diff -up openssh-7.4p1/audit-bsm.c.audit openssh-7.4p1/audit-bsm.c

--- openssh-7.4p1/audit-bsm.c.audit	2016-12-19 05:59:41.000000000 +0100

+++ openssh-7.4p1/audit-bsm.c	2016-12-23 18:54:54.433080419 +0100

@@ -373,10 +373,23 @@ audit_connection_from(const char *host,

 #endif

 }

-void

+int

 audit_run_command(const char *command)

 {

 	/* not implemented */

+	return 0;

+}

+

+void

+audit_end_command(int handle, const char *command)

+{

+	/* not implemented */

+}

+

+void

+audit_count_session_open(void)

+{

+	/* not necessary */

 }

 void

@@ -391,6 +404,12 @@ audit_session_close(struct logininfo *li

 	/* not implemented */

 }

+int

+audit_keyusage(int host_user, const char *type, unsigned bits, char *fp, int rv)

+{

+	/* not implemented */

+}

+

 void

 audit_event(ssh_audit_event_t event)

 {

@@ -452,4 +471,40 @@ audit_event(ssh_audit_event_t event)

 		debug("%s: unhandled event %d", __func__, event);

 	}

 }

+

+void

+audit_unsupported_body(int what)

+{

+	/* not implemented */

+}

+

+void

+audit_kex_body(int ctos, char *enc, char *mac, char *compress, char *pfs, pid_t pid, uid_t uid)

+{

+	/* not implemented */

+}

+

+void

+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)

+{

+	/* not implemented */

+}

+

+void

+audit_destroy_sensitive_data(const char *fp)

+{

+	/* not implemented */

+}

+

+void

+audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)

+{

+	/* not implemented */

+}

+

+void

+audit_generate_ephemeral_server_key(const char *fp)

+{

+	/* not implemented */

+}

 #endif /* BSM */

diff -up openssh-7.4p1/audit.c.audit openssh-7.4p1/audit.c

--- openssh-7.4p1/audit.c.audit	2016-12-19 05:59:41.000000000 +0100

+++ openssh-7.4p1/audit.c	2016-12-23 18:54:54.433080419 +0100

@@ -26,6 +26,7 @@

 #include <stdarg.h>

 #include <string.h>

+#include <unistd.h>

 #ifdef SSH_AUDIT_EVENTS

@@ -34,6 +35,11 @@

 #include "key.h"

 #include "hostfile.h"

 #include "auth.h"

+#include "ssh-gss.h"

+#include "monitor_wrap.h"

+#include "xmalloc.h"

+#include "misc.h"

+#include "servconf.h"

 /*

  * Care must be taken when using this since it WILL NOT be initialized when

@@ -41,6 +47,7 @@

  * audit_event(CONNECTION_ABANDON) is called.  Test for NULL before using.

  */

 extern Authctxt *the_authctxt;

+extern ServerOptions options;

 /* Maybe add the audit class to struct Authmethod? */

 ssh_audit_event_t

@@ -69,13 +76,10 @@ audit_classify_auth(const char *method)

 const char *

 audit_username(void)

 {

-	static const char unknownuser[] = "(unknown user)";

-	static const char invaliduser[] = "(invalid user)";

+	static const char unknownuser[] = "(unknown)";

-	if (the_authctxt == NULL || the_authctxt->user == NULL)

+	if (the_authctxt == NULL || the_authctxt->user == NULL || !the_authctxt->valid)

 		return (unknownuser);

-	if (!the_authctxt->valid)

-		return (invaliduser);

 	return (the_authctxt->user);

 }

@@ -109,6 +113,40 @@ audit_event_lookup(ssh_audit_event_t ev)

 	return(event_lookup[i].name);

 }

+void

+audit_key(int host_user, int *rv, const Key *key)

+{

+	char *fp;

+	const char *crypto_name;

+

+	fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX);

+	if (key->type == KEY_RSA1)

+		crypto_name = "ssh-rsa1";

+	else

+		crypto_name = key_ssh_name(key);

+	if (audit_keyusage(host_user, crypto_name, key_size(key), fp, *rv) == 0)

+		*rv = 0;

+	free(fp);

+}

+

+void

+audit_unsupported(int what)

+{

+	PRIVSEP(audit_unsupported_body(what));

+}

+

+void

+audit_kex(int ctos, char *enc, char *mac, char *comp, char *pfs)

+{

+	PRIVSEP(audit_kex_body(ctos, enc, mac, comp, pfs, getpid(), getuid()));

+}

+

+void

+audit_session_key_free(int ctos)

+{

+	PRIVSEP(audit_session_key_free_body(ctos, getpid(), getuid()));

+}

+

 # ifndef CUSTOM_SSH_AUDIT_EVENTS

 /*

  * Null implementations of audit functions.

@@ -138,6 +176,17 @@ audit_event(ssh_audit_event_t event)

 }

 /*

+ * Called when a child process has called, or will soon call,

+ * audit_session_open.

+ */

+void

+audit_count_session_open(void)

+{

+	debug("audit count session open euid %d user %s", geteuid(),

+	      audit_username());

+}

+

+/*

  * Called when a user session is started.  Argument is the tty allocated to

  * the session, or NULL if no tty was allocated.

  *

@@ -172,13 +221,91 @@ audit_session_close(struct logininfo *li

 /*

  * This will be called when a user runs a non-interactive command.  Note that

  * it may be called multiple times for a single connection since SSH2 allows

- * multiple sessions within a single connection.

+ * multiple sessions within a single connection.  Returns a "handle" for

+ * audit_end_command.

  */

-void

+int

 audit_run_command(const char *command)

 {

 	debug("audit run command euid %d user %s command '%.200s'", geteuid(),

 	    audit_username(), command);

+	return 0;

+}

+

+/*

+ * This will be called when the non-interactive command finishes.  Note that

+ * it may be called multiple times for a single connection since SSH2 allows

+ * multiple sessions within a single connection.  "handle" should come from

+ * the corresponding audit_run_command.

+ */

+void

+audit_end_command(int handle, const char *command)

+{

+	debug("audit end nopty exec  euid %d user %s command '%.200s'", geteuid(),

+	    audit_username(), command);

+}

+

+/*

+ * This will be called when user is successfully autherized by the RSA1/RSA/DSA key.

+ *

+ * Type is the key type, len is the key length(byte) and fp is the fingerprint of the key.

+ */

+int

+audit_keyusage(int host_user, const char *type, unsigned bits, char *fp, int rv)

+{

+	debug("audit %s key usage euid %d user %s key type %s key length %d fingerprint %s, result %d",

+		host_user ? "pubkey" : "hostbased", geteuid(), audit_username(), type, bits,

+		fp, rv);

+}

+

+/*

+ * This will be called when the protocol negotiation fails.

+ */

+void

+audit_unsupported_body(int what)

+{

+	debug("audit unsupported protocol euid %d type %d", geteuid(), what);

+}

+

+/*

+ * This will be called on succesfull protocol negotiation.

+ */

+void

+audit_kex_body(int ctos, char *enc, char *mac, char *compress, char *pfs, pid_t pid,

+	       uid_t uid)

+{

+	debug("audit protocol negotiation euid %d direction %d cipher %s mac %s compresion %s pfs %s from pid %ld uid %u",

+		(unsigned)geteuid(), ctos, enc, mac, compress, pfs, (long)pid,

+	        (unsigned)uid);

+}

+

+/*

+ * This will be called on succesfull session key discard

+ */

+void

+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)

+{

+	debug("audit session key discard euid %u direction %d from pid %ld uid %u",

+		(unsigned)geteuid(), ctos, (long)pid, (unsigned)uid);

+}

+

+/*

+ * This will be called on destroy private part of the server key

+ */

+void

+audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)

+{

+	debug("audit destroy sensitive data euid %d fingerprint %s from pid %ld uid %u",

+		geteuid(), fp, (long)pid, (unsigned)uid);

+}

+

+/*

+ * This will be called on generation of the ephemeral server key

+ */

+void

+audit_generate_ephemeral_server_key(const char *)

+{

+	debug("audit create ephemeral server key euid %d fingerprint %s", geteuid(), fp);

 }

 # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */

 #endif /* SSH_AUDIT_EVENTS */

diff -up openssh-7.4p1/audit.h.audit openssh-7.4p1/audit.h

--- openssh-7.4p1/audit.h.audit	2016-12-19 05:59:41.000000000 +0100

+++ openssh-7.4p1/audit.h	2016-12-23 18:54:54.433080419 +0100

@@ -26,6 +26,7 @@

 # define _SSH_AUDIT_H

 #include "loginrec.h"

+#include "key.h"

 enum ssh_audit_event_type {

 	SSH_LOGIN_EXCEED_MAXTRIES,

@@ -43,13 +44,33 @@ enum ssh_audit_event_type {

 	SSH_CONNECTION_ABANDON,	/* closed without completing auth */

 	SSH_AUDIT_UNKNOWN

 };

+

+enum ssh_audit_kex {

+	SSH_AUDIT_UNSUPPORTED_CIPHER,

+	SSH_AUDIT_UNSUPPORTED_MAC,

+	SSH_AUDIT_UNSUPPORTED_COMPRESSION

+};

 typedef enum ssh_audit_event_type ssh_audit_event_t;

+int	listening_for_clients(void);

+

 void	audit_connection_from(const char *, int);

 void	audit_event(ssh_audit_event_t);

+void	audit_count_session_open(void);

 void	audit_session_open(struct logininfo *);

 void	audit_session_close(struct logininfo *);

-void	audit_run_command(const char *);

+int	audit_run_command(const char *);

+void 	audit_end_command(int, const char *);

 ssh_audit_event_t audit_classify_auth(const char *);

+int	audit_keyusage(int, const char *, unsigned, char *, int);

+void	audit_key(int, int *, const Key *);

+void	audit_unsupported(int);

+void	audit_kex(int, char *, char *, char *, char *);

+void	audit_unsupported_body(int);

+void	audit_kex_body(int, char *, char *, char *, char *, pid_t, uid_t);

+void	audit_session_key_free(int ctos);

+void	audit_session_key_free_body(int ctos, pid_t, uid_t);

+void	audit_destroy_sensitive_data(const char *, pid_t, uid_t);

+void	audit_generate_ephemeral_server_key(const char *);

 #endif /* _SSH_AUDIT_H */

diff -up openssh-7.4p1/audit-linux.c.audit openssh-7.4p1/audit-linux.c

--- openssh-7.4p1/audit-linux.c.audit	2016-12-19 05:59:41.000000000 +0100

+++ openssh-7.4p1/audit-linux.c	2016-12-23 18:54:54.434080419 +0100

@@ -33,25 +33,38 @@

 #include "log.h"

 #include "audit.h"

+#include "key.h"

+#include "hostfile.h"

+#include "auth.h"

+#include "misc.h"      /* servconf.h needs misc.h for struct ForwardOptions */

+#include "servconf.h"

 #include "canohost.h"

 #include "packet.h"

-

+#include "cipher.h"

+#include "channels.h"

+#include "session.h"

+

+#define AUDIT_LOG_SIZE 256

+

+extern ServerOptions options;

+extern Authctxt *the_authctxt;

+extern u_int utmp_len;

 const char *audit_username(void);

-int

-linux_audit_record_event(int uid, const char *username, const char *hostname,

-    const char *ip, const char *ttyn, int success)

+static void

+linux_audit_user_logxxx(int uid, const char *username, const char *hostname,

+    const char *ip, const char *ttyn, int success, int event)

 {

 	int audit_fd, rc, saved_errno;

 	if ((audit_fd = audit_open()) < 0) {

 		if (errno == EINVAL || errno == EPROTONOSUPPORT ||

 		    errno == EAFNOSUPPORT)

-			return 1; /* No audit support in kernel */

+			return; /* No audit support in kernel */

 		else

-			return 0; /* Must prevent login */

+			goto fatal_report; /* Must prevent login */

 	}

-	rc = audit_log_acct_message(audit_fd, AUDIT_USER_LOGIN,

+	rc = audit_log_acct_message(audit_fd, event,

 	    NULL, "login", username ? username : "(unknown)",

 	    username == NULL ? uid : -1, hostname, ip, ttyn, success);

 	saved_errno = errno;

@@ -65,9 +78,97 @@ linux_audit_record_event(int uid, const

 		rc = 0;

 	errno = saved_errno;

-	return rc >= 0;

+	if (rc < 0) {

+fatal_report:

+		fatal("linux_audit_write_entry failed: %s", strerror(errno));

+	}

+}

+

+static void

+linux_audit_user_auth(int uid, const char *username,

+    const char *hostname, const char *ip, const char *ttyn, int success, int event)

+{

+	int audit_fd, rc, saved_errno;

+	static const char *event_name[] = {

+		"maxtries exceeded",

+		"root denied",

+		"success",

+		"none",

+		"password",

+		"challenge-response",

+		"pubkey",

+		"hostbased",

+		"gssapi",

+		"invalid user",

+		"nologin",

+		"connection closed",

+		"connection abandoned",

+		"unknown"

+	};

+

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||

+		    errno == EAFNOSUPPORT)

+			return; /* No audit support in kernel */

+		else

+			goto fatal_report; /* Must prevent login */

+	}

+

+	if ((event < 0) || (event > SSH_AUDIT_UNKNOWN))

+		event = SSH_AUDIT_UNKNOWN;

+

+	rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH,

+	    NULL, event_name[event], username ? username : "(unknown)",

+	    username == NULL ? uid : -1, hostname, ip, ttyn, success);

+	saved_errno = errno;

+	close(audit_fd);

+	/*

+	 * Do not report error if the error is EPERM and sshd is run as non

+	 * root user.

+	 */

+	if ((rc == -EPERM) && (geteuid() != 0))

+		rc = 0;

+	errno = saved_errno;

+	if (rc < 0) {

+fatal_report:

+		fatal("linux_audit_write_entry failed: %s", strerror(errno));

+	}

+}

+

+int

+audit_keyusage(int host_user, const char *type, unsigned bits, char *fp, int rv)

+{

+	char buf[AUDIT_LOG_SIZE];

+	int audit_fd, rc, saved_errno;

+

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||

+					 errno == EAFNOSUPPORT)

+			return 1; /* No audit support in kernel */

+		else

+			return 0; /* Must prevent login */

+	}

+	snprintf(buf, sizeof(buf), "%s_auth rport=%d", host_user ? "pubkey" : "hostbased", ssh_remote_port(active_state));

+	rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL,

+		buf, audit_username(), -1, NULL, ssh_remote_ipaddr(active_state), NULL, rv);

+	if ((rc < 0) && ((rc != -1) || (getuid() == 0)))

+		goto out;

+	snprintf(buf, sizeof(buf), "key algo=%s size=%d fp=%s rport=%d",

+			type, bits, fp, ssh_remote_port(active_state));

+	rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL,

+		buf, audit_username(), -1, NULL, ssh_remote_ipaddr(active_state), NULL, rv);

+out:

+	saved_errno = errno;

+	audit_close(audit_fd);

+	errno = saved_errno;

+	/* do not report error if the error is EPERM and sshd is run as non root user */

+	return (rc >= 0) || ((rc == -EPERM) && (getuid() != 0));

 }

+static int user_login_count = 0;

+

 /* Below is the sshd audit API code */

 void

@@ -76,24 +177,51 @@ audit_connection_from(const char *host,

 	/* not implemented */

 }

-void

+int

 audit_run_command(const char *command)

 {

-	/* not implemented */

+	if (!user_login_count++)

+		linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, session_get_remote_name_or_ip(active_state, utmp_len, options.use_dns),

+		    NULL, "ssh", 1, AUDIT_USER_LOGIN);

+	linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, session_get_remote_name_or_ip(active_state, utmp_len, options.use_dns),

+	    NULL, "ssh", 1, AUDIT_USER_START);

+	return 0;

+}

+

+void

+audit_end_command(int handle, const char *command)

+{

+	linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, session_get_remote_name_or_ip(active_state, utmp_len, options.use_dns),

+	    NULL, "ssh", 1, AUDIT_USER_END);

+	if (user_login_count && !--user_login_count)

+		linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, session_get_remote_name_or_ip(active_state, utmp_len, options.use_dns),

+		    NULL, "ssh", 1, AUDIT_USER_LOGOUT);

+}

+

+void

+audit_count_session_open(void)

+{

+	user_login_count++;

 }

 void

 audit_session_open(struct logininfo *li)

 {

-	if (linux_audit_record_event(li->uid, NULL, li->hostname, NULL,

-	    li->line, 1) == 0)

-		fatal("linux_audit_write_entry failed: %s", strerror(errno));

+	if (!user_login_count++)

+		linux_audit_user_logxxx(li->uid, NULL, li->hostname,

+		    NULL, li->line, 1, AUDIT_USER_LOGIN);

+	linux_audit_user_logxxx(li->uid, NULL, li->hostname,

+	    NULL, li->line, 1, AUDIT_USER_START);

 }

 void

 audit_session_close(struct logininfo *li)

 {

-	/* not implemented */

+	linux_audit_user_logxxx(li->uid, NULL, li->hostname,

+	    NULL, li->line, 1, AUDIT_USER_END);

+	if (user_login_count && !--user_login_count)

+		linux_audit_user_logxxx(li->uid, NULL, li->hostname,

+		    NULL, li->line, 1, AUDIT_USER_LOGOUT);

 }

 void

@@ -103,24 +231,180 @@ audit_event(ssh_audit_event_t event)

 	switch(event) {

 	case SSH_AUTH_SUCCESS:

-	case SSH_CONNECTION_CLOSE:

+		linux_audit_user_auth(-1, audit_username(), NULL,

+			ssh_remote_ipaddr(ssh), "ssh", 1, event);

+		break;

+

 	case SSH_NOLOGIN:

-	case SSH_LOGIN_EXCEED_MAXTRIES:

 	case SSH_LOGIN_ROOT_DENIED:

+		linux_audit_user_auth(-1, audit_username(), NULL,

+			ssh_remote_ipaddr(ssh), "ssh", 0, event);

+		linux_audit_user_logxxx(-1, audit_username(), NULL,

+			ssh_remote_ipaddr(ssh), "ssh", 0, AUDIT_USER_LOGIN);

 		break;

+	case SSH_LOGIN_EXCEED_MAXTRIES:

 	case SSH_AUTH_FAIL_NONE:

 	case SSH_AUTH_FAIL_PASSWD:

 	case SSH_AUTH_FAIL_KBDINT:

 	case SSH_AUTH_FAIL_PUBKEY:

 	case SSH_AUTH_FAIL_HOSTBASED:

 	case SSH_AUTH_FAIL_GSSAPI:

+		linux_audit_user_auth(-1, audit_username(), NULL,

+			ssh_remote_ipaddr(ssh), "ssh", 0, event);

+		break;

+

+	case SSH_CONNECTION_CLOSE:

+		if (user_login_count) {

+			while (user_login_count--)

+				linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,

+				    session_get_remote_name_or_ip(ssh, utmp_len, options.use_dns),

+				    NULL, "ssh", 1, AUDIT_USER_END);

+			linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,

+			    session_get_remote_name_or_ip(ssh, utmp_len, options.use_dns),

+			    NULL, "ssh", 1, AUDIT_USER_LOGOUT);

+		}

+		break;

+

+	case SSH_CONNECTION_ABANDON:

 	case SSH_INVALID_USER:

-		linux_audit_record_event(-1, audit_username(), NULL,

-		    ssh_remote_ipaddr(ssh), "sshd", 0);

+		linux_audit_user_logxxx(-1, audit_username(), NULL,

+			ssh_remote_ipaddr(ssh), "ssh", 0, AUDIT_USER_LOGIN);

 		break;

 	default:

 		debug("%s: unhandled event %d", __func__, event);

 		break;

 	}

 }

+

+void

+audit_unsupported_body(int what)

+{

+#ifdef AUDIT_CRYPTO_SESSION

+	char buf[AUDIT_LOG_SIZE];

+	const static char *name[] = { "cipher", "mac", "comp" };

+	char *s;

+	int audit_fd;

+

+	snprintf(buf, sizeof(buf), "op=unsupported-%s direction=? cipher=? ksize=? rport=%d laddr=%s lport=%d ",

+		name[what], ssh_remote_port(active_state), (s = get_local_ipaddr(packet_get_connection_in())),

+		ssh_local_port(active_state));

+	free(s);

+	audit_fd = audit_open();

+	if (audit_fd < 0)

+		/* no problem, the next instruction will be fatal() */

+		return;

+	audit_log_user_message(audit_fd, AUDIT_CRYPTO_SESSION,

+			buf, NULL, ssh_remote_ipaddr(active_state), NULL, 0);

+	audit_close(audit_fd);

+#endif

+}

+

+const static char *direction[] = { "from-server", "from-client", "both" };

+

+void

+audit_kex_body(int ctos, char *enc, char *mac, char *compress, char *pfs, pid_t pid,

+	       uid_t uid)

+{

+#ifdef AUDIT_CRYPTO_SESSION

+	char buf[AUDIT_LOG_SIZE];

+	int audit_fd, audit_ok;

+	const struct sshcipher *cipher = cipher_by_name(enc);

+	char *s;

+

+	snprintf(buf, sizeof(buf), "op=start direction=%s cipher=%s ksize=%d mac=%s pfs=%s spid=%jd suid=%jd rport=%d laddr=%s lport=%d ",

+		direction[ctos], enc, cipher ? 8 * cipher->key_len : 0, mac, pfs,

+		(intmax_t)pid, (intmax_t)uid,

+		ssh_remote_port(active_state), (s = get_local_ipaddr(packet_get_connection_in())), ssh_local_port(active_state));

+	free(s);

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||

+					 errno == EAFNOSUPPORT)

+			return; /* No audit support in kernel */

+		else

+			fatal("cannot open audit"); /* Must prevent login */

+	}

+	audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_SESSION,

+			buf, NULL, ssh_remote_ipaddr(active_state), NULL, 1);

+	audit_close(audit_fd);

+	/* do not abort if the error is EPERM and sshd is run as non root user */

+	if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))

+		fatal("cannot write into audit"); /* Must prevent login */

+#endif

+}

+

+void

+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)

+{

+	char buf[AUDIT_LOG_SIZE];

+	int audit_fd, audit_ok;

+	char *s;

+

+	snprintf(buf, sizeof(buf), "op=destroy kind=session fp=? direction=%s spid=%jd suid=%jd rport=%d laddr=%s lport=%d ",

+		 direction[ctos], (intmax_t)pid, (intmax_t)uid,

+		 ssh_remote_port(active_state),

+		 (s = get_local_ipaddr(packet_get_connection_in())),

+		 ssh_local_port(active_state));

+	free(s);

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno != EINVAL && errno != EPROTONOSUPPORT &&

+					 errno != EAFNOSUPPORT)

+			error("cannot open audit");

+		return;

+	}

+	audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,

+			buf, NULL, ssh_remote_ipaddr(active_state), NULL, 1);

+	audit_close(audit_fd);

+	/* do not abort if the error is EPERM and sshd is run as non root user */

+	if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))

+		error("cannot write into audit");

+}

+

+void

+audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)

+{

+	char buf[AUDIT_LOG_SIZE];

+	int audit_fd, audit_ok;

+

+	snprintf(buf, sizeof(buf), "op=destroy kind=server fp=%s direction=? spid=%jd suid=%jd ",

+		fp, (intmax_t)pid, (intmax_t)uid);

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno != EINVAL && errno != EPROTONOSUPPORT &&

+					 errno != EAFNOSUPPORT)

+			error("cannot open audit");

+		return;

+	}

+	audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,

+			buf, NULL,

+			listening_for_clients() ? NULL : ssh_remote_ipaddr(active_state),

+			NULL, 1);

+	audit_close(audit_fd);

+	/* do not abort if the error is EPERM and sshd is run as non root user */

+	if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))

+		error("cannot write into audit");

+}

+

+void

+audit_generate_ephemeral_server_key(const char *fp)

+{

+	char buf[AUDIT_LOG_SIZE];

+	int audit_fd, audit_ok;

+

+	snprintf(buf, sizeof(buf), "op=create kind=server fp=%s direction=? ", fp);

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno != EINVAL && errno != EPROTONOSUPPORT &&

+					 errno != EAFNOSUPPORT)

+			error("cannot open audit");

+		return;

+	}

+	audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,

+			buf, NULL, 0, NULL, 1);

+	audit_close(audit_fd);

+	/* do not abort if the error is EPERM and sshd is run as non root user */