128 lines
3.7 KiB
Diff
128 lines
3.7 KiB
Diff
diff -up openssh-5.8p1/audit-linux.c.audit1a openssh-5.8p1/audit-linux.c
|
|
--- openssh-5.8p1/audit-linux.c.audit1a 2011-02-21 18:14:37.000000000 +0100
|
|
+++ openssh-5.8p1/audit-linux.c 2011-02-21 18:17:33.000000000 +0100
|
|
@@ -35,13 +35,20 @@
|
|
|
|
#include "log.h"
|
|
#include "audit.h"
|
|
+#include "key.h"
|
|
+#include "hostfile.h"
|
|
+#include "auth.h"
|
|
+#include "servconf.h"
|
|
#include "canohost.h"
|
|
|
|
+extern ServerOptions options;
|
|
+extern Authctxt *the_authctxt;
|
|
+extern u_int utmp_len;
|
|
const char* audit_username(void);
|
|
|
|
static void
|
|
-linux_audit_user_login(int uid, const char *username,
|
|
- const char *hostname, const char *ip, const char *ttyn, int success)
|
|
+linux_audit_user_logxxx(int uid, const char *username,
|
|
+ const char *hostname, const char *ip, const char *ttyn, int success, int event)
|
|
{
|
|
int audit_fd, rc, saved_errno;
|
|
|
|
@@ -53,7 +60,7 @@ linux_audit_user_login(int uid, const ch
|
|
else
|
|
goto fatal_report; /* Must prevent login */
|
|
}
|
|
- rc = audit_log_acct_message(audit_fd, AUDIT_USER_LOGIN,
|
|
+ rc = audit_log_acct_message(audit_fd, event,
|
|
NULL, "login", username ? username : "(unknown)",
|
|
username == NULL ? uid : -1, hostname, ip, ttyn, success);
|
|
saved_errno = errno;
|
|
@@ -77,19 +84,19 @@ linux_audit_user_auth(int uid, const cha
|
|
{
|
|
int audit_fd, rc, saved_errno;
|
|
static const char *event_name[] = {
|
|
- "exceed maxtries",
|
|
+ "maxtries exceeded",
|
|
"root denied",
|
|
"success",
|
|
"none",
|
|
- "pasword",
|
|
- "chalenge-response",
|
|
+ "password",
|
|
+ "challenge-response",
|
|
"pubkey",
|
|
"hostbased",
|
|
"gssapi",
|
|
"invalid user",
|
|
"nologin",
|
|
- "connection close",
|
|
- "connection abandon",
|
|
+ "connection closed",
|
|
+ "connection abandoned",
|
|
"unknown"
|
|
};
|
|
|
|
@@ -123,6 +130,8 @@ fatal_report:
|
|
}
|
|
}
|
|
|
|
+static int user_login_count = 0;
|
|
+
|
|
/* Below is the sshd audit API code */
|
|
|
|
void
|
|
@@ -134,20 +143,31 @@ audit_connection_from(const char *host,
|
|
void
|
|
audit_run_command(const char *command)
|
|
{
|
|
- /* not implemented */
|
|
+ linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),
|
|
+ NULL, "ssh", 1, AUDIT_USER_START);
|
|
+ if (!user_login_count++)
|
|
+ linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),
|
|
+ NULL, "ssh", 1, AUDIT_USER_LOGIN);
|
|
}
|
|
|
|
void
|
|
audit_session_open(struct logininfo *li)
|
|
{
|
|
- linux_audit_user_login(li->uid, NULL, li->hostname,
|
|
- NULL, li->line, 1);
|
|
+ linux_audit_user_logxxx(li->uid, NULL, li->hostname,
|
|
+ NULL, li->line, 1, AUDIT_USER_START);
|
|
+ if (!user_login_count++)
|
|
+ linux_audit_user_logxxx(li->uid, NULL, li->hostname,
|
|
+ NULL, li->line, 1, AUDIT_USER_LOGIN);
|
|
}
|
|
|
|
void
|
|
audit_session_close(struct logininfo *li)
|
|
{
|
|
- /* not implemented */
|
|
+ linux_audit_user_logxxx(li->uid, NULL, li->hostname,
|
|
+ NULL, li->line, 1, AUDIT_USER_END);
|
|
+ if (!--user_login_count)
|
|
+ linux_audit_user_logxxx(li->uid, NULL, li->hostname,
|
|
+ NULL, li->line, 1, AUDIT_USER_LOGOUT);
|
|
}
|
|
|
|
void
|
|
@@ -163,8 +183,8 @@ audit_event(ssh_audit_event_t event)
|
|
case SSH_LOGIN_ROOT_DENIED:
|
|
linux_audit_user_auth(-1, audit_username(), NULL,
|
|
get_remote_ipaddr(), "sshd", 0, event);
|
|
- linux_audit_user_login(-1, audit_username(), NULL,
|
|
- get_remote_ipaddr(), "sshd", 0);
|
|
+ linux_audit_user_logxxx(-1, audit_username(), NULL,
|
|
+ get_remote_ipaddr(), "sshd", 0, AUDIT_USER_LOGIN);
|
|
break;
|
|
|
|
case SSH_LOGIN_EXCEED_MAXTRIES:
|
|
@@ -181,8 +201,8 @@ audit_event(ssh_audit_event_t event)
|
|
case SSH_CONNECTION_CLOSE:
|
|
case SSH_CONNECTION_ABANDON:
|
|
case SSH_INVALID_USER:
|
|
- linux_audit_user_login(-1, audit_username(), NULL,
|
|
- get_remote_ipaddr(), "sshd", 0);
|
|
+ linux_audit_user_logxxx(-1, audit_username(), NULL,
|
|
+ get_remote_ipaddr(), "sshd", 0, AUDIT_USER_LOGIN);
|
|
break;
|
|
|
|
default:
|