success(void)
>+{
>+	if (cannot_audit(0)) {
>+		return;
>+	}
>+
>+	audit_sshd_session_setup();
>+	audit_sshd_record(0, gettext("successful login"), AUE_openssh);
>+}
>+
>+static void
>+audit_sshd_record(int typ, char *string, au_event_t event_no)
>+{
>+	int		ad, rc;
>+	uid_t		uid;
>+	gid_t		gid;
>+	pid_t		pid;
>+	au_tid_addr_t	tid;
>+
>+	uid = sav_uid;
>+	gid = sav_gid;
>+	pid = getpid();
>+
>+	get_terminal_id(&tid);
>+
>+	if (typ == 0) {
>+		rc = 0;
>+	} else {
>+		rc = -1;
>+	}
>+
>+	if (!selected(sav_name, uid, event_no, rc))
>+		return;
>+
>+	debug3("BSM audit: sav_host=%s", sav_host);
>+	ad = au_open();
>+
>+	(void) au_write(ad, au_to_subject_ex(uid, uid, gid, uid, gid,
>+	    pid, pid, &tid));
>+	(void) au_write(ad, au_to_text(string));
>+	if (sav_cmd != NULL) {
>+		(void) au_write(ad, au_to_text(sav_cmd));
>+	}
>+	(void) au_write(ad, au_to_return32(typ, (int32_t)rc));
>+
>+	rc = au_close(ad, AU_TO_WRITE, event_no);
>+	if (rc < 0) {
>+		fatal("audit_sshd_record failed to write record: %s",
>+		    strerror(errno));
>+	}
>+}
>+
>+static void
>+audit_sshd_session_setup(void)
>+{
>+	int	rc;
>+	struct auditinfo_addr info;
>+	au_mask_t mask;
>+	struct auditinfo_addr now;
>+
>+	info.ai_auid = sav_uid;
>+	info.ai_asid = getpid();
>+	mask.am_success = 0;
>+	mask.am_failure = 0;
>+
>+	(void) au_user_mask(sav_name, &mask);
>+
>+	info.ai_mask.am_success  = mask.am_success;
>+	info.ai_mask.am_failure  = mask.am_failure;
>+
>+	/* see if terminal id already set */
>+	if (getaudit_addr(&now, sizeof (now)) < 0) {
>+		fatal("audit_sshd_session_setup: getaudit_addr failed: %s",
>+		    strerror(errno));
>+	}
>+
>+	debug("BSM audit_sshd_setup_session: calling get_terminal_id");
>+	get_terminal_id(&(info.ai_termid));
>+
>+	rc = setaudit_addr(&info, sizeof (info));
>+	if (rc < 0) {
>+		fatal("audit_sshd_session_setup: setaudit_addr failed: %s",
>+		    strerror(errno));
>+	}
>+}
>+
>+
>+static void
>+get_terminal_id(au_tid_addr_t *tid)
>+{
>+	tid->at_port = sav_port;
>+	tid->at_type = sav_iptype;
>+	tid->at_addr[0] = sav_machine[0];
>+	tid->at_addr[1] = sav_machine[1];
>+	tid->at_addr[2] = sav_machine[2];
>+	tid->at_addr[3] = sav_machine[3];
>+}
>+
>+void
>+audit_sshd_logout(void)
>+{
>+	char    textbuf[BSM_TEXTBUFSZ];
>+
>+	(void) snprintf(textbuf, sizeof (textbuf),
>+		gettext("sshd logout %s"), sav_name);
>+
>+	audit_sshd_record(0, textbuf, AUE_logout);
>+}
>+
>+static int
>+selected(char *nam, uid_t uid, au_event_t event, int sf)
>+{
>+	int	rc, sorf;
>+	char	naflags[512];
>+	struct au_mask mask;
>+
>+	mask.am_success = mask.am_failure = 0;
>+	if (uid < 0) {
>+		rc = getacna(naflags, 256); /* get non-attrib flags */
>+		if (rc == 0)
>+			(void) getauditflagsbin(naflags, &mask);
>+	} else {
>+		rc = au_user_mask(nam, &mask);
>+	}
>+
>+	if (sf == 0) {
>+		sorf = AU_PRS_SUCCESS;
>+	} else {
>+		sorf = AU_PRS_FAILURE;
>+	}
>+	rc = au_preselect(event, &mask, sorf, AU_PRS_REREAD);
>+
>+	return (rc);
>+}
>diff -Pru openssh-3.1p1/bsmaudit.h openssh-3.1p1-bsm/bsmaudit.h
>--- openssh-3.1p1/bsmaudit.h	Wed Dec 31 16:00:00 1969
>+++ openssh-3.1p1-bsm/bsmaudit.h	Thu May  9 15:10:17 2002
>@@ -0,0 +1,55 @@
>+/*
>+ * Copyright 1993-2002 Sun Microsystems, Inc.  All rights reserved.
>+ * Use is subject to license terms.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
>+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
>+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
>+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
>+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
>+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
>+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
>+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
>+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ *
>+ */
>+
>+#ifndef	_BSMAUDIT_H
>+#define	_BSMAUDIT_H
>+
>+#pragma ident	"@(#)bsmaudit.h	1.1	01/09/17 SMI"
>+
>+#ifdef	__cplusplus
>+extern "C" {
>+#endif
>+
>+#include <bsm/audit.h>
>+#define	AUE_openssh	32800
>+
>+void audit_sshd_maxtrys(void);
>+void audit_sshd_nologin(void);
>+void audit_sshd_save_pw(struct passwd *pwd);
>+void audit_sshd_not_console(void);
>+void audit_sshd_bad_pw(void);
>+void audit_sshd_save_host(const char *host);
>+void audit_sshd_save_ttyn(const char *ttyn);
>+void audit_sshd_save_port(int port);
>+void audit_sshd_save_command(const char *command);
>+void audit_sshd_success(void);
>+void audit_sshd_logout(void);
>+
>+#ifdef	__cplusplus
>+}
>+#endif
>+
>+#endif	/* _BSMAUDIT_H */
>diff -Pru openssh-3.1p1/contrib/solaris/buildpkg.sh openssh-3.1p1-bsm/contrib/solaris/buildpkg.sh
>--- openssh-3.1p1/contrib/solaris/buildpkg.sh	Fri Oct 19 13:36:24 2001
>+++ openssh-3.1p1-bsm/contrib/solaris/buildpkg.sh	Thu May  9 15:32:58 2002
>@@ -10,7 +10,7 @@
> PKGNAME=OpenSSH
> 
> ## Extract common info requires for the 'info' part of the package.
>-VERSION=`tail -1 ../../version.h | sed -e 's/.*_$[0-9]$/\1/g' | sed 's/\"$//'`
>+VERSION=`grep SSH_VERSION ../../version.h | sed -e 's/.*_$[0-9]$/\1/g' | sed 's/\"$//'`
> ARCH=`uname -p`
> 
> ## Start by faking root install 
>@@ -75,6 +75,8 @@
>             BEGIN { print "i pkginfo" }	
> 	    { $5="root"; $6="sys"; }
> 	    { print; }' > prototype
>+echo "i postinstall" >> prototype
>+cp $START/postinstall $FAKE_ROOT
> 
> ## Step back a directory and now build the package.
> echo "Building package.."
>diff -Pru openssh-3.1p1/contrib/solaris/postinstall openssh-3.1p1-bsm/contrib/solaris/postinstall
>--- openssh-3.1p1/contrib/solaris/postinstall	Wed Dec 31 16:00:00 1969
>+++ openssh-3.1p1-bsm/contrib/solaris/postinstall	Thu May  9 15:25:04 2002
>@@ -0,0 +1,7 @@
>+#!/bin/sh
>+
>+audit_event=/etc/security/audit_event
>+
>+if [ -z "`grep AUE_openssh $audit_event`" ] ; then
>+	echo "32800:AUE_openssh:OpenSSH login:lo" >> $audit_event
>+fi
>diff -Pru openssh-3.1p1/includes.h openssh-3.1p1-bsm/includes.h
>--- openssh-3.1p1/includes.h	Mon Feb  4 17:11:03 2002
>+++ openssh-3.1p1-bsm/includes.h	Thu May  9 15:04:51 2002
>@@ -98,6 +98,9 @@
> #ifdef HAVE_UTIME_H
> # include <utime.h>
> #endif
>+#ifdef HAVE_BSM_AUDIT_H
>+# include "bsmaudit.h"
>+#endif
> #include "version.h"
> #include "openbsd-compat/openbsd-compat.h"
> #include "openbsd-compat/bsd-cygwin_util.h"
>diff -Pru openssh-3.1p1/session.c openssh-3.1p1-bsm/session.c
>--- openssh-3.1p1/session.c	Mon Feb 25 07:48:03 2002
>+++ openssh-3.1p1-bsm/session.c	Thu May  9 15:00:06 2002
>@@ -556,10 +556,14 @@
> 
> 		/* record login, etc. similar to login(1) */
> #ifndef HAVE_OSF_SIA
>-		if (!(options.use_login && command == NULL))
>+		if (!(options.use_login && command == NULL)) {
> 			do_login(s, command);
>+#ifdef HAVE_BSM_AUDIT_H
>+			if (s->tty != NULL)
>+				audit_sshd_save_ttyn(s->tty);
>+#endif /* HAVE_BSM_AUDIT_H */
> # ifdef LOGIN_NEEDS_UTMPX
>-		else
>+		} else
> 			do_pre_login(s);
> # endif
> #endif
>@@ -1094,6 +1098,9 @@
> 		while (fgets(buf, sizeof(buf), f))
> 			fputs(buf, stderr);
> 		fclose(f);
>+#ifdef HAVE_BSM_AUDIT_H
>+		audit_sshd_nologin();
>+#endif /* HAVE_BSM_AUDIT_H */
> 		exit(254);
> 	}
> }
>@@ -1146,6 +1153,9 @@
> # if defined(WITH_IRIX_PROJECT) || defined(WITH_IRIX_JOBS) || defined(WITH_IRIX_ARRAY)
> 		irix_setusercontext(pw);
> #  endif /* defined(WITH_IRIX_PROJECT) || defined(WITH_IRIX_JOBS) || defined(WITH_IRIX_ARRAY) */
>+#ifdef HAVE_BSM_AUDIT_H
>+		audit_sshd_success();
>+#endif /* HAVE_BSM_AUDIT_H */
> 		/* Permanently switch to the desired uid. */
> 		permanently_set_uid(pw);
> #endif
>@@ -1190,6 +1200,10 @@
> # ifdef _AIX
> 		aix_usrinfo(pw, s->tty, s->ttyfd);
> # endif /* _AIX */
>+#ifdef HAVE_BSM_AUDIT_H
>+		if (command != NULL)
>+			audit_sshd_save_command(command);
>+#endif /* HAVE_BSM_AUDIT_H */
> 		do_setusercontext(pw);
> #endif /* HAVE_OSF_SIA */
> 	}
>diff -Pru openssh-3.1p1/sshd.c openssh-3.1p1-bsm/sshd.c
>--- openssh-3.1p1/sshd.c	Mon Mar  4 17:31:30 2002
>+++ openssh-3.1p1-bsm/sshd.c	Thu May  9 15:00:06 2002
>@@ -1166,7 +1166,10 @@
> 
> 	remote_port = get_remote_port();
> 	remote_ip = get_remote_ipaddr();
>-
>+#ifdef HAVE_BSM_AUDIT_H
>+	audit_sshd_save_host(remote_ip);
>+	audit_sshd_save_port(remote_port);
>+#endif /* HAVE_BSM_AUDIT_H */
> #ifdef LIBWRAP
> 	/* Check whether logins are denied from this host. */
> 	{
>diff -Pru openssh-3.1p1/sshlogin.c openssh-3.1p1-bsm/sshlogin.c
>--- openssh-3.1p1/sshlogin.c	Sun Feb 24 17:56:47 2002
>+++ openssh-3.1p1-bsm/sshlogin.c	Thu May  9 15:00:06 2002
>@@ -101,4 +101,7 @@
>   li = login_alloc_entry(pid, user, NULL, ttyname);
>   login_logout(li);
>   login_free_entry(li);
>+#ifdef HAVE_BSM_AUDIT_H
>+  audit_sshd_logout();
>+#endif /* HAVE_BSM_AUDIT_H */
> }

Actions: View | Diff

Attachments on bug 2: 94 | 95