Bugzilla – Attachment 619 Details for
Bug 125
add BSM audit support
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
(DO NOT USE) Work-in-progress BSM patch for comment.
openssh-bsm2.patch (text/plain), 29.14 KB, created by
Darren Tucker
on 2004-04-26 11:48:04 AEST
(
hide
)
Description:
(DO NOT USE) Work-in-progress BSM patch for comment.
Filename:
MIME Type:
Creator:
Darren Tucker
Created:
2004-04-26 11:48:04 AEST
Size:
29.14 KB
patch
obsolete
>Index: INSTALL >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/INSTALL,v >retrieving revision 1.63 >diff -u -r1.63 INSTALL >--- INSTALL 21 Nov 2003 12:48:55 -0000 1.63 >+++ INSTALL 26 Apr 2004 00:54:29 -0000 >@@ -99,6 +99,21 @@ > configuration will work with sshd (sshd will match the other service > name). > >+If you enable BSM auditing on Solaris, you need to update audit_event(4) >+for praudit(1m) to give sensible output. The following line needs to be >+added to /etc/security/audit_event: >+ >+ 32800:AUE_openssh:OpenSSH login:lo >+ >+If the contrib/buildpkg.sh script is used, the included postinstall >+script will add the line for you. >+ >+The BSM audit event range available for third party TCB applications is >+32768 - 65535. Event number 32800 has been choosen for AUE_openssh. >+There is no official registry of 3rd party event numbers, so if this >+number is already in use on your system, change the value of >+AUE_openssh in openbsd-compat/bsd-solaris.h and rebuild. >+ > There are a few other options to the configure script: > > --with-pam enables PAM support. If PAM support is compiled in, it must >Index: LICENCE >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/LICENCE,v >retrieving revision 1.16 >diff -u -r1.16 LICENCE >--- LICENCE 10 Feb 2004 02:01:14 -0000 1.16 >+++ LICENCE 26 Apr 2004 00:55:51 -0000 >@@ -203,6 +203,7 @@ > Wayne Schroeder > William Jones > Darren Tucker >+ Sun Microsystems > > * Redistribution and use in source and binary forms, with or without > * modification, are permitted provided that the following conditions >Index: auth.c >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/auth.c,v >retrieving revision 1.83 >diff -u -r1.83 auth.c >--- auth.c 21 Feb 2004 22:43:15 -0000 1.83 >+++ auth.c 26 Apr 2004 00:54:30 -0000 >@@ -482,6 +482,9 @@ > #endif > struct passwd *pw; > >+#ifdef USE_BSM_AUDIT >+ solaris_audit_save_name(user); >+#endif > pw = getpwnam(user); > if (pw == NULL) { > logit("Illegal user %.100s from %.100s", >@@ -508,8 +511,12 @@ > auth_close(as); > #endif > #endif >- if (pw != NULL) >- return (pwcopy(pw)); >+ if (pw != NULL) { >+#ifdef USE_BSM_AUDIT >+ solaris_audit_save_pw(pw); >+#endif /* BSM */ >+ return(pwcopy(pw)); >+ } > return (NULL); > } > >Index: auth1.c >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/auth1.c,v >retrieving revision 1.97 >diff -u -r1.97 auth1.c >--- auth1.c 8 Mar 2004 12:04:07 -0000 1.97 >+++ auth1.c 26 Apr 2004 00:54:30 -0000 >@@ -241,8 +241,12 @@ > #else > /* Special handling for root */ > if (authenticated && authctxt->pw->pw_uid == 0 && >- !auth_root_allowed(get_authname(type))) >+ !auth_root_allowed(get_authname(type))) { > authenticated = 0; >+#ifdef USE_BSM_AUDIT >+ PRIVSEP(solaris_audit_event(NOT_CONSOLE)); >+#endif /* BSM */ >+ } > #endif > > #ifdef USE_PAM >@@ -262,9 +266,16 @@ > if (authenticated) > return; > >- if (authctxt->failures++ > AUTH_FAIL_MAX) >+ if (authctxt->failures++ > AUTH_FAIL_MAX) { >+#ifdef USE_BSM_AUDIT >+ PRIVSEP(solaris_audit_event(MAXTRIES)); >+#endif > packet_disconnect(AUTH_FAIL_MSG, authctxt->user); >+ } > >+#ifdef USE_BSM_AUDIT >+ PRIVSEP(solaris_audit_bad_pw("authorization")); >+#endif > packet_start(SSH_SMSG_FAILURE); > packet_send(); > packet_write_wait(); >Index: auth2-kbdint.c >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/auth2-kbdint.c,v >retrieving revision 1.2 >diff -u -r1.2 auth2-kbdint.c >--- auth2-kbdint.c 10 May 2003 09:28:02 -0000 1.2 >+++ auth2-kbdint.c 27 Aug 2003 15:49:56 -0000 >@@ -30,6 +30,7 @@ > #include "log.h" > #include "servconf.h" > #include "xmalloc.h" >+#include "monitor_wrap.h" > > /* import */ > extern ServerOptions options; >@@ -55,6 +56,11 @@ > if (check_nt_auth(0, authctxt->pw) == 0) > return(0); > #endif >+#ifdef USE_BSM_AUDIT >+ if (!authenticated) { >+ PRIVSEP(solaris_audit_bad_pw("interactive password entry")); >+ } >+#endif > return authenticated; > } > >Index: auth2-passwd.c >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/auth2-passwd.c,v >retrieving revision 1.6 >diff -u -r1.6 auth2-passwd.c >--- auth2-passwd.c 31 Dec 2003 00:43:24 -0000 1.6 >+++ auth2-passwd.c 26 Apr 2004 00:54:30 -0000 >@@ -63,6 +63,10 @@ > authenticated = 1; > memset(password, 0, len); > xfree(password); >+#ifdef USE_BSM_AUDIT >+ if (!authenticated) >+ PRIVSEP(solaris_audit_bad_pw("password")); >+#endif /* BSM */ > return authenticated; > } > >Index: auth2-pubkey.c >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/auth2-pubkey.c,v >retrieving revision 1.6 >diff -u -r1.6 auth2-pubkey.c >--- auth2-pubkey.c 21 Jan 2004 00:02:50 -0000 1.6 >+++ auth2-pubkey.c 26 Apr 2004 00:54:31 -0000 >@@ -160,6 +160,10 @@ > if (check_nt_auth(0, authctxt->pw) == 0) > return(0); > #endif >+#ifdef USE_BSMAUDIT >+ if (!authenticated) >+ PRIVSEP(solaris_audit_bad_pw("public key")); >+#endif /* BSM */ > return authenticated; > } > >Index: auth2.c >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/auth2.c,v >retrieving revision 1.127 >diff -u -r1.127 auth2.c >--- auth2.c 8 Mar 2004 12:04:07 -0000 1.127 >+++ auth2.c 26 Apr 2004 00:54:31 -0000 >@@ -165,6 +165,9 @@ > if (options.use_pam) > PRIVSEP(start_pam(authctxt)); > #endif >+#ifdef USE_BSM_AUDIT >+ PRIVSEP(solaris_audit_bad_pw("name")); >+#endif > } > setproctitle("%s%s", authctxt->pw ? user : "unknown", > use_privsep ? " [net]" : ""); >@@ -212,8 +215,12 @@ > > /* Special handling for root */ > if (authenticated && authctxt->pw->pw_uid == 0 && >- !auth_root_allowed(method)) >+ !auth_root_allowed(method)) { > authenticated = 0; >+#ifdef USE_BSM_AUDIT >+ PRIVSEP(solaris_audit_event(NOT_CONSOLE)); >+#endif >+ } > > #ifdef USE_PAM > if (options.use_pam && authenticated && !PRIVSEP(do_pam_account())) >@@ -243,8 +250,15 @@ > /* now we can break out */ > authctxt->success = 1; > } else { >- if (authctxt->failures++ > AUTH_FAIL_MAX) >+ if (authctxt->failures++ > AUTH_FAIL_MAX) { >+#ifdef USE_BSM_AUDIT >+ PRIVSEP(solaris_audit_event(MAXTRIES)); >+#endif > packet_disconnect(AUTH_FAIL_MSG, authctxt->user); >+ } >+#ifdef USE_BSM_AUDIT >+ PRIVSEP(solaris_audit_bad_pw("authorization")); >+#endif > methods = authmethods_get(); > packet_start(SSH2_MSG_USERAUTH_FAILURE); > packet_put_cstring(methods); >Index: configure.ac >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/configure.ac,v >retrieving revision 1.216 >diff -u -r1.216 configure.ac >--- configure.ac 23 Apr 2004 08:53:10 -0000 1.216 >+++ configure.ac 26 Apr 2004 00:54:32 -0000 >@@ -667,6 +667,20 @@ > AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN)]) > AC_CHECK_FUNCS(logout updwtmp logwtmp) > >+dnl Checks for libbsm functions >+AC_CHECK_HEADERS(bsm/audit.h) >+AC_CHECK_LIB(bsm, getaudit) >+AC_CHECK_FUNC(getaudit, AC_DEFINE(HAVE_GETAUDIT, >+ 1, >+ [Define if libbsm has `getaudit'.] >+ ) >+ ) >+AC_CHECK_FUNC(getaudit_addr, AC_DEFINE(HAVE_GETAUDIT_ADDR, >+ 1, >+ [Define if libbsm has `getaudit_addr'.] >+ ) >+ ) >+ > AC_FUNC_STRFTIME > > # Check for ALTDIRFUNC glob() extension >Index: defines.h >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/defines.h,v >retrieving revision 1.115 >diff -u -r1.115 defines.h >--- defines.h 14 Apr 2004 07:24:30 -0000 1.115 >+++ defines.h 26 Apr 2004 00:54:32 -0000 >@@ -523,6 +523,11 @@ > # define getpgrp() getpgrp(0) > #endif > >+#if defined(HAVE_BSM_AUDIT_H) && defined(HAVE_LIBBSM) >+# define USE_BSM_AUDIT >+# define CUSTOM_FAILED_LOGIN >+#endif >+ > /* OPENSSL_free() is Free() in versions before OpenSSL 0.9.6 */ > #if !defined(OPENSSL_VERSION_NUMBER) || (OPENSSL_VERSION_NUMBER < 0x0090600f) > # define OPENSSL_free(x) Free(x) >Index: loginrec.c >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/loginrec.c,v >retrieving revision 1.56 >diff -u -r1.56 loginrec.c >--- loginrec.c 8 Apr 2004 06:16:06 -0000 1.56 >+++ loginrec.c 26 Apr 2004 00:54:33 -0000 >@@ -412,6 +412,9 @@ > return 1; > } > #endif >+#ifdef USE_BSM_AUDIT >+ solaris_audit_event(LOGOUT); >+#endif /* BSM */ > > /* set the timestamp */ > login_set_current_time(li); >Index: monitor.c >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/monitor.c,v >retrieving revision 1.69 >diff -u -r1.69 monitor.c >--- monitor.c 14 Apr 2004 07:24:30 -0000 1.69 >+++ monitor.c 26 Apr 2004 00:57:06 -0000 >@@ -143,6 +143,11 @@ > int mm_answer_gss_checkmic(int, Buffer *); > #endif > >+#ifdef USE_BSM_AUDIT >+int mm_answer_bad_pw(int, Buffer *); >+int mm_answer_audit_event(int, Buffer *); >+#endif >+ > static Authctxt *authctxt; > static BIGNUM *ssh1_challenge = NULL; /* used for ssh1 rsa auth */ > >@@ -196,6 +201,10 @@ > #endif > {MONITOR_REQ_KEYALLOWED, MON_ISAUTH, mm_answer_keyallowed}, > {MONITOR_REQ_KEYVERIFY, MON_AUTH, mm_answer_keyverify}, >+#ifdef USE_BSM_AUDIT >+ {MONITOR_REQ_AUDIT_BAD_PW, MON_PERMIT, mm_answer_bad_pw}, >+ {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, >+#endif > #ifdef GSSAPI > {MONITOR_REQ_GSSSETUP, MON_ISAUTH, mm_answer_gss_setup_ctx}, > {MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx}, >@@ -239,6 +248,10 @@ > {MONITOR_REQ_PAM_RESPOND, MON_ISAUTH, mm_answer_pam_respond}, > {MONITOR_REQ_PAM_FREE_CTX, MON_ONCE|MON_AUTHDECIDE, mm_answer_pam_free_ctx}, > #endif >+#ifdef USE_BSM_AUDIT >+ {MONITOR_REQ_AUDIT_BAD_PW, MON_PERMIT, mm_answer_bad_pw}, >+ {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, >+#endif > {0, 0, NULL} > }; > >@@ -1483,6 +1496,42 @@ > exit (res); > } > >+#ifdef USE_BSM_AUDIT >+ >+/* Report that the user or password is invalid */ >+ >+int >+mm_answer_bad_pw(int socket, Buffer *m) >+{ >+ char *what; >+ >+ debug3("%s", __func__); >+ >+ what = buffer_get_string(m, NULL); >+ solaris_audit_bad_pw(what); >+ xfree(what); >+ >+ return (0); >+} >+ >+/* Report that an audit event occurred */ >+ >+int >+mm_answer_audit_event(int socket, Buffer *m) >+{ >+ enum audit_event_type event; >+ >+ debug3("%s", __func__); >+ >+ event = buffer_get_int(m); >+ if (event == MAXTRIES || event == NOT_CONSOLE) >+ solaris_audit_event(event); >+ >+ return (0); >+} >+ >+#endif >+ > void > monitor_apply_keystate(struct monitor *pmonitor) > { >Index: monitor.h >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/monitor.h,v >retrieving revision 1.19 >diff -u -r1.19 monitor.h >--- monitor.h 17 Nov 2003 11:18:22 -0000 1.19 >+++ monitor.h 26 Apr 2004 00:54:34 -0000 >@@ -46,6 +46,8 @@ > MONITOR_REQ_PTYCLEANUP, > MONITOR_REQ_SESSKEY, MONITOR_ANS_SESSKEY, > MONITOR_REQ_SESSID, >+ MONITOR_REQ_AUDIT_BAD_PW, >+ MONITOR_REQ_AUDIT_EVENT, > MONITOR_REQ_RSAKEYALLOWED, MONITOR_ANS_RSAKEYALLOWED, > MONITOR_REQ_RSACHALLENGE, MONITOR_ANS_RSACHALLENGE, > MONITOR_REQ_RSARESPONSE, MONITOR_ANS_RSARESPONSE, >Index: monitor_wrap.c >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/monitor_wrap.c,v >retrieving revision 1.44 >diff -u -r1.44 monitor_wrap.c >--- monitor_wrap.c 8 Apr 2004 16:12:30 -0000 1.44 >+++ monitor_wrap.c 26 Apr 2004 00:57:42 -0000 >@@ -1091,6 +1091,37 @@ > return (success); > } > >+#ifdef USE_BSM_AUDIT >+void >+mm_solaris_audit_bad_pw(const char *what) >+{ >+ Buffer m; >+ >+ debug3("%s entering", __func__); >+ >+ buffer_init(&m); >+ buffer_put_string(&m, what, strlen(what) + 1); >+ >+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_BAD_PW, &m); >+ buffer_free(&m); >+} >+ >+void >+mm_solaris_audit_event(enum audit_event_type event) >+{ >+ Buffer m; >+ >+ debug3("%s entering", __func__); >+ >+ buffer_init(&m); >+ buffer_put_int(&m, event); >+ >+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_EVENT, &m); >+ buffer_free(&m); >+} >+ >+#endif /* BSM */ >+ > #ifdef GSSAPI > OM_uint32 > mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid) >Index: monitor_wrap.h >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/monitor_wrap.h,v >retrieving revision 1.18 >diff -u -r1.18 monitor_wrap.h >--- monitor_wrap.h 8 Mar 2004 12:04:07 -0000 1.18 >+++ monitor_wrap.h 26 Apr 2004 00:58:01 -0000 >@@ -99,6 +99,11 @@ > int mm_skey_query(void *, char **, char **, u_int *, char ***, u_int **); > int mm_skey_respond(void *, u_int, char **); > >+#ifdef USE_BSM_AUDIT >+void mm_solaris_audit_bad_pw(const char *); >+void mm_solaris_audit_audit_event(enum audit_event_type); >+#endif /* BSM */ >+ > /* zlib allocation hooks */ > > void *mm_zalloc(struct mm_master *, u_int, u_int); >Index: session.c >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/session.c,v >retrieving revision 1.278 >diff -u -r1.278 session.c >--- session.c 16 Apr 2004 12:47:55 -0000 1.278 >+++ session.c 26 Apr 2004 00:54:36 -0000 >@@ -567,6 +567,10 @@ > cray_init_job(s->pw); /* set up cray jid and tmpdir */ > #endif /* _UNICOS */ > do_login(s, command); >+#ifdef USE_BSM_AUDIT >+ if (s->tty != NULL) >+ solaris_audit_save_ttyn(s->tty); >+#endif /* BSM */ > } > # ifdef LOGIN_NEEDS_UTMPX > else >@@ -1226,6 +1230,9 @@ > while (fgets(buf, sizeof(buf), f)) > fputs(buf, stderr); > fclose(f); >+#ifdef USE_BSM_AUDIT >+ solaris_audit_event(NOLOGIN); >+#endif > fflush(NULL); > exit(254); > } >@@ -1422,6 +1429,10 @@ > do_motd(); > #else /* HAVE_OSF_SIA */ > do_nologin(pw); >+# ifdef USE_BSM_AUDIT >+ if (command != NULL) >+ solaris_audit_save_command(command); >+# endif /* BSM */ > do_setusercontext(pw); > #endif /* HAVE_OSF_SIA */ > } >Index: sshd.c >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/sshd.c,v >retrieving revision 1.279 >diff -u -r1.279 sshd.c >--- sshd.c 21 Mar 2004 22:36:01 -0000 1.279 >+++ sshd.c 26 Apr 2004 00:54:38 -0000 >@@ -1423,7 +1423,10 @@ > > remote_port = get_remote_port(); > remote_ip = get_remote_ipaddr(); >- >+#ifdef USE_BSM_AUDIT >+ solaris_audit_save_host(remote_ip); >+ solaris_audit_save_port(remote_port); >+#endif > #ifdef LIBWRAP > /* Check whether logins are denied from this host. */ > { >@@ -1493,6 +1496,11 @@ > } > > authenticated: >+ >+#ifdef USE_BSM_AUDIT >+ solaris_audit_event(SUCCESS); >+#endif >+ > /* > * In privilege separation, we fork another child and prepare > * file descriptor passing. >Index: contrib/solaris/buildpkg.sh >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/contrib/solaris/buildpkg.sh,v >retrieving revision 1.9 >diff -u -r1.9 buildpkg.sh >--- contrib/solaris/buildpkg.sh 23 Jan 2004 00:10:03 -0000 1.9 >+++ contrib/solaris/buildpkg.sh 26 Apr 2004 00:54:40 -0000 >@@ -191,6 +191,12 @@ > cat > postinstall << _EOF > #! /sbin/sh > # >+audit_event=/etc/security/audit_event >+ >+if [ -z "\`grep AUE_openssh \$audit_event\`" ] ; then >+ echo "32800:AUE_openssh:OpenSSH login:lo" >> \$audit_event >+fi >+# > [ -f \${PKG_INSTALL_ROOT}${sysconfdir}/ssh_config ] || \\ > cp -p \${PKG_INSTALL_ROOT}${sysconfdir}/ssh_config.default \\ > \${PKG_INSTALL_ROOT}${sysconfdir}/ssh_config >Index: openbsd-compat/Makefile.in >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/openbsd-compat/Makefile.in,v >retrieving revision 1.30 >diff -u -r1.30 Makefile.in >--- openbsd-compat/Makefile.in 21 Jan 2004 06:07:23 -0000 1.30 >+++ openbsd-compat/Makefile.in 26 Apr 2004 00:54:40 -0000 >@@ -20,7 +20,7 @@ > > COMPAT=bsd-arc4random.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-snprintf.o bsd-waitpid.o fake-rfc2553.o xmmap.o xcrypt.o > >-PORTS=port-irix.o port-aix.o >+PORTS=port-irix.o port-aix.o port-solaris.o > > .c.o: > $(CC) $(CFLAGS) $(CPPFLAGS) -c $< >Index: openbsd-compat/openbsd-compat.h >=================================================================== >RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/openbsd-compat/openbsd-compat.h,v >retrieving revision 1.25 >diff -u -r1.25 openbsd-compat.h >--- openbsd-compat/openbsd-compat.h 21 Jan 2004 06:07:23 -0000 1.25 >+++ openbsd-compat/openbsd-compat.h 26 Apr 2004 00:54:41 -0000 >@@ -163,7 +163,8 @@ > /* Routines for a single OS platform */ > #include "bsd-cray.h" > #include "bsd-cygwin_util.h" >-#include "port-irix.h" > #include "port-aix.h" >+#include "port-irix.h" >+#include "port-solaris.h" > > #endif /* _OPENBSD_COMPAT_H */ >Index: openbsd-compat/port-solaris.c >=================================================================== >RCS file: openbsd-compat/port-solaris.c >diff -N openbsd-compat/port-solaris.c >--- /dev/null 1 Jan 1970 00:00:00 -0000 >+++ openbsd-compat/port-solaris.c 27 Aug 2003 15:37:25 -0000 >@@ -0,0 +1,385 @@ >+/* >+ * Copyright 1988-2002 Sun Microsystems, Inc. All rights reserved. >+ * Use is subject to license terms. >+ * >+ * >+ * Redistribution and use in source and binary forms, with or without >+ * modification, are permitted provided that the following conditions >+ * are met: >+ * 1. Redistributions of source code must retain the above copyright >+ * notice, this list of conditions and the following disclaimer. >+ * 2. Redistributions in binary form must reproduce the above copyright >+ * notice, this list of conditions and the following disclaimer in the >+ * documentation and/or other materials provided with the distribution. >+ * >+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR >+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES >+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. >+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, >+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT >+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, >+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY >+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT >+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF >+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. >+ * >+ */ >+/* #pragma ident "@(#)bsmaudit.c 1.1 01/09/17 SMI" */ >+ >+#include "includes.h" >+#if defined(HAVE_BSM_AUDIT_H) && defined(HAVE_LIBBSM) >+ >+#include <bsm/audit.h> >+#include <bsm/libbsm.h> >+#include <bsm/audit_uevents.h> >+#include <bsm/audit_record.h> >+#include "port-solaris.h" >+ >+#include <locale.h> >+ >+#include "ssh.h" >+#include "log.h" >+ >+#if defined(HAVE_GETAUDIT_ADDR) >+#define AuditInfoStruct auditinfo_addr >+#define AuditInfoTermID au_tid_addr_t >+#define GetAuditFunc(a,b) getaudit_addr((a),(b)) >+#define GetAuditFuncText "getaudit_addr" >+#define SetAuditFunc(a,b) setaudit_addr((a),(b)) >+#define SetAuditFuncText "setaudit_addr" >+#define AUToSubjectFunc au_to_subject_ex >+#define AUToReturnFunc(a,b) au_to_return32((a), (int32_t)(b)) >+#else >+#define AuditInfoStruct auditinfo >+#define AuditInfoTermID au_tid_t >+#define GetAuditFunc(a,b) getaudit(a) >+#define GetAuditFuncText "getaudit" >+#define SetAuditFunc(a,b) setaudit(a) >+#define SetAuditFuncText "setaudit" >+#define AUToSubjectFunc au_to_subject >+#define AUToReturnFunc(a,b) au_to_return((a), (u_int)(b)) >+#endif >+ >+static void solaris_audit_record(int typ, char *string, au_event_t event_no); >+static void solaris_audit_session_setup(void); >+static int selected(char *nam, uid_t uid, au_event_t event, int sf); >+ >+static void get_terminal_id(AuditInfoTermID *tid); >+ >+extern int cannot_audit(int); >+extern void aug_init(void); >+extern dev_t aug_get_port(void); >+extern int aug_get_machine(char *, uint32_t *, uint32_t *); >+extern void aug_save_auid(au_id_t); >+extern void aug_save_uid(uid_t); >+extern void aug_save_euid(uid_t); >+extern void aug_save_gid(gid_t); >+extern void aug_save_egid(gid_t); >+extern void aug_save_pid(pid_t); >+extern void aug_save_asid(au_asid_t); >+extern void aug_save_tid(dev_t, unsigned int); >+extern void aug_save_tid_ex(dev_t, uint32_t *, uint32_t); >+extern int aug_save_me(void); >+extern int aug_save_namask(void); >+extern void aug_save_event(au_event_t); >+extern void aug_save_sorf(int); >+extern void aug_save_text(char *); >+extern void aug_save_text1(char *); >+extern void aug_save_text2(char *); >+extern void aug_save_na(int); >+extern void aug_save_user(char *); >+extern void aug_save_path(char *); >+extern int aug_save_policy(void); >+extern void aug_save_afunc(int (*)(int)); >+extern int aug_audit(void); >+extern int aug_na_selected(void); >+extern int aug_selected(void); >+extern int aug_daemon_session(void); >+ >+static char sav_ttyn[512]; >+static char sav_name[512]; >+static uid_t sav_uid; >+static gid_t sav_gid; >+static dev_t sav_port; >+static uint32_t sav_machine[4]; >+static uint32_t sav_iptype; >+static char sav_host[MAXHOSTNAMELEN]; >+static char *sav_cmd = NULL; >+ >+void >+solaris_audit_save_port(int port) >+{ >+ if (cannot_audit(0)) >+ return; >+ >+ sav_port = port; >+ debug3("BSM audit: sav_port=%ld", (long)sav_port); >+} >+ >+void >+solaris_audit_save_host(const char *host) >+{ >+ int i; >+#if !defined(HAVE_GETAUDIT_ADDR) >+ in_addr_t ia; >+#endif >+ >+ if (cannot_audit(0)) >+ return; >+ >+ (void) strlcpy(sav_host, host, sizeof (sav_host)); >+ debug3("BSM audit: sav_host=%s", sav_host); >+ memset(sav_machine, 0, sizeof(sav_machine)); >+#if defined(HAVE_GETAUDIT_ADDR) >+ (void) aug_get_machine(sav_host, &sav_machine[0], &sav_iptype); >+ debug3("BSM audit: sav_iptype=%ld", (long)sav_iptype); >+#else >+ ia = inet_addr(host); >+ memcpy(&sav_machine[0], &ia, sizeof(sav_machine[0])); >+ sav_iptype = 0; /* not used, but just in case */ >+#endif >+ for (i = 0; i < sizeof(sav_machine) / sizeof(sav_machine[0]); i++) { >+ debug3("BSM audit: sav_machine[%d]=%08lx", >+ i, (long)sav_machine[i]); >+ } >+} >+ >+void >+solaris_audit_save_command(const char *command) >+{ >+ if (cannot_audit(0)) >+ return; >+ >+ if (sav_cmd != NULL) { >+ free(sav_cmd); >+ sav_cmd = NULL; >+ } >+ sav_cmd = strdup(command); >+ debug3("BSM audit: sav_cmd=%s", sav_cmd); >+} >+ >+void >+solaris_audit_save_ttyn(const char *ttyn) >+{ >+ if (cannot_audit(0)) >+ return; >+ >+ (void) strlcpy(sav_ttyn, ttyn, sizeof (sav_ttyn)); >+ debug3("BSM audit: sav_ttyn=%s", sav_ttyn); >+} >+ >+void >+solaris_audit_save_name(const char *name) >+{ >+ if (cannot_audit(0)) { >+ return; >+ } >+ (void) strlcpy(sav_name, name, sizeof (sav_name)); >+ debug3("BSM audit: sav_name=%s", sav_name); >+} >+ >+void >+solaris_audit_save_pw(struct passwd *pwd) >+{ >+ if (cannot_audit(0)) >+ return; >+ >+ if (pwd == NULL) { >+ sav_uid = -1; >+ sav_gid = -1; >+ } else { >+ (void) strlcpy(sav_name, pwd->pw_name, sizeof (sav_name)); >+ sav_uid = pwd->pw_uid; >+ sav_gid = pwd->pw_gid; >+ } >+ debug3("BSM audit: sav_name=%s", sav_name); >+ debug3("BSM audit: sav_uid=%ld", (long)sav_uid); >+ debug3("BSM audit: sav_gid=%ld", (long)sav_gid); >+} >+ >+void >+solaris_audit_bad_pw(const char *what) >+{ >+ char textbuf[BSM_TEXTBUFSZ]; >+ >+ if (cannot_audit(0)) >+ return; >+ >+ if (sav_uid == -1) { >+ (void) snprintf(textbuf, sizeof (textbuf), >+ gettext("invalid user name \"%s\""), sav_name); >+ solaris_audit_record(3, textbuf, AUE_openssh); >+ } else { >+ (void) snprintf(textbuf, sizeof (textbuf), >+ gettext("invalid %s for user %s"), what, sav_name); >+ solaris_audit_record(4, textbuf, AUE_openssh); >+ } >+} >+ >+static void >+solaris_audit_record(int typ, char *string, au_event_t event_no) >+{ >+ int ad, rc, sel; >+ uid_t uid; >+ gid_t gid; >+ pid_t pid; >+ AuditInfoTermID tid; >+ >+ uid = sav_uid; >+ gid = sav_gid; >+ pid = getpid(); >+ >+ get_terminal_id(&tid); >+ >+ if (typ == 0) { >+ rc = 0; >+ } else { >+ rc = -1; >+ } >+ >+ sel = selected(sav_name, uid, event_no, rc); >+ debug3("BSM audit: typ %d rc %d \"%s\"", typ, rc, string); >+ if (!sel) >+ return; >+ >+ ad = au_open(); >+ >+ (void) au_write(ad, AUToSubjectFunc(uid, uid, gid, uid, gid, >+ pid, pid, &tid)); >+ (void) au_write(ad, au_to_text(string)); >+ if (sav_cmd != NULL) { >+ (void) au_write(ad, au_to_text(sav_cmd)); >+ } >+ (void) au_write(ad, AUToReturnFunc(typ, rc)); >+ >+ rc = au_close(ad, AU_TO_WRITE, event_no); >+ if (rc < 0) { >+ error("BSM audit: solaris_audit_record failed to write \"%s\" record: %s", >+ string, strerror(errno)); >+ } >+} >+ >+static void >+solaris_audit_session_setup(void) >+{ >+ int rc; >+ struct AuditInfoStruct info; >+ au_mask_t mask; >+ struct AuditInfoStruct now; >+ >+ info.ai_auid = sav_uid; >+ info.ai_asid = getpid(); >+ mask.am_success = 0; >+ mask.am_failure = 0; >+ >+ (void) au_user_mask(sav_name, &mask); >+ >+ info.ai_mask.am_success = mask.am_success; >+ info.ai_mask.am_failure = mask.am_failure; >+ >+ /* see if terminal id already set */ >+ if (GetAuditFunc(&now, sizeof (now)) < 0) { >+ error("BSM audit: solaris_audit_session_setup: %s failed: %s", >+ GetAuditFuncText, strerror(errno)); >+ } >+ >+ debug("BSM solaris_audit_setup_session: calling get_terminal_id"); >+ get_terminal_id(&(info.ai_termid)); >+ >+ rc = SetAuditFunc(&info, sizeof (info)); >+ if (rc < 0) { >+ error("BSM audit: solaris_audit_session_setup: %s failed: %s", >+ SetAuditFuncText, strerror(errno)); >+ } >+} >+ >+ >+static void >+get_terminal_id(AuditInfoTermID *tid) >+{ >+#if defined(HAVE_GETAUDIT_ADDR) >+ tid->at_port = sav_port; >+ tid->at_type = sav_iptype; >+ tid->at_addr[0] = sav_machine[0]; >+ tid->at_addr[1] = sav_machine[1]; >+ tid->at_addr[2] = sav_machine[2]; >+ tid->at_addr[3] = sav_machine[3]; >+#else >+ tid->port = sav_port; >+ tid->machine = sav_machine[0]; >+#endif >+} >+ >+void >+solaris_audit_event(enum audit_event_type event) >+{ >+ char textbuf[BSM_TEXTBUFSZ]; >+ >+ if (cannot_audit(0)) >+ return; >+ >+ switch(event) { >+ case LOGOUT: >+ snprintf(textbuf, sizeof (textbuf), >+ gettext("sshd logout %s"), sav_name); >+ solaris_audit_record(0, textbuf, AUE_logout); >+ break; >+ >+ case NOLOGIN: >+ solaris_audit_record(1, >+ gettext("logins disabled by /etc/nologin"), AUE_openssh); >+ break; >+ >+ case MAXTRIES: >+ snprintf(textbuf, sizeof (textbuf), >+ gettext("too many tries for user %s"), sav_name); >+ solaris_audit_record(1, textbuf, AUE_openssh); >+ break; >+ >+ case NOT_CONSOLE: >+ solaris_audit_record(2, gettext("not_console"), AUE_openssh); >+ break; >+ >+ case SUCCESS: >+ solaris_audit_session_setup(); >+ snprintf(textbuf, sizeof (textbuf), >+ gettext("successful login %s"), sav_name); >+ solaris_audit_record(0, textbuf, AUE_openssh); >+ break; >+ } >+} >+ >+static int >+selected(char *nam, uid_t uid, au_event_t event, int sf) >+{ >+ int rc, sorf; >+ char naflags[512]; >+ struct au_mask mask; >+ >+ mask.am_success = mask.am_failure = 0; >+ if (uid < 0) { >+ rc = getacna(naflags, 256); /* get non-attrib flags */ >+ if (rc == 0) >+ (void) getauditflagsbin(naflags, &mask); >+ } else { >+ rc = au_user_mask(nam, &mask); >+ } >+ >+ if (sf == 0) { >+ sorf = AU_PRS_SUCCESS; >+ } else { >+ sorf = AU_PRS_FAILURE; >+ } >+ rc = au_preselect(event, &mask, sorf, AU_PRS_REREAD); >+ >+ return (rc); >+} >+ >+# ifdef CUSTOM_FAILED_LOGIN >+void >+record_failed_login(const char *user, const char *ttyname) >+{ >+} >+# endif >+ >+#endif /* BSM */ >Index: openbsd-compat/port-solaris.h >=================================================================== >RCS file: openbsd-compat/port-solaris.h >diff -N openbsd-compat/port-solaris.h >--- /dev/null 1 Jan 1970 00:00:00 -0000 >+++ openbsd-compat/port-solaris.h 27 Aug 2003 15:04:57 -0000 >@@ -0,0 +1,55 @@ >+/* >+ * Copyright 1993-2002 Sun Microsystems, Inc. All rights reserved. >+ * Use is subject to license terms. >+ * >+ * Redistribution and use in source and binary forms, with or without >+ * modification, are permitted provided that the following conditions >+ * are met: >+ * 1. Redistributions of source code must retain the above copyright >+ * notice, this list of conditions and the following disclaimer. >+ * 2. Redistributions in binary form must reproduce the above copyright >+ * notice, this list of conditions and the following disclaimer in the >+ * documentation and/or other materials provided with the distribution. >+ * >+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR >+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES >+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. >+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, >+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT >+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, >+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY >+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT >+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF >+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. >+ * >+ */ >+ >+#ifndef _BSD_SOLARIS_H >+#define _BSD_SOLARIS_H >+ >+#if defined(HAVE_BSM_AUDIT_H) && defined(HAVE_LIBBSM) >+ >+/* #pragma ident "@(#)bsmaudit.h 1.1 01/09/17 SMI" */ >+ >+#include <bsm/audit.h> >+#define AUE_openssh 32800 >+ >+enum audit_event_type { >+ NOLOGIN, >+ MAXTRIES, >+ NOT_CONSOLE, >+ SUCCESS, >+ LOGOUT >+}; >+ >+void solaris_audit_save_name(const char *name); >+void solaris_audit_save_pw(struct passwd *pwd); >+void solaris_audit_event(enum audit_event_type); >+void solaris_audit_bad_pw(const char *what); >+void solaris_audit_save_host(const char *host); >+void solaris_audit_save_ttyn(const char *ttyn); >+void solaris_audit_save_port(int port); >+void solaris_audit_save_command(const char *command); >+ >+#endif /* BSM */ >+#endif /* _BSD_SOLARIS_H */
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=619">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 125
:
131
|
192
|
355
|
438
|
500
|
560
|
618
|
619
|
647
|
753
|
754
|
755
|
756
|
793
|
794
|
795
|
796
|
800
|
804
|
820
|
826
|
845
|
846