| 1 |
diff -up openssh-5.3p1/auth.c.audit openssh-5.3p1/auth.c
|
| 2 |
--- openssh-5.3p1/auth.c.audit 2008-11-05 06:12:54.000000000 +0100
|
| 3 |
+++ openssh-5.3p1/auth.c 2009-10-11 13:02:47.000000000 +0200
|
| 4 |
@@ -287,6 +287,12 @@ auth_log(Authctxt *authctxt, int authent
|
| 5 |
get_canonical_hostname(options.use_dns), "ssh", &loginmsg);
|
| 6 |
# endif
|
| 7 |
#endif
|
| 8 |
+#if HAVE_LINUX_AUDIT
|
| 9 |
+ if (authenticated == 0 && !authctxt->postponed) {
|
| 10 |
+ linux_audit_record_event(-1, authctxt->user, NULL,
|
| 11 |
+ get_remote_ipaddr(), "sshd", 0);
|
| 12 |
+ }
|
| 13 |
+#endif
|
| 14 |
#ifdef SSH_AUDIT_EVENTS
|
| 15 |
if (authenticated == 0 && !authctxt->postponed)
|
| 16 |
audit_event(audit_classify_auth(method));
|
| 17 |
@@ -533,6 +539,10 @@ getpwnamallow(const char *user)
|
| 18 |
record_failed_login(user,
|
| 19 |
get_canonical_hostname(options.use_dns), "ssh");
|
| 20 |
#endif
|
| 21 |
+#ifdef HAVE_LINUX_AUDIT
|
| 22 |
+ linux_audit_record_event(-1, user, NULL, get_remote_ipaddr(),
|
| 23 |
+ "sshd", 0);
|
| 24 |
+#endif
|
| 25 |
#ifdef SSH_AUDIT_EVENTS
|
| 26 |
audit_event(SSH_INVALID_USER);
|
| 27 |
#endif /* SSH_AUDIT_EVENTS */
|
| 28 |
diff -up openssh-5.3p1/config.h.in.audit openssh-5.3p1/config.h.in
|
| 29 |
--- openssh-5.3p1/config.h.in.audit 2009-09-26 08:31:14.000000000 +0200
|
| 30 |
+++ openssh-5.3p1/config.h.in 2009-10-11 13:09:41.000000000 +0200
|
| 31 |
@@ -533,6 +533,9 @@
|
| 32 |
/* Define to 1 if you have the <lastlog.h> header file. */
|
| 33 |
#undef HAVE_LASTLOG_H
|
| 34 |
|
| 35 |
+/* Define to 1 if you have the <libaudit.h> header file. */
|
| 36 |
+#undef HAVE_LIBAUDIT_H
|
| 37 |
+
|
| 38 |
/* Define to 1 if you have the `bsm' library (-lbsm). */
|
| 39 |
#undef HAVE_LIBBSM
|
| 40 |
|
| 41 |
@@ -572,6 +575,9 @@
|
| 42 |
/* Define to 1 if you have the <limits.h> header file. */
|
| 43 |
#undef HAVE_LIMITS_H
|
| 44 |
|
| 45 |
+/* Define if you want Linux audit support. */
|
| 46 |
+#undef HAVE_LINUX_AUDIT
|
| 47 |
+
|
| 48 |
/* Define to 1 if you have the <linux/if_tun.h> header file. */
|
| 49 |
#undef HAVE_LINUX_IF_TUN_H
|
| 50 |
|
| 51 |
@@ -768,6 +774,9 @@
|
| 52 |
/* Define to 1 if you have the `setgroups' function. */
|
| 53 |
#undef HAVE_SETGROUPS
|
| 54 |
|
| 55 |
+/* Define to 1 if you have the `setkeycreatecon' function. */
|
| 56 |
+#undef HAVE_SETKEYCREATECON
|
| 57 |
+
|
| 58 |
/* Define to 1 if you have the `setlogin' function. */
|
| 59 |
#undef HAVE_SETLOGIN
|
| 60 |
|
| 61 |
@@ -1348,6 +1357,10 @@
|
| 62 |
/* Prepend the address family to IP tunnel traffic */
|
| 63 |
#undef SSH_TUN_PREPEND_AF
|
| 64 |
|
| 65 |
+/* Define to your vendor patch level, if it has been modified from the
|
| 66 |
+ upstream source release. */
|
| 67 |
+#undef SSH_VENDOR_PATCHLEVEL
|
| 68 |
+
|
| 69 |
/* Define to 1 if you have the ANSI C header files. */
|
| 70 |
#undef STDC_HEADERS
|
| 71 |
|
| 72 |
diff -up openssh-5.3p1/configure.ac.audit openssh-5.3p1/configure.ac
|
| 73 |
--- openssh-5.3p1/configure.ac.audit 2009-09-11 06:56:08.000000000 +0200
|
| 74 |
+++ openssh-5.3p1/configure.ac 2009-10-11 13:08:03.000000000 +0200
|
| 75 |
@@ -3407,6 +3407,18 @@ AC_ARG_WITH(selinux,
|
| 76 |
fi ]
|
| 77 |
)
|
| 78 |
|
| 79 |
+# Check whether user wants Linux audit support
|
| 80 |
+LINUX_AUDIT_MSG="no"
|
| 81 |
+AC_ARG_WITH(linux-audit,
|
| 82 |
+ [ --with-linux-audit Enable Linux audit support],
|
| 83 |
+ [ if test "x$withval" != "xno" ; then
|
| 84 |
+ AC_DEFINE(HAVE_LINUX_AUDIT,1,[Define if you want Linux audit support.])
|
| 85 |
+ LINUX_AUDIT_MSG="yes"
|
| 86 |
+ AC_CHECK_HEADERS(libaudit.h)
|
| 87 |
+ SSHDLIBS="$SSHDLIBS -laudit"
|
| 88 |
+ fi ]
|
| 89 |
+)
|
| 90 |
+
|
| 91 |
# Check whether user wants Kerberos 5 support
|
| 92 |
KRB5_MSG="no"
|
| 93 |
AC_ARG_WITH(kerberos5,
|
| 94 |
@@ -4226,6 +4238,7 @@ echo " PAM support
|
| 95 |
echo " OSF SIA support: $SIA_MSG"
|
| 96 |
echo " KerberosV support: $KRB5_MSG"
|
| 97 |
echo " SELinux support: $SELINUX_MSG"
|
| 98 |
+echo " Linux audit support: $LINUX_AUDIT_MSG"
|
| 99 |
echo " Smartcard support: $SCARD_MSG"
|
| 100 |
echo " S/KEY support: $SKEY_MSG"
|
| 101 |
echo " TCP Wrappers support: $TCPW_MSG"
|
| 102 |
diff -up openssh-5.3p1/loginrec.c.audit openssh-5.3p1/loginrec.c
|
| 103 |
--- openssh-5.3p1/loginrec.c.audit 2009-02-12 03:12:22.000000000 +0100
|
| 104 |
+++ openssh-5.3p1/loginrec.c 2009-10-11 13:06:16.000000000 +0200
|
| 105 |
@@ -176,6 +176,10 @@
|
| 106 |
#include "auth.h"
|
| 107 |
#include "buffer.h"
|
| 108 |
|
| 109 |
+#ifdef HAVE_LINUX_AUDIT
|
| 110 |
+# include <libaudit.h>
|
| 111 |
+#endif
|
| 112 |
+
|
| 113 |
#ifdef HAVE_UTIL_H
|
| 114 |
# include <util.h>
|
| 115 |
#endif
|
| 116 |
@@ -202,6 +206,9 @@ int utmp_write_entry(struct logininfo *l
|
| 117 |
int utmpx_write_entry(struct logininfo *li);
|
| 118 |
int wtmp_write_entry(struct logininfo *li);
|
| 119 |
int wtmpx_write_entry(struct logininfo *li);
|
| 120 |
+#ifdef HAVE_LINUX_AUDIT
|
| 121 |
+int linux_audit_write_entry(struct logininfo *li);
|
| 122 |
+#endif
|
| 123 |
int lastlog_write_entry(struct logininfo *li);
|
| 124 |
int syslogin_write_entry(struct logininfo *li);
|
| 125 |
|
| 126 |
@@ -440,6 +447,10 @@ login_write(struct logininfo *li)
|
| 127 |
|
| 128 |
/* set the timestamp */
|
| 129 |
login_set_current_time(li);
|
| 130 |
+#ifdef HAVE_LINUX_AUDIT
|
| 131 |
+ if (linux_audit_write_entry(li) == 0)
|
| 132 |
+ fatal("linux_audit_write_entry failed: %s", strerror(errno));
|
| 133 |
+#endif
|
| 134 |
#ifdef USE_LOGIN
|
| 135 |
syslogin_write_entry(li);
|
| 136 |
#endif
|
| 137 |
@@ -1394,6 +1405,87 @@ wtmpx_get_entry(struct logininfo *li)
|
| 138 |
}
|
| 139 |
#endif /* USE_WTMPX */
|
| 140 |
|
| 141 |
+#ifdef HAVE_LINUX_AUDIT
|
| 142 |
+static void
|
| 143 |
+_audit_hexscape(const char *what, char *where, unsigned int size)
|
| 144 |
+{
|
| 145 |
+ const char *ptr = what;
|
| 146 |
+ const char *hex = "0123456789ABCDEF";
|
| 147 |
+
|
| 148 |
+ while (*ptr) {
|
| 149 |
+ if (*ptr == '"' || *ptr < 0x21 || *ptr > 0x7E) {
|
| 150 |
+ unsigned int i;
|
| 151 |
+ ptr = what;
|
| 152 |
+ for (i = 0; *ptr && i+2 < size; i += 2) {
|
| 153 |
+ where[i] = hex[((unsigned)*ptr & 0xF0)>>4]; /* Upper nibble */
|
| 154 |
+ where[i+1] = hex[(unsigned)*ptr & 0x0F]; /* Lower nibble */
|
| 155 |
+ ptr++;
|
| 156 |
+ }
|
| 157 |
+ where[i] = '\0';
|
| 158 |
+ return;
|
| 159 |
+ }
|
| 160 |
+ ptr++;
|
| 161 |
+ }
|
| 162 |
+ where[0] = '"';
|
| 163 |
+ if ((unsigned)(ptr - what) < size - 3)
|
| 164 |
+ {
|
| 165 |
+ size = ptr - what + 3;
|
| 166 |
+ }
|
| 167 |
+ strncpy(where + 1, what, size - 3);
|
| 168 |
+ where[size-2] = '"';
|
| 169 |
+ where[size-1] = '\0';
|
| 170 |
+}
|
| 171 |
+
|
| 172 |
+#define AUDIT_LOG_SIZE 128
|
| 173 |
+#define AUDIT_ACCT_SIZE (AUDIT_LOG_SIZE - 8)
|
| 174 |
+
|
| 175 |
+int
|
| 176 |
+linux_audit_record_event(int uid, const char *username,
|
| 177 |
+ const char *hostname, const char *ip, const char *ttyn, int success)
|
| 178 |
+{
|
| 179 |
+ char buf[AUDIT_LOG_SIZE];
|
| 180 |
+ int audit_fd, rc;
|
| 181 |
+
|
| 182 |
+ audit_fd = audit_open();
|
| 183 |
+ if (audit_fd < 0) {
|
| 184 |
+ if (errno == EINVAL || errno == EPROTONOSUPPORT ||
|
| 185 |
+ errno == EAFNOSUPPORT)
|
| 186 |
+ return 1; /* No audit support in kernel */
|
| 187 |
+ else
|
| 188 |
+ return 0; /* Must prevent login */
|
| 189 |
+ }
|
| 190 |
+ if (username == NULL)
|
| 191 |
+ snprintf(buf, sizeof(buf), "uid=%d", uid);
|
| 192 |
+ else {
|
| 193 |
+ char encoded[AUDIT_ACCT_SIZE];
|
| 194 |
+ _audit_hexscape(username, encoded, sizeof(encoded));
|
| 195 |
+ snprintf(buf, sizeof(buf), "acct=%s", encoded);
|
| 196 |
+ }
|
| 197 |
+ rc = audit_log_user_message(audit_fd, AUDIT_USER_LOGIN,
|
| 198 |
+ buf, hostname, ip, ttyn, success);
|
| 199 |
+ close(audit_fd);
|
| 200 |
+ if (rc >= 0)
|
| 201 |
+ return 1;
|
| 202 |
+ else
|
| 203 |
+ return 0;
|
| 204 |
+}
|
| 205 |
+
|
| 206 |
+int
|
| 207 |
+linux_audit_write_entry(struct logininfo *li)
|
| 208 |
+{
|
| 209 |
+ switch(li->type) {
|
| 210 |
+ case LTYPE_LOGIN:
|
| 211 |
+ return (linux_audit_record_event(li->uid, NULL, li->hostname,
|
| 212 |
+ NULL, li->line, 1));
|
| 213 |
+ case LTYPE_LOGOUT:
|
| 214 |
+ return (1); /* We only care about logins */
|
| 215 |
+ default:
|
| 216 |
+ logit("%s: invalid type field", __func__);
|
| 217 |
+ return (0);
|
| 218 |
+ }
|
| 219 |
+}
|
| 220 |
+#endif /* HAVE_LINUX_AUDIT */
|
| 221 |
+
|
| 222 |
/**
|
| 223 |
** Low-level libutil login() functions
|
| 224 |
**/
|
| 225 |
diff -up openssh-5.3p1/loginrec.h.audit openssh-5.3p1/loginrec.h
|
| 226 |
--- openssh-5.3p1/loginrec.h.audit 2006-08-05 04:39:40.000000000 +0200
|
| 227 |
+++ openssh-5.3p1/loginrec.h 2009-10-11 13:04:28.000000000 +0200
|
| 228 |
@@ -127,5 +127,9 @@ char *line_stripname(char *dst, const ch
|
| 229 |
char *line_abbrevname(char *dst, const char *src, int dstsize);
|
| 230 |
|
| 231 |
void record_failed_login(const char *, const char *, const char *);
|
| 232 |
+#ifdef HAVE_LINUX_AUDIT
|
| 233 |
+int linux_audit_record_event(int uid, const char *username,
|
| 234 |
+ const char *hostname, const char *ip, const char *ttyn, int success);
|
| 235 |
+#endif /* HAVE_LINUX_AUDIT */
|
| 236 |
|
| 237 |
#endif /* _HAVE_LOGINREC_H_ */
|
Parent Directory
| 
Revision Log