|
 |
2ed3f9b |
diff -up openssh-5.3p1/auth.c.audit openssh-5.3p1/auth.c
|
|
|
2ed3f9b |
--- openssh-5.3p1/auth.c.audit 2008-11-05 06:12:54.000000000 +0100
|
|
|
ecd50fd |
+++ openssh-5.3p1/auth.c 2009-12-21 08:50:12.000000000 +0100
|
|
|
2ed3f9b |
@@ -287,6 +287,12 @@ auth_log(Authctxt *authctxt, int authent
|
|
|
2ed3f9b |
get_canonical_hostname(options.use_dns), "ssh", &loginmsg);
|
|
|
2ed3f9b |
# endif
|
|
|
2ed3f9b |
#endif
|
|
|
2ed3f9b |
+#if HAVE_LINUX_AUDIT
|
|
|
ecd50fd |
+ if (authenticated == 0 && !authctxt->postponed) {
|
|
|
ecd50fd |
+ linux_audit_record_event(-1, authctxt->user, NULL,
|
|
|
ecd50fd |
+ get_remote_ipaddr(), "sshd", 0);
|
|
|
ecd50fd |
+ }
|
|
|
2ed3f9b |
+#endif
|
|
|
2ed3f9b |
#ifdef SSH_AUDIT_EVENTS
|
|
|
2ed3f9b |
if (authenticated == 0 && !authctxt->postponed)
|
|
|
2ed3f9b |
audit_event(audit_classify_auth(method));
|
|
|
2ed3f9b |
@@ -533,6 +539,10 @@ getpwnamallow(const char *user)
|
|
|
2ed3f9b |
record_failed_login(user,
|
|
|
2ed3f9b |
get_canonical_hostname(options.use_dns), "ssh");
|
|
|
2ed3f9b |
#endif
|
|
|
2ed3f9b |
+#ifdef HAVE_LINUX_AUDIT
|
|
|
ecd50fd |
+ linux_audit_record_event(-1, user, NULL, get_remote_ipaddr(),
|
|
|
ecd50fd |
+ "sshd", 0);
|
|
|
2ed3f9b |
+#endif
|
|
|
2ed3f9b |
#ifdef SSH_AUDIT_EVENTS
|
|
|
2ed3f9b |
audit_event(SSH_INVALID_USER);
|
|
|
2ed3f9b |
#endif /* SSH_AUDIT_EVENTS */
|
|
|
2ed3f9b |
diff -up openssh-5.3p1/configure.ac.audit openssh-5.3p1/configure.ac
|
|
|
ecd50fd |
--- openssh-5.3p1/configure.ac.audit 2009-12-21 08:48:59.000000000 +0100
|
|
|
ecd50fd |
+++ openssh-5.3p1/configure.ac 2009-12-21 08:51:47.000000000 +0100
|
|
|
ecd50fd |
@@ -3409,6 +3409,18 @@ AC_ARG_WITH(selinux,
|
|
|
2ed3f9b |
fi ]
|
|
|
2ed3f9b |
)
|
|
|
2ed3f9b |
|
|
|
2ed3f9b |
+# Check whether user wants Linux audit support
|
|
|
2ed3f9b |
+LINUX_AUDIT_MSG="no"
|
|
|
2ed3f9b |
+AC_ARG_WITH(linux-audit,
|
|
|
ecd50fd |
+ [ --with-linux-audit Enable Linux audit support],
|
|
|
ecd50fd |
+ [ if test "x$withval" != "xno" ; then
|
|
|
ecd50fd |
+ AC_DEFINE(HAVE_LINUX_AUDIT,1,[Define if you want Linux audit support.])
|
|
|
ecd50fd |
+ LINUX_AUDIT_MSG="yes"
|
|
|
ecd50fd |
+ AC_CHECK_HEADERS(libaudit.h)
|
|
|
ecd50fd |
+ SSHDLIBS="$SSHDLIBS -laudit"
|
|
|
ecd50fd |
+ fi ]
|
|
|
2ed3f9b |
+)
|
|
|
2ed3f9b |
+
|
|
|
2ed3f9b |
# Check whether user wants Kerberos 5 support
|
|
|
2ed3f9b |
KRB5_MSG="no"
|
|
|
2ed3f9b |
AC_ARG_WITH(kerberos5,
|
|
|
ecd50fd |
@@ -4234,6 +4246,7 @@ echo " PAM support
|
|
|
2ed3f9b |
echo " OSF SIA support: $SIA_MSG"
|
|
|
2ed3f9b |
echo " KerberosV support: $KRB5_MSG"
|
|
|
2ed3f9b |
echo " SELinux support: $SELINUX_MSG"
|
|
|
2ed3f9b |
+echo " Linux audit support: $LINUX_AUDIT_MSG"
|
|
|
2ed3f9b |
echo " Smartcard support: $SCARD_MSG"
|
|
|
2ed3f9b |
echo " S/KEY support: $SKEY_MSG"
|
|
|
2ed3f9b |
echo " TCP Wrappers support: $TCPW_MSG"
|
|
|
2ed3f9b |
diff -up openssh-5.3p1/loginrec.c.audit openssh-5.3p1/loginrec.c
|
|
|
2ed3f9b |
--- openssh-5.3p1/loginrec.c.audit 2009-02-12 03:12:22.000000000 +0100
|
|
|
ecd50fd |
+++ openssh-5.3p1/loginrec.c 2009-12-21 08:54:17.000000000 +0100
|
|
|
2ed3f9b |
@@ -176,6 +176,10 @@
|
|
|
2ed3f9b |
#include "auth.h"
|
|
|
2ed3f9b |
#include "buffer.h"
|
|
|
2ed3f9b |
|
|
|
2ed3f9b |
+#ifdef HAVE_LINUX_AUDIT
|
|
|
2ed3f9b |
+# include <libaudit.h>
|
|
|
2ed3f9b |
+#endif
|
|
|
2ed3f9b |
+
|
|
|
2ed3f9b |
#ifdef HAVE_UTIL_H
|
|
|
2ed3f9b |
# include <util.h>
|
|
|
2ed3f9b |
#endif
|
|
|
2ed3f9b |
@@ -202,6 +206,9 @@ int utmp_write_entry(struct logininfo *l
|
|
|
2ed3f9b |
int utmpx_write_entry(struct logininfo *li);
|
|
|
2ed3f9b |
int wtmp_write_entry(struct logininfo *li);
|
|
|
2ed3f9b |
int wtmpx_write_entry(struct logininfo *li);
|
|
|
2ed3f9b |
+#ifdef HAVE_LINUX_AUDIT
|
|
|
2ed3f9b |
+int linux_audit_write_entry(struct logininfo *li);
|
|
|
2ed3f9b |
+#endif
|
|
|
2ed3f9b |
int lastlog_write_entry(struct logininfo *li);
|
|
|
2ed3f9b |
int syslogin_write_entry(struct logininfo *li);
|
|
|
2ed3f9b |
|
|
|
2ed3f9b |
@@ -440,6 +447,10 @@ login_write(struct logininfo *li)
|
|
|
2ed3f9b |
|
|
|
2ed3f9b |
/* set the timestamp */
|
|
|
2ed3f9b |
login_set_current_time(li);
|
|
|
2ed3f9b |
+#ifdef HAVE_LINUX_AUDIT
|
|
|
ecd50fd |
+ if (linux_audit_write_entry(li) == 0)
|
|
|
ecd50fd |
+ fatal("linux_audit_write_entry failed: %s", strerror(errno));
|
|
|
2ed3f9b |
+#endif
|
|
|
2ed3f9b |
#ifdef USE_LOGIN
|
|
|
2ed3f9b |
syslogin_write_entry(li);
|
|
|
2ed3f9b |
#endif
|
|
|
ecd50fd |
@@ -1394,6 +1405,47 @@ wtmpx_get_entry(struct logininfo *li)
|
|
|
2ed3f9b |
}
|
|
|
2ed3f9b |
#endif /* USE_WTMPX */
|
|
|
2ed3f9b |
|
|
|
2ed3f9b |
+#ifdef HAVE_LINUX_AUDIT
|
|
|
2ed3f9b |
+int
|
|
|
2ed3f9b |
+linux_audit_record_event(int uid, const char *username,
|
|
|
ecd50fd |
+ const char *hostname, const char *ip, const char *ttyn, int success)
|
|
|
2ed3f9b |
+{
|
|
|
ecd50fd |
+ int audit_fd, rc;
|
|
|
2ed3f9b |
+
|
|
|
ecd50fd |
+ audit_fd = audit_open();
|
|
|
ecd50fd |
+ if (audit_fd < 0) {
|
|
|
ecd50fd |
+ if (errno == EINVAL || errno == EPROTONOSUPPORT ||
|
|
|
ecd50fd |
+ errno == EAFNOSUPPORT)
|
|
|
ecd50fd |
+ return 1; /* No audit support in kernel */
|
|
|
ecd50fd |
+ else
|
|
|
ecd50fd |
+ return 0; /* Must prevent login */
|
|
|
ecd50fd |
+ }
|
|
|
ecd50fd |
+ rc = audit_log_acct_message(audit_fd, AUDIT_USER_LOGIN,
|
|
|
ecd50fd |
+ NULL, "login", username ? username : "(unknown)",
|
|
|
ecd50fd |
+ username == NULL ? uid : -1, hostname, ip, ttyn, success);
|
|
|
ecd50fd |
+ close(audit_fd);
|
|
|
ecd50fd |
+ if (rc >= 0)
|
|
|
ecd50fd |
+ return 1;
|
|
|
ecd50fd |
+ else
|
|
|
ecd50fd |
+ return 0;
|
|
|
2ed3f9b |
+}
|
|
|
2ed3f9b |
+
|
|
|
2ed3f9b |
+int
|
|
|
2ed3f9b |
+linux_audit_write_entry(struct logininfo *li)
|
|
|
2ed3f9b |
+{
|
|
|
ecd50fd |
+ switch(li->type) {
|
|
|
ecd50fd |
+ case LTYPE_LOGIN:
|
|
|
ecd50fd |
+ return (linux_audit_record_event(li->uid, NULL, li->hostname,
|
|
|
ecd50fd |
+ NULL, li->line, 1));
|
|
|
ecd50fd |
+ case LTYPE_LOGOUT:
|
|
|
ecd50fd |
+ return (1); /* We only care about logins */
|
|
|
ecd50fd |
+ default:
|
|
|
ecd50fd |
+ logit("%s: invalid type field", __func__);
|
|
|
ecd50fd |
+ return (0);
|
|
|
ecd50fd |
+ }
|
|
|
2ed3f9b |
+}
|
|
|
2ed3f9b |
+#endif /* HAVE_LINUX_AUDIT */
|
|
|
2ed3f9b |
+
|
|
|
2ed3f9b |
/**
|
|
|
2ed3f9b |
** Low-level libutil login() functions
|
|
|
2ed3f9b |
**/
|
|
|
2ed3f9b |
diff -up openssh-5.3p1/loginrec.h.audit openssh-5.3p1/loginrec.h
|
|
|
2ed3f9b |
--- openssh-5.3p1/loginrec.h.audit 2006-08-05 04:39:40.000000000 +0200
|
|
|
ecd50fd |
+++ openssh-5.3p1/loginrec.h 2009-12-21 08:48:59.000000000 +0100
|
|
|
2ed3f9b |
@@ -127,5 +127,9 @@ char *line_stripname(char *dst, const ch
|
|
|
2ed3f9b |
char *line_abbrevname(char *dst, const char *src, int dstsize);
|
|
|
2ed3f9b |
|
|
|
2ed3f9b |
void record_failed_login(const char *, const char *, const char *);
|
|
|
2ed3f9b |
+#ifdef HAVE_LINUX_AUDIT
|
|
|
2ed3f9b |
+int linux_audit_record_event(int uid, const char *username,
|
|
|
ecd50fd |
+ const char *hostname, const char *ip, const char *ttyn, int success);
|
|
|
2ed3f9b |
+#endif /* HAVE_LINUX_AUDIT */
|
|
|
2ed3f9b |
|
|
|
2ed3f9b |
#endif /* _HAVE_LOGINREC_H_ */
|