diff options
author | Darren Tucker <dtucker@zip.com.au> | 2005-02-03 00:20:53 +1100 |
---|---|---|
committer | Darren Tucker <dtucker@zip.com.au> | 2005-02-03 00:20:53 +1100 |
commit | 269a1ea1c80a855d1eb74fccba6dd5c75947c5d2 (patch) | |
tree | 2c3ece8547de7552c4c78337607a1a387decd797 /auth.c | |
parent | 2fba993080eba14e339d6a6666ee79580ee20f97 (diff) |
- (dtucker) [Makefile.in auth.c auth.h auth1.c auth2.c loginrec.c monitor.c
monitor.h monitor_wrap.c monitor_wrap.h session.c sshd.c] Bug #125:
(first stage) Add audit instrumentation to sshd, currently disabled by
default. with suggestions from and djm@
Diffstat (limited to 'auth.c')
-rw-r--r-- | auth.c | 42 |
1 files changed, 42 insertions, 0 deletions
@@ -51,6 +51,7 @@ RCSID("$OpenBSD: auth.c,v 1.57 2005/01/22 08:17:59 dtucker Exp $"); | |||
51 | #include "bufaux.h" | 51 | #include "bufaux.h" |
52 | #include "packet.h" | 52 | #include "packet.h" |
53 | #include "loginrec.h" | 53 | #include "loginrec.h" |
54 | #include "monitor_wrap.h" | ||
54 | 55 | ||
55 | /* import */ | 56 | /* import */ |
56 | extern ServerOptions options; | 57 | extern ServerOptions options; |
@@ -251,6 +252,44 @@ auth_log(Authctxt *authctxt, int authenticated, char *method, char *info) | |||
251 | record_failed_login(authctxt->user, | 252 | record_failed_login(authctxt->user, |
252 | get_canonical_hostname(options.use_dns), "ssh"); | 253 | get_canonical_hostname(options.use_dns), "ssh"); |
253 | #endif | 254 | #endif |
255 | #ifdef AUDIT_EVENTS | ||
256 | if (authenticated == 0 && !authctxt->postponed) { | ||
257 | ssh_audit_event_t event; | ||
258 | |||
259 | debug3("audit failed auth attempt, method %s euid %d", | ||
260 | method, (int)geteuid()); | ||
261 | /* | ||
262 | * Because the auth loop is used in both monitor and slave, | ||
263 | * we must be careful to send each event only once and with | ||
264 | * enough privs to write the event. | ||
265 | */ | ||
266 | event = audit_classify_auth(method); | ||
267 | switch(event) { | ||
268 | case AUTH_FAIL_NONE: | ||
269 | case AUTH_FAIL_PASSWD: | ||
270 | case AUTH_FAIL_KBDINT: | ||
271 | if (geteuid() == 0) | ||
272 | audit_event(event); | ||
273 | break; | ||
274 | case AUTH_FAIL_PUBKEY: | ||
275 | case AUTH_FAIL_HOSTBASED: | ||
276 | case AUTH_FAIL_GSSAPI: | ||
277 | /* | ||
278 | * This is required to handle the case where privsep | ||
279 | * is enabled but it's root logging in, since | ||
280 | * use_privsep won't be cleared until after a | ||
281 | * successful login. | ||
282 | */ | ||
283 | if (geteuid() == 0) | ||
284 | audit_event(event); | ||
285 | else | ||
286 | PRIVSEP(audit_event(event)); | ||
287 | break; | ||
288 | default: | ||
289 | error("unknown authentication audit event %d", event); | ||
290 | } | ||
291 | } | ||
292 | #endif | ||
254 | } | 293 | } |
255 | 294 | ||
256 | /* | 295 | /* |
@@ -476,6 +515,9 @@ getpwnamallow(const char *user) | |||
476 | record_failed_login(user, | 515 | record_failed_login(user, |
477 | get_canonical_hostname(options.use_dns), "ssh"); | 516 | get_canonical_hostname(options.use_dns), "ssh"); |
478 | #endif | 517 | #endif |
518 | #ifdef AUDIT_EVENTS | ||
519 | audit_event(INVALID_USER); | ||
520 | #endif /* AUDIT_EVENTS */ | ||
479 | return (NULL); | 521 | return (NULL); |
480 | } | 522 | } |
481 | if (!allowed_user(pw)) | 523 | if (!allowed_user(pw)) |