140 lines
5.3 KiB
Diff
140 lines
5.3 KiB
Diff
diff -up openssh-5.8p1/audit-bsm.c.audit3a openssh-5.8p1/audit-bsm.c
|
|
--- openssh-5.8p1/audit-bsm.c.audit3a 2011-02-21 18:29:45.000000000 +0100
|
|
+++ openssh-5.8p1/audit-bsm.c 2011-02-21 18:29:45.000000000 +0100
|
|
@@ -391,7 +391,7 @@ audit_unsupported_body(int what)
|
|
}
|
|
|
|
void
|
|
-audit_kex_body(int ctos, char *enc, char *mac, char *compress)
|
|
+audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid, uid_t uid)
|
|
{
|
|
/* not implemented */
|
|
}
|
|
diff -up openssh-5.8p1/audit.c.audit3a openssh-5.8p1/audit.c
|
|
--- openssh-5.8p1/audit.c.audit3a 2011-02-21 18:29:45.000000000 +0100
|
|
+++ openssh-5.8p1/audit.c 2011-02-21 18:29:45.000000000 +0100
|
|
@@ -28,6 +28,7 @@
|
|
|
|
#include <stdarg.h>
|
|
#include <string.h>
|
|
+#include <unistd.h>
|
|
|
|
#ifdef SSH_AUDIT_EVENTS
|
|
|
|
@@ -139,7 +140,7 @@ audit_unsupported(int what)
|
|
void
|
|
audit_kex(int ctos, char *enc, char *mac, char *comp)
|
|
{
|
|
- PRIVSEP(audit_kex_body(ctos, enc, mac, comp));
|
|
+ PRIVSEP(audit_kex_body(ctos, enc, mac, comp, getpid(), getuid()));
|
|
}
|
|
|
|
# ifndef CUSTOM_SSH_AUDIT_EVENTS
|
|
@@ -239,10 +240,12 @@ audit_unsupported_body(int what)
|
|
* This will be called on succesfull protocol negotiation.
|
|
*/
|
|
void
|
|
-audit_kex_body(int ctos, char *enc, char *mac, char *compress)
|
|
+audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,
|
|
+ uid_t uid)
|
|
{
|
|
- debug("audit procol negotiation euid %d direction %d cipher %s mac %s compresion %s",
|
|
- geteuid(), ctos, enc, mac, compress);
|
|
+ debug("audit protocol negotiation euid %d direction %d cipher %s mac %s compresion %s from pid %ld uid %u",
|
|
+ (unsigned)geteuid(), ctos, enc, mac, compress, (long)pid,
|
|
+ (unsigned)uid);
|
|
}
|
|
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
|
|
#endif /* SSH_AUDIT_EVENTS */
|
|
diff -up openssh-5.8p1/audit.h.audit3a openssh-5.8p1/audit.h
|
|
--- openssh-5.8p1/audit.h.audit3a 2011-02-21 18:29:45.000000000 +0100
|
|
+++ openssh-5.8p1/audit.h 2011-02-21 18:29:45.000000000 +0100
|
|
@@ -59,6 +59,6 @@ void audit_key(int, int *, const Key *);
|
|
void audit_unsupported(int);
|
|
void audit_kex(int, char *, char *, char *);
|
|
void audit_unsupported_body(int);
|
|
-void audit_kex_body(int, char *, char *, char *);
|
|
+void audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
|
|
|
|
#endif /* _SSH_AUDIT_H */
|
|
diff -up openssh-5.8p1/audit-linux.c.audit3a openssh-5.8p1/audit-linux.c
|
|
--- openssh-5.8p1/audit-linux.c.audit3a 2011-02-21 18:29:45.000000000 +0100
|
|
+++ openssh-5.8p1/audit-linux.c 2011-02-21 18:29:45.000000000 +0100
|
|
@@ -267,7 +267,8 @@ audit_unsupported_body(int what)
|
|
}
|
|
|
|
void
|
|
-audit_kex_body(int ctos, char *enc, char *mac, char *compress)
|
|
+audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,
|
|
+ uid_t uid)
|
|
{
|
|
#ifdef AUDIT_CRYPTO_SESSION
|
|
char buf[AUDIT_LOG_SIZE];
|
|
@@ -275,8 +276,9 @@ audit_kex_body(int ctos, char *enc, char
|
|
const static char *direction[] = { "from-server", "from-client", "both" };
|
|
Cipher *cipher = cipher_by_name(enc);
|
|
|
|
- snprintf(buf, sizeof(buf), "op=start direction=%s cipher=%s ksize=%d rport=%d laddr=%s lport=%d",
|
|
+ snprintf(buf, sizeof(buf), "op=start direction=%s cipher=%s ksize=%d spid=%jd suid=%jd rport=%d laddr=%s lport=%d",
|
|
direction[ctos], enc, cipher ? 8 * cipher->key_len : 0,
|
|
+ (intmax_t)pid, (intmax_t)uid,
|
|
get_remote_port(), get_local_ipaddr(packet_get_connection_in()), get_local_port());
|
|
audit_fd = audit_open();
|
|
if (audit_fd < 0) {
|
|
diff -up openssh-5.8p1/monitor.c.audit3a openssh-5.8p1/monitor.c
|
|
--- openssh-5.8p1/monitor.c.audit3a 2011-02-21 18:29:45.000000000 +0100
|
|
+++ openssh-5.8p1/monitor.c 2011-02-21 18:29:45.000000000 +0100
|
|
@@ -2239,13 +2239,17 @@ mm_answer_audit_kex_body(int sock, Buffe
|
|
{
|
|
int ctos, len;
|
|
char *cipher, *mac, *compress;
|
|
+ pid_t pid;
|
|
+ uid_t uid;
|
|
|
|
ctos = buffer_get_int(m);
|
|
cipher = buffer_get_string(m, &len);
|
|
mac = buffer_get_string(m, &len);
|
|
compress = buffer_get_string(m, &len);
|
|
+ pid = buffer_get_int64(m);
|
|
+ uid = buffer_get_int64(m);
|
|
|
|
- audit_kex_body(ctos, cipher, mac, compress);
|
|
+ audit_kex_body(ctos, cipher, mac, compress, pid, uid);
|
|
|
|
buffer_clear(m);
|
|
|
|
diff -up openssh-5.8p1/monitor_wrap.c.audit3a openssh-5.8p1/monitor_wrap.c
|
|
--- openssh-5.8p1/monitor_wrap.c.audit3a 2011-02-21 18:29:45.000000000 +0100
|
|
+++ openssh-5.8p1/monitor_wrap.c 2011-02-21 18:29:45.000000000 +0100
|
|
@@ -1430,7 +1430,8 @@ mm_audit_unsupported_body(int what)
|
|
}
|
|
|
|
void
|
|
-mm_audit_kex_body(int ctos, char *cipher, char *mac, char *compress)
|
|
+mm_audit_kex_body(int ctos, char *cipher, char *mac, char *compress, pid_t pid,
|
|
+ uid_t uid)
|
|
{
|
|
Buffer m;
|
|
|
|
@@ -1439,6 +1440,8 @@ mm_audit_kex_body(int ctos, char *cipher
|
|
buffer_put_cstring(&m, cipher);
|
|
buffer_put_cstring(&m, mac);
|
|
buffer_put_cstring(&m, compress);
|
|
+ buffer_put_int64(&m, pid);
|
|
+ buffer_put_int64(&m, uid);
|
|
|
|
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_KEX, &m);
|
|
mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_KEX,
|
|
diff -up openssh-5.8p1/monitor_wrap.h.audit3a openssh-5.8p1/monitor_wrap.h
|
|
--- openssh-5.8p1/monitor_wrap.h.audit3a 2011-02-21 18:33:57.000000000 +0100
|
|
+++ openssh-5.8p1/monitor_wrap.h 2011-02-21 18:34:18.000000000 +0100
|
|
@@ -75,7 +75,7 @@ void mm_sshpam_free_ctx(void *);
|
|
void mm_audit_event(ssh_audit_event_t);
|
|
void mm_audit_run_command(const char *);
|
|
void mm_audit_unsupported_body(int);
|
|
-void mm_audit_kex_body(int, char *, char *, char *);
|
|
+void mm_audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
|
|
#endif
|
|
|
|
struct Session;
|