1 /* 2 * TODO 3 * 4 * - deal with overlap between this and sys_auth_allowed_user 5 * sys_auth_record_login and record_failed_login. 6 */ 7 8 /* 9 * Copyright 1988-2002 Sun Microsystems, Inc. All rights reserved. 10 * Use is subject to license terms. 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, this list of conditions and the following disclaimer. 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 * 32 */ 33 /* #pragma ident "@(#)bsmaudit.c 1.1 01/09/17 SMI" */ 34 35 #include "includes.h" 36 #if defined(USE_BSM_AUDIT) 37 38 #include <sys/types.h> 39 40 #include <errno.h> 41 #include <netdb.h> 42 #include <stdarg.h> 43 #include <string.h> 44 #include <unistd.h> 45 46 #ifdef BROKEN_BSM_API 47 #include <libscf.h> 48 #endif 49 50 #include "ssh.h" 51 #include "log.h" 52 #include "key.h" 53 #include "hostfile.h" 54 #include "auth.h" 55 #include "xmalloc.h" 56 57 #ifndef AUE_openssh 58 # define AUE_openssh 32800 59 #endif 60 #include <bsm/audit.h> 61 #include <bsm/libbsm.h> 62 #include <bsm/audit_uevents.h> 63 #include <bsm/audit_record.h> 64 #include <locale.h> 65 66 #if defined(HAVE_GETAUDIT_ADDR) 67 #define AuditInfoStruct auditinfo_addr 68 #define AuditInfoTermID au_tid_addr_t 69 #define SetAuditFunc(a,b) setaudit_addr((a),(b)) 70 #define SetAuditFuncText "setaudit_addr" 71 #define AUToSubjectFunc au_to_subject_ex 72 #define AUToReturnFunc(a,b) au_to_return32((a), (int32_t)(b)) 73 #else 74 #define AuditInfoStruct auditinfo 75 #define AuditInfoTermID au_tid_t 76 #define SetAuditFunc(a,b) setaudit(a) 77 #define SetAuditFuncText "setaudit" 78 #define AUToSubjectFunc au_to_subject 79 #define AUToReturnFunc(a,b) au_to_return((a), (u_int)(b)) 80 #endif 81 82 #ifndef cannot_audit 83 extern int cannot_audit(int); 84 #endif 85 extern void aug_init(void); 86 extern void aug_save_auid(au_id_t); 87 extern void aug_save_uid(uid_t); 88 extern void aug_save_euid(uid_t); 89 extern void aug_save_gid(gid_t); 90 extern void aug_save_egid(gid_t); 91 extern void aug_save_pid(pid_t); 92 extern void aug_save_asid(au_asid_t); 93 extern void aug_save_tid(dev_t, unsigned int); 94 extern void aug_save_tid_ex(dev_t, u_int32_t *, u_int32_t); 95 extern int aug_save_me(void); 96 extern int aug_save_namask(void); 97 extern void aug_save_event(au_event_t); 98 extern void aug_save_sorf(int); 99 extern void aug_save_text(char *); 100 extern void aug_save_text1(char *); 101 extern void aug_save_text2(char *); 102 extern void aug_save_na(int); 103 extern void aug_save_user(char *); 104 extern void aug_save_path(char *); 105 extern int aug_save_policy(void); 106 extern void aug_save_afunc(int (*)(int)); 107 extern int aug_audit(void); 108 extern int aug_na_selected(void); 109 extern int aug_selected(void); 110 extern int aug_daemon_session(void); 111 112 #ifndef HAVE_GETTEXT 113 # define gettext(a) (a) 114 #endif 115 116 extern Authctxt *the_authctxt; 117 static AuditInfoTermID ssh_bsm_tid; 118 119 #ifdef BROKEN_BSM_API 120 /* For some reason this constant is no longer defined 121 in Solaris 11. */ 122 #define BSM_TEXTBUFSZ 256 123 #endif 124 125 /* Below is the low-level BSM interface code */ 126 127 /* 128 * aug_get_machine is only required on IPv6 capable machines, we use a 129 * different mechanism in audit_connection_from() for IPv4-only machines. 130 * getaudit_addr() is only present on IPv6 capable machines. 131 */ 132 #if defined(HAVE_AUG_GET_MACHINE) || !defined(HAVE_GETAUDIT_ADDR) 133 extern int aug_get_machine(char *, u_int32_t *, u_int32_t *); 134 #else 135 static int 136 aug_get_machine(char *host, u_int32_t *addr, u_int32_t *type) 137 { 138 struct addrinfo *ai; 139 struct sockaddr_in *in4; 140 struct sockaddr_in6 *in6; 141 int ret = 0, r; 142 143 if ((r = getaddrinfo(host, NULL, NULL, &ai)) != 0) { 144 error("BSM audit: getaddrinfo failed for %.100s: %.100s", host, 145 r == EAI_SYSTEM ? strerror(errno) : gai_strerror(r)); 146 return -1; 147 } 148 149 switch (ai->ai_family) { 150 case AF_INET: 151 in4 = (struct sockaddr_in *)ai->ai_addr; 152 *type = AU_IPv4; 153 memcpy(addr, &in4->sin_addr, sizeof(struct in_addr)); 154 break; 155 #ifdef AU_IPv6 156 case AF_INET6: 157 in6 = (struct sockaddr_in6 *)ai->ai_addr; 158 *type = AU_IPv6; 159 memcpy(addr, &in6->sin6_addr, sizeof(struct in6_addr)); 160 break; 161 #endif 162 default: 163 error("BSM audit: unknown address family for %.100s: %d", 164 host, ai->ai_family); 165 ret = -1; 166 } 167 freeaddrinfo(ai); 168 return ret; 169 } 170 #endif 171 172 #ifdef BROKEN_BSM_API 173 /* 174 In Solaris 11 the audit daemon has been moved to SMF. In the process 175 they simply dropped getacna() from the API, since it read from a now 176 non-existent config file. This function re-implements getacna() to 177 read from the SMF repository instead. 178 */ 179 int 180 getacna(char *auditstring, int len) 181 { 182 scf_handle_t *handle = NULL; 183 scf_property_t *property = NULL; 184 scf_value_t *value = NULL; 185 int ret = 0; 186 187 handle = scf_handle_create(SCF_VERSION); 188 if (handle == NULL) 189 return -2; /* The man page for getacna on Solaris 10 states 190 we should return -2 in case of error and set 191 errno to indicate the error. We don't bother 192 with errno here, though, since the only use 193 of this function below doesn't check for errors 194 anyway. 195 */ 196 197 ret = scf_handle_bind(handle); 198 if (ret == -1) 199 return -2; 200 201 property = scf_property_create(handle); 202 if (property == NULL) 203 return -2; 204 205 ret = scf_handle_decode_fmri(handle, 206 "svc:/system/auditd:default/:properties/preselection/naflags", 207 NULL, NULL, NULL, NULL, property, 0); 208 if (ret == -1) 209 return -2; 210 211 value = scf_value_create(handle); 212 if (value == NULL) 213 return -2; 214 215 ret = scf_property_get_value(property, value); 216 if (ret == -1) 217 return -2; 218 219 ret = scf_value_get_astring(value, auditstring, len); 220 if (ret == -1) 221 return -2; 222 223 scf_value_destroy(value); 224 scf_property_destroy(property); 225 scf_handle_destroy(handle); 226 227 return 0; 228 } 229 #endif 230 231 /* 232 * Check if the specified event is selected (enabled) for auditing. 233 * Returns 1 if the event is selected, 0 if not and -1 on failure. 234 */ 235 static int 236 selected(char *username, uid_t uid, au_event_t event, int sf) 237 { 238 int rc, sorf; 239 char naflags[512]; 240 struct au_mask mask; 241 242 mask.am_success = mask.am_failure = 0; 243 if (uid < 0) { 244 /* get flags for non-attributable (to a real user) events */ 245 rc = getacna(naflags, sizeof(naflags)); 246 if (rc == 0) 247 (void) getauditflagsbin(naflags, &mask); 248 } else 249 rc = au_user_mask(username, &mask); 250 251 sorf = (sf == 0) ? AU_PRS_SUCCESS : AU_PRS_FAILURE; 252 return(au_preselect(event, &mask, sorf, AU_PRS_REREAD)); 253 } 254 255 static void 256 bsm_audit_record(int typ, char *string, au_event_t event_no) 257 { 258 int ad, rc, sel; 259 uid_t uid = -1; 260 gid_t gid = -1; 261 pid_t pid = getpid(); 262 AuditInfoTermID tid = ssh_bsm_tid; 263 264 if (the_authctxt != NULL && the_authctxt->valid) { 265 uid = the_authctxt->pw->pw_uid; 266 gid = the_authctxt->pw->pw_gid; 267 } 268 269 rc = (typ == 0) ? 0 : -1; 270 sel = selected(the_authctxt->user, uid, event_no, rc); 271 debug3("BSM audit: typ %d rc %d \"%s\"", typ, rc, string); 272 if (!sel) 273 return; /* audit event does not match mask, do not write */ 274 275 debug3("BSM audit: writing audit new record"); 276 ad = au_open(); 277 278 (void) au_write(ad, AUToSubjectFunc(uid, uid, gid, uid, gid, 279 pid, pid, &tid)); 280 (void) au_write(ad, au_to_text(string)); 281 (void) au_write(ad, AUToReturnFunc(typ, rc)); 282 283 #ifdef BROKEN_BSM_API 284 /* The last argument is the event modifier flags. For 285 some seemingly undocumented reason it was added in 286 Solaris 11. */ 287 rc = au_close(ad, AU_TO_WRITE, event_no, 0); 288 #else 289 rc = au_close(ad, AU_TO_WRITE, event_no); 290 #endif 291 292 if (rc < 0) 293 error("BSM audit: %s failed to write \"%s\" record: %s", 294 __func__, string, strerror(errno)); 295 } 296 297 static void 298 bsm_audit_session_setup(void) 299 { 300 int rc; 301 struct AuditInfoStruct info; 302 au_mask_t mask; 303 304 if (the_authctxt == NULL) { 305 error("BSM audit: session setup internal error (NULL ctxt)"); 306 return; 307 } 308 309 if (the_authctxt->valid) 310 info.ai_auid = the_authctxt->pw->pw_uid; 311 else 312 info.ai_auid = -1; 313 info.ai_asid = getpid(); 314 mask.am_success = 0; 315 mask.am_failure = 0; 316 317 (void) au_user_mask(the_authctxt->user, &mask); 318 319 info.ai_mask.am_success = mask.am_success; 320 info.ai_mask.am_failure = mask.am_failure; 321 322 info.ai_termid = ssh_bsm_tid; 323 324 rc = SetAuditFunc(&info, sizeof(info)); 325 if (rc < 0) 326 error("BSM audit: %s: %s failed: %s", __func__, 327 SetAuditFuncText, strerror(errno)); 328 } 329 330 static void 331 bsm_audit_bad_login(const char *what) 332 { 333 char textbuf[BSM_TEXTBUFSZ]; 334 335 if (the_authctxt->valid) { 336 (void) snprintf(textbuf, sizeof (textbuf), 337 gettext("invalid %s for user %s"), 338 what, the_authctxt->user); 339 bsm_audit_record(4, textbuf, AUE_openssh); 340 } else { 341 (void) snprintf(textbuf, sizeof (textbuf), 342 gettext("invalid user name \"%s\""), 343 the_authctxt->user); 344 bsm_audit_record(3, textbuf, AUE_openssh); 345 } 346 } 347 348 /* Below is the sshd audit API code */ 349 350 void 351 audit_connection_from(const char *host, int port) 352 { 353 AuditInfoTermID *tid = &ssh_bsm_tid; 354 char buf[1024]; 355 356 if (cannot_audit(0)) 357 return; 358 debug3("BSM audit: connection from %.100s port %d", host, port); 359 360 /* populate our terminal id structure */ 361 #if defined(HAVE_GETAUDIT_ADDR) 362 tid->at_port = (dev_t)port; 363 aug_get_machine((char *)host, &(tid->at_addr[0]), &(tid->at_type)); 364 snprintf(buf, sizeof(buf), "%08x %08x %08x %08x", tid->at_addr[0], 365 tid->at_addr[1], tid->at_addr[2], tid->at_addr[3]); 366 debug3("BSM audit: iptype %d machine ID %s", (int)tid->at_type, buf); 367 #else 368 /* this is used on IPv4-only machines */ 369 tid->port = (dev_t)port; 370 tid->machine = inet_addr(host); 371 snprintf(buf, sizeof(buf), "%08x", tid->machine); 372 debug3("BSM audit: machine ID %s", buf); 373 #endif 374 } 375 376 void 377 audit_run_command(const char *command) 378 { 379 /* not implemented */ 380 } 381 382 void 383 audit_session_open(struct logininfo *li) 384 { 385 /* not implemented */ 386 } 387 388 void 389 audit_session_close(struct logininfo *li) 390 { 391 /* not implemented */ 392 } 393 394 void 395 audit_event(ssh_audit_event_t event) 396 { 397 char textbuf[BSM_TEXTBUFSZ]; 398 static int logged_in = 0; 399 const char *user = the_authctxt ? the_authctxt->user : "(unknown user)"; 400 401 if (cannot_audit(0)) 402 return; 403 404 switch(event) { 405 case SSH_AUTH_SUCCESS: 406 logged_in = 1; 407 bsm_audit_session_setup(); 408 snprintf(textbuf, sizeof(textbuf), 409 gettext("successful login %s"), user); 410 bsm_audit_record(0, textbuf, AUE_openssh); 411 break; 412 413 case SSH_CONNECTION_CLOSE: 414 /* 415 * We can also get a close event if the user attempted auth 416 * but never succeeded. 417 */ 418 if (logged_in) { 419 snprintf(textbuf, sizeof(textbuf), 420 gettext("sshd logout %s"), the_authctxt->user); 421 bsm_audit_record(0, textbuf, AUE_logout); 422 } else { 423 debug("%s: connection closed without authentication", 424 __func__); 425 } 426 break; 427 428 case SSH_NOLOGIN: 429 bsm_audit_record(1, 430 gettext("logins disabled by /etc/nologin"), AUE_openssh); 431 break; 432 433 case SSH_LOGIN_EXCEED_MAXTRIES: 434 snprintf(textbuf, sizeof(textbuf), 435 gettext("too many tries for user %s"), the_authctxt->user); 436 bsm_audit_record(1, textbuf, AUE_openssh); 437 break; 438 439 case SSH_LOGIN_ROOT_DENIED: 440 bsm_audit_record(2, gettext("not_console"), AUE_openssh); 441 break; 442 443 case SSH_AUTH_FAIL_PASSWD: 444 bsm_audit_bad_login("password"); 445 break; 446 447 case SSH_AUTH_FAIL_KBDINT: 448 bsm_audit_bad_login("interactive password entry"); 449 break; 450 451 default: 452 debug("%s: unhandled event %d", __func__, event); 453 } 454 } 455 #endif /* BSM */ 456
