- (dtucker) [Makefile.in auth.c auth.h auth1.c auth2.c loginrec.c monitor.c

   monitor.h monitor_wrap.c monitor_wrap.h session.c sshd.c] Bug #125:
   (first stage) Add audit instrumentation to sshd, currently disabled by
   default.  with suggestions from and djm@

1 files changed, 65 insertions, 0 deletions

diff --git a/monitor.c b/monitor.c
index 00d4a785f..ce7784aa1 100644
--- a/monitor.c
+++ b/monitor.c
@@ -143,6 +143,11 @@ int mm_answer_gss_userok(int, Buffer *);
 int mm_answer_gss_checkmic(int, Buffer *);
 #endif
 
+#ifdef AUDIT_EVENTS
+int mm_answer_audit_event(int, Buffer *);
+int mm_answer_audit_command(int, Buffer *);
+#endif
+
 static Authctxt *authctxt;
 static BIGNUM *ssh1_challenge = NULL;   /* used for ssh1 rsa auth */
 
@@ -186,6 +191,9 @@ struct mon_table mon_dispatch_proto20[] = {
     {MONITOR_REQ_PAM_RESPOND, MON_ISAUTH, mm_answer_pam_respond},
     {MONITOR_REQ_PAM_FREE_CTX, MON_ONCE|MON_AUTHDECIDE, mm_answer_pam_free_ctx},
 #endif
+#ifdef AUDIT_EVENTS
+    {MONITOR_REQ_AUDIT_EVENT, 0, mm_answer_audit_event},
+#endif
 #ifdef BSD_AUTH
     {MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
     {MONITOR_REQ_BSDAUTHRESPOND, MON_AUTH,mm_answer_bsdauthrespond},
@@ -211,6 +219,10 @@ struct mon_table mon_dispatch_postauth20[] = {
     {MONITOR_REQ_PTY, 0, mm_answer_pty},
     {MONITOR_REQ_PTYCLEANUP, 0, mm_answer_pty_cleanup},
     {MONITOR_REQ_TERM, 0, mm_answer_term},
+#ifdef AUDIT_EVENTS
+    {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
+    {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
+#endif
     {0, 0, NULL}
 };
 
@@ -239,6 +251,9 @@ struct mon_table mon_dispatch_proto15[] = {
     {MONITOR_REQ_PAM_RESPOND, MON_ISAUTH, mm_answer_pam_respond},
     {MONITOR_REQ_PAM_FREE_CTX, MON_ONCE|MON_AUTHDECIDE, mm_answer_pam_free_ctx},
 #endif
+#ifdef AUDIT_EVENTS
+    {MONITOR_REQ_AUDIT_EVENT, 0, mm_answer_audit_event},
+#endif
     {0, 0, NULL}
 };
 
@@ -246,6 +261,10 @@ struct mon_table mon_dispatch_postauth15[] = {
     {MONITOR_REQ_PTY, MON_ONCE, mm_answer_pty},
     {MONITOR_REQ_PTYCLEANUP, MON_ONCE, mm_answer_pty_cleanup},
     {MONITOR_REQ_TERM, 0, mm_answer_term},
+#ifdef AUDIT_EVENTS
+    {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
+    {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command},
+#endif
     {0, 0, NULL}
 };
 
@@ -609,6 +628,9 @@ mm_answer_pwnamallow(int sock, Buffer *m)
         if (options.use_pam)
                 monitor_permit(mon_dispatch, MONITOR_REQ_PAM_START, 1);
 #endif
+#ifdef AUDIT_EVENTS
+        monitor_permit(mon_dispatch, MONITOR_REQ_AUDIT_EVENT, 1);
+#endif
 
         return (0);
 }
@@ -1491,6 +1513,49 @@ mm_answer_term(int sock, Buffer *req)
         exit(res);
 }
 
+#ifdef AUDIT_EVENTS
+/* Report that an audit event occurred */
+int
+mm_answer_audit_event(int socket, Buffer *m)
+{
+        ssh_audit_event_t event;
+
+        debug3("%s entering", __func__);
+
+        event = buffer_get_int(m);
+        buffer_free(m);
+        switch(event) {
+        case AUTH_FAIL_PUBKEY:
+        case AUTH_FAIL_HOSTBASED:
+        case AUTH_FAIL_GSSAPI:
+        case LOGIN_EXCEED_MAXTRIES:
+        case LOGIN_ROOT_DENIED:
+        case CONNECTION_CLOSE:
+                audit_event(event);
+                break;
+        default:
+                fatal("Audit event type %d not permitted", event);
+        }
+
+        return (0);
+}
+
+int
+mm_answer_audit_command(int socket, Buffer *m)
+{
+        u_int len;
+        char *cmd;
+
+        debug3("%s entering", __func__);
+        cmd = buffer_get_string(m, &len);
+        /* sanity check command, if so how? */
+        audit_run_command(cmd);
+        xfree(cmd);
+        buffer_free(m);
+        return (0);
+}
+#endif /* AUDIT_EVENTS */
+
 void
 monitor_apply_keystate(struct monitor *pmonitor)
 {