You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
247 lines
8.7 KiB
247 lines
8.7 KiB
2 months ago
|
diff -up openssh-9.0p1/audit-bsm.c.patch openssh-9.0p1/audit-bsm.c
|
||
|
|
--- openssh-9.0p1/audit-bsm.c.patch 2022-10-24 15:02:16.544858331 +0200
|
||
|
|
+++ openssh-9.0p1/audit-bsm.c 2022-10-24 14:51:43.685766639 +0200
|
||
|
|
@@ -405,7 +405,7 @@ audit_session_close(struct logininfo *li
|
||
|
|
}
|
||
|
|
|
||
|
|
int
|
||
|
|
-audit_keyusage(struct ssh *ssh, int host_user, char *fp, int rv)
|
||
|
|
+audit_keyusage(struct ssh *ssh, int host_user, char *key_fp, const struct sshkey_cert *cert, const char *issuer_fp, int rv)
|
||
|
|
{
|
||
|
|
/* not implemented */
|
||
|
|
}
|
||
|
|
diff -up openssh-9.0p1/audit.c.patch openssh-9.0p1/audit.c
|
||
|
|
--- openssh-9.0p1/audit.c.patch 2022-10-24 15:02:16.544858331 +0200
|
||
|
|
+++ openssh-9.0p1/audit.c 2022-10-24 15:20:38.854548226 +0200
|
||
|
|
@@ -116,12 +116,22 @@ audit_event_lookup(ssh_audit_event_t ev)
|
||
|
|
void
|
||
|
|
audit_key(struct ssh *ssh, int host_user, int *rv, const struct sshkey *key)
|
||
|
|
{
|
||
|
|
- char *fp;
|
||
|
|
+ char *key_fp = NULL;
|
||
|
|
+ char *issuer_fp = NULL;
|
||
|
|
+ struct sshkey_cert *cert = NULL;
|
||
|
|
|
||
|
|
- fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX);
|
||
|
|
- if (audit_keyusage(ssh, host_user, fp, (*rv == 0)) == 0)
|
||
|
|
+ key_fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX);
|
||
|
|
+ if (sshkey_is_cert(key) && key->cert != NULL && key->cert->signature_key != NULL) {
|
||
|
|
+ cert = key->cert;
|
||
|
|
+ issuer_fp = sshkey_fingerprint(cert->signature_key,
|
||
|
|
+ options.fingerprint_hash, SSH_FP_DEFAULT);
|
||
|
|
+ }
|
||
|
|
+ if (audit_keyusage(ssh, host_user, key_fp, cert, issuer_fp, (*rv == 0)) == 0)
|
||
|
|
*rv = -SSH_ERR_INTERNAL_ERROR;
|
||
|
|
- free(fp);
|
||
|
|
+ if (key_fp)
|
||
|
|
+ free(key_fp);
|
||
|
|
+ if (issuer_fp)
|
||
|
|
+ free(issuer_fp);
|
||
|
|
}
|
||
|
|
|
||
|
|
void
|
||
|
|
diff -up openssh-9.0p1/audit.h.patch openssh-9.0p1/audit.h
|
||
|
|
--- openssh-9.0p1/audit.h.patch 2022-10-24 15:02:16.544858331 +0200
|
||
|
|
+++ openssh-9.0p1/audit.h 2022-10-24 14:58:20.887565518 +0200
|
||
|
|
@@ -64,7 +64,7 @@ void audit_session_close(struct logininf
|
||
|
|
int audit_run_command(struct ssh *, const char *);
|
||
|
|
void audit_end_command(struct ssh *, int, const char *);
|
||
|
|
ssh_audit_event_t audit_classify_auth(const char *);
|
||
|
|
-int audit_keyusage(struct ssh *, int, char *, int);
|
||
|
|
+int audit_keyusage(struct ssh *, int, const char *, const struct sshkey_cert *, const char *, int);
|
||
|
|
void audit_key(struct ssh *, int, int *, const struct sshkey *);
|
||
|
|
void audit_unsupported(struct ssh *, int);
|
||
|
|
void audit_kex(struct ssh *, int, char *, char *, char *, char *);
|
||
|
|
diff -up openssh-9.9p1/audit-linux.c.xxx openssh-9.9p1/audit-linux.c
|
||
|
|
--- openssh-9.9p1/audit-linux.c.xxx 2024-10-15 11:49:48.092151974 +0200
|
||
|
|
+++ openssh-9.9p1/audit-linux.c 2024-10-15 12:08:17.179158343 +0200
|
||
|
|
@@ -52,7 +52,7 @@ extern u_int utmp_len;
|
||
|
|
const char *audit_username(void);
|
||
|
|
|
||
|
|
static void
|
||
|
|
-linux_audit_user_logxxx(int uid, const char *username,
|
||
|
|
+linux_audit_user_logxxx(int uid, const char *username, const char *hostname,
|
||
|
|
const char *ip, const char *ttyn, int success, int event)
|
||
|
|
{
|
||
|
|
int audit_fd, rc, saved_errno;
|
||
|
|
@@ -66,7 +66,7 @@ linux_audit_user_logxxx(int uid, const c
|
||
|
|
}
|
||
|
|
rc = audit_log_acct_message(audit_fd, event,
|
||
|
|
NULL, "login", username ? username : "(unknown)",
|
||
|
|
- username == NULL ? uid : -1, NULL, ip, ttyn, success);
|
||
|
|
+ username == NULL ? uid : -1, hostname, ip, ttyn, success);
|
||
|
|
saved_errno = errno;
|
||
|
|
close(audit_fd);
|
||
|
|
|
||
|
|
@@ -137,10 +137,12 @@ fatal_report:
|
||
|
|
}
|
||
|
|
|
||
|
|
int
|
||
|
|
-audit_keyusage(struct ssh *ssh, int host_user, char *fp, int rv)
|
||
|
|
+audit_keyusage(struct ssh *ssh, int host_user, const char *key_fp, const struct sshkey_cert *cert, const char *issuer_fp, int rv)
|
||
|
|
{
|
||
|
|
char buf[AUDIT_LOG_SIZE];
|
||
|
|
int audit_fd, rc, saved_errno;
|
||
|
|
+ const char *rip;
|
||
|
|
+ u_int i;
|
||
|
|
|
||
|
|
audit_fd = audit_open();
|
||
|
|
if (audit_fd < 0) {
|
||
|
|
@@ -150,14 +152,44 @@ audit_keyusage(struct ssh *ssh, int host
|
||
|
|
else
|
||
|
|
return 0; /* Must prevent login */
|
||
|
|
}
|
||
|
|
+ rip = ssh_remote_ipaddr(ssh);
|
||
|
|
snprintf(buf, sizeof(buf), "%s_auth grantors=auth-key", host_user ? "pubkey" : "hostbased");
|
||
|
|
rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL,
|
||
|
|
- buf, audit_username(), -1, NULL, ssh_remote_ipaddr(ssh), NULL, rv);
|
||
|
|
+ buf, audit_username(), -1, NULL, rip, NULL, rv);
|
||
|
|
if ((rc < 0) && ((rc != -1) || (getuid() == 0)))
|
||
|
|
goto out;
|
||
|
|
- snprintf(buf, sizeof(buf), "op=negotiate kind=auth-key fp=%s", fp);
|
||
|
|
+ snprintf(buf, sizeof(buf), "op=negotiate kind=auth-key fp=%s", key_fp);
|
||
|
|
rc = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER, buf, NULL,
|
||
|
|
- ssh_remote_ipaddr(ssh), NULL, rv);
|
||
|
|
+ rip, NULL, rv);
|
||
|
|
+ if ((rc < 0) && ((rc != -1) || (getuid() == 0)))
|
||
|
|
+ goto out;
|
||
|
|
+
|
||
|
|
+ if (cert) {
|
||
|
|
+ char *pbuf;
|
||
|
|
+
|
||
|
|
+ pbuf = audit_encode_nv_string("key_id", cert->key_id, 0);
|
||
|
|
+ if (pbuf == NULL)
|
||
|
|
+ goto out;
|
||
|
|
+ snprintf(buf, sizeof(buf), "cert %s cert_serial=%llu cert_issuer_alg=\"%s\" cert_issuer_fp=\"%s\"",
|
||
|
|
+ pbuf, (unsigned long long)cert->serial, sshkey_type(cert->signature_key), issuer_fp);
|
||
|
|
+ free(pbuf);
|
||
|
|
+ rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL,
|
||
|
|
+ buf, audit_username(), -1, NULL, rip, NULL, rv);
|
||
|
|
+ if ((rc < 0) && ((rc != -1) || (getuid() == 0)))
|
||
|
|
+ goto out;
|
||
|
|
+
|
||
|
|
+ for (i = 0; cert->principals != NULL && i < cert->nprincipals; i++) {
|
||
|
|
+ pbuf = audit_encode_nv_string("cert_principal", cert->principals[i], 0);
|
||
|
|
+ if (pbuf == NULL)
|
||
|
|
+ goto out;
|
||
|
|
+ snprintf(buf, sizeof(buf), "principal %s", pbuf);
|
||
|
|
+ free(pbuf);
|
||
|
|
+ rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL,
|
||
|
|
+ buf, audit_username(), -1, NULL, rip, NULL, rv);
|
||
|
|
+ if ((rc < 0) && ((rc != -1) || (getuid() == 0)))
|
||
|
|
+ goto out;
|
||
|
|
+ }
|
||
|
|
+ }
|
||
|
|
out:
|
||
|
|
saved_errno = errno;
|
||
|
|
audit_close(audit_fd);
|
||
|
|
@@ -179,26 +211,34 @@ audit_connection_from(const char *host,
|
||
|
|
int
|
||
|
|
audit_run_command(struct ssh *ssh, const char *command)
|
||
|
|
{
|
||
|
|
+ char * audit_hostname = options.use_dns ? remote_hostname(ssh) : NULL;
|
||
|
|
if (!user_login_count++)
|
||
|
|
linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
|
||
|
|
+ audit_hostname,
|
||
|
|
ssh_remote_ipaddr(ssh),
|
||
|
|
"ssh", 1, AUDIT_USER_LOGIN);
|
||
|
|
linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
|
||
|
|
+ audit_hostname,
|
||
|
|
ssh_remote_ipaddr(ssh),
|
||
|
|
"ssh", 1, AUDIT_USER_START);
|
||
|
|
+ free(audit_hostname);
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
void
|
||
|
|
audit_end_command(struct ssh *ssh, int handle, const char *command)
|
||
|
|
{
|
||
|
|
+ char * audit_hostname = options.use_dns ? remote_hostname(ssh) : NULL;
|
||
|
|
linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
|
||
|
|
+ audit_hostname,
|
||
|
|
ssh_remote_ipaddr(ssh),
|
||
|
|
"ssh", 1, AUDIT_USER_END);
|
||
|
|
if (user_login_count && !--user_login_count)
|
||
|
|
linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
|
||
|
|
+ audit_hostname,
|
||
|
|
ssh_remote_ipaddr(ssh),
|
||
|
|
"ssh", 1, AUDIT_USER_LOGOUT);
|
||
|
|
+ free(audit_hostname);
|
||
|
|
}
|
||
|
|
|
||
|
|
void
|
||
|
|
@@ -211,31 +251,41 @@ void
|
||
|
|
audit_session_open(struct logininfo *li)
|
||
|
|
{
|
||
|
|
if (!user_login_count++)
|
||
|
|
- linux_audit_user_logxxx(li->uid, NULL, li->hostname,
|
||
|
|
+ linux_audit_user_logxxx(li->uid, NULL,
|
||
|
|
+ options.use_dns ? li->hostname : NULL,
|
||
|
|
+ options.use_dns ? NULL : li->hostname,
|
||
|
|
li->line, 1, AUDIT_USER_LOGIN);
|
||
|
|
- linux_audit_user_logxxx(li->uid, NULL, li->hostname,
|
||
|
|
+ linux_audit_user_logxxx(li->uid, NULL,
|
||
|
|
+ options.use_dns ? li->hostname : NULL,
|
||
|
|
+ options.use_dns ? NULL : li->hostname,
|
||
|
|
li->line, 1, AUDIT_USER_START);
|
||
|
|
}
|
||
|
|
|
||
|
|
void
|
||
|
|
audit_session_close(struct logininfo *li)
|
||
|
|
{
|
||
|
|
- linux_audit_user_logxxx(li->uid, NULL, li->hostname,
|
||
|
|
+ linux_audit_user_logxxx(li->uid, NULL,
|
||
|
|
+ options.use_dns ? li->hostname : NULL,
|
||
|
|
+ options.use_dns ? NULL : li->hostname,
|
||
|
|
li->line, 1, AUDIT_USER_END);
|
||
|
|
if (user_login_count && !--user_login_count)
|
||
|
|
- linux_audit_user_logxxx(li->uid, NULL, li->hostname,
|
||
|
|
+ linux_audit_user_logxxx(li->uid, NULL,
|
||
|
|
+ options.use_dns ? li->hostname : NULL,
|
||
|
|
+ options.use_dns ? NULL : li->hostname,
|
||
|
|
li->line, 1, AUDIT_USER_LOGOUT);
|
||
|
|
}
|
||
|
|
|
||
|
|
void
|
||
|
|
audit_event(struct ssh *ssh, ssh_audit_event_t event)
|
||
|
|
{
|
||
|
|
+ char * audit_hostname = options.use_dns ? remote_hostname(ssh) : NULL;
|
||
|
|
+
|
||
|
|
switch(event) {
|
||
|
|
case SSH_NOLOGIN:
|
||
|
|
case SSH_LOGIN_ROOT_DENIED:
|
||
|
|
linux_audit_user_auth(-1, audit_username(),
|
||
|
|
ssh_remote_ipaddr(ssh), "ssh", 0, event);
|
||
|
|
- linux_audit_user_logxxx(-1, audit_username(),
|
||
|
|
+ linux_audit_user_logxxx(-1, audit_username(), audit_hostname,
|
||
|
|
ssh_remote_ipaddr(ssh), "ssh", 0, AUDIT_USER_LOGIN);
|
||
|
|
break;
|
||
|
|
case SSH_AUTH_FAIL_PASSWD:
|
||
|
|
@@ -255,9 +305,11 @@ audit_event(struct ssh *ssh, ssh_audit_e
|
||
|
|
if (user_login_count) {
|
||
|
|
while (user_login_count--)
|
||
|
|
linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
|
||
|
|
+ audit_hostname,
|
||
|
|
ssh_remote_ipaddr(ssh),
|
||
|
|
"ssh", 1, AUDIT_USER_END);
|
||
|
|
linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
|
||
|
|
+ audit_hostname,
|
||
|
|
ssh_remote_ipaddr(ssh),
|
||
|
|
"ssh", 1, AUDIT_USER_LOGOUT);
|
||
|
|
}
|
||
|
|
@@ -266,12 +318,14 @@ audit_event(struct ssh *ssh, ssh_audit_e
|
||
|
|
case SSH_CONNECTION_ABANDON:
|
||
|
|
case SSH_INVALID_USER:
|
||
|
|
linux_audit_user_logxxx(-1, audit_username(),
|
||
|
|
+ audit_hostname,
|
||
|
|
ssh_remote_ipaddr(ssh), "ssh", 0, AUDIT_USER_LOGIN);
|
||
|
|
break;
|
||
|
|
default:
|
||
|
|
debug("%s: unhandled event %d", __func__, event);
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
+ free(audit_hostname);
|
||
|
|
}
|
||
|
|
|
||
|
|
void
|