Line data Source code
1 : /*
2 :
3 : Authentication and authorization logging
4 :
5 : Copyright (C) Andrew Bartlett <abartlet@samba.org> 2017
6 :
7 : This program is free software; you can redistribute it and/or modify
8 : it under the terms of the GNU General Public License as published by
9 : the Free Software Foundation; either version 3 of the License, or
10 : (at your option) any later version.
11 :
12 : This program is distributed in the hope that it will be useful,
13 : but WITHOUT ANY WARRANTY; without even the implied warranty of
14 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 : GNU General Public License for more details.
16 :
17 : You should have received a copy of the GNU General Public License
18 : along with this program. If not, see <http://www.gnu.org/licenses/>.
19 : */
20 :
21 : /*
22 : * Debug log levels for authentication logging (these both map to
23 : * LOG_NOTICE in syslog)
24 : */
25 : #define AUTH_FAILURE_LEVEL 2
26 : #define AUTH_SUCCESS_LEVEL 3
27 : #define AUTHZ_SUCCESS_LEVEL 4
28 :
29 : /* 5 is used for both authentication and authorization */
30 : #define AUTH_ANONYMOUS_LEVEL 5
31 : #define AUTHZ_ANONYMOUS_LEVEL 5
32 :
33 : #define AUTHZ_JSON_TYPE "Authorization"
34 : #define AUTH_JSON_TYPE "Authentication"
35 :
36 : /*
37 : * JSON message version numbers
38 : *
39 : * If adding a field increment the minor version
40 : * If removing or changing the format/meaning of a field
41 : * increment the major version.
42 : */
43 : #define AUTH_MAJOR 1
44 : #define AUTH_MINOR 2
45 : #define AUTHZ_MAJOR 1
46 : #define AUTHZ_MINOR 1
47 :
48 : #include "includes.h"
49 : #include "../lib/tsocket/tsocket.h"
50 : #include "common_auth.h"
51 : #include "lib/util/util_str_escape.h"
52 : #include "libcli/security/dom_sid.h"
53 : #include "libcli/security/security_token.h"
54 : #include "librpc/gen_ndr/server_id.h"
55 : #include "source4/lib/messaging/messaging.h"
56 : #include "source4/lib/messaging/irpc.h"
57 : #include "lib/util/server_id_db.h"
58 : #include "lib/param/param.h"
59 : #include "librpc/ndr/libndr.h"
60 : #include "librpc/gen_ndr/windows_event_ids.h"
61 : #include "lib/audit_logging/audit_logging.h"
62 :
63 : /*
64 : * Determine the type of the password supplied for the
65 : * authorisation attempt.
66 : *
67 : */
68 : static const char* get_password_type(const struct auth_usersupplied_info *ui);
69 :
70 : #ifdef HAVE_JANSSON
71 :
72 : #include <jansson.h>
73 : #include "system/time.h"
74 :
75 : /*
76 : * Write the json object to the debug logs.
77 : *
78 : */
79 52161 : static void log_json(struct imessaging_context *msg_ctx,
80 : struct loadparm_context *lp_ctx,
81 : struct json_object *object,
82 : int debug_class,
83 : int debug_level)
84 : {
85 52161 : audit_log_json(object, debug_class, debug_level);
86 52161 : if (msg_ctx && lp_ctx && lpcfg_auth_event_notification(lp_ctx)) {
87 52161 : audit_message_send(msg_ctx,
88 : AUTH_EVENT_NAME,
89 : MSG_AUTH_LOG,
90 : object);
91 : }
92 52161 : }
93 :
94 : /*
95 : * Determine the Windows logon type for the current authorisation attempt.
96 : *
97 : * Currently Samba only supports
98 : *
99 : * 2 Interactive A user logged on to this computer.
100 : * 3 Network A user or computer logged on to this computer from
101 : * the network.
102 : * 8 NetworkCleartext A user logged on to this computer from the network.
103 : * The user's password was passed to the authentication
104 : * package in its unhashed form.
105 : *
106 : */
107 29608 : static enum event_logon_type get_logon_type(
108 : const struct auth_usersupplied_info *ui)
109 : {
110 29608 : if ((ui->logon_parameters & MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED)
111 29362 : || (ui->password_state == AUTH_PASSWORD_PLAIN)) {
112 246 : return EVT_LOGON_NETWORK_CLEAR_TEXT;
113 29362 : } else if (ui->flags & USER_INFO_INTERACTIVE_LOGON) {
114 432 : return EVT_LOGON_INTERACTIVE;
115 : }
116 28930 : return EVT_LOGON_NETWORK;
117 : }
118 :
119 : /*
120 : * Write a machine parsable json formatted authentication log entry.
121 : *
122 : * IF removing or changing the format/meaning of a field please update the
123 : * major version number AUTH_MAJOR
124 : *
125 : * IF adding a new field please update the minor version number AUTH_MINOR
126 : *
127 : * To process the resulting log lines from the commend line use jq to
128 : * parse the json.
129 : *
130 : * grep "^ {" log file |
131 : * jq -rc '"\(.timestamp)\t\(.Authentication.status)\t
132 : * \(.Authentication.clientDomain)\t
133 : * \(.Authentication.clientAccount)
134 : * \t\(.Authentication.workstation)
135 : * \t\(.Authentication.remoteAddress)
136 : * \t\(.Authentication.localAddress)"'
137 : */
138 29608 : static void log_authentication_event_json(
139 : struct imessaging_context *msg_ctx,
140 : struct loadparm_context *lp_ctx,
141 : const struct timeval *start_time,
142 : const struct auth_usersupplied_info *ui,
143 : NTSTATUS status,
144 : const char *domain_name,
145 : const char *account_name,
146 : struct dom_sid *sid,
147 : enum event_id_type event_id,
148 : int debug_level)
149 : {
150 29608 : struct json_object wrapper = json_empty_object;
151 29608 : struct json_object authentication = json_empty_object;
152 : char negotiate_flags[11];
153 : char logon_id[19];
154 29608 : int rc = 0;
155 59216 : const char *clientDomain = ui->orig_client.domain_name ?
156 29608 : ui->orig_client.domain_name :
157 : ui->client.domain_name;
158 59216 : const char *clientAccount = ui->orig_client.account_name ?
159 29608 : ui->orig_client.account_name :
160 : ui->client.account_name;
161 :
162 29608 : authentication = json_new_object();
163 29608 : if (json_is_invalid(&authentication)) {
164 0 : goto failure;
165 : }
166 29608 : rc = json_add_version(&authentication, AUTH_MAJOR, AUTH_MINOR);
167 29608 : if (rc != 0) {
168 0 : goto failure;
169 : }
170 29608 : rc = json_add_int(&authentication,
171 : "eventId",
172 : event_id);
173 29608 : if (rc != 0) {
174 0 : goto failure;
175 : }
176 29608 : snprintf(logon_id,
177 : sizeof( logon_id),
178 : "%"PRIx64"",
179 1384 : ui->logon_id);
180 29608 : rc = json_add_string(&authentication, "logonId", logon_id);
181 29608 : if (rc != 0) {
182 0 : goto failure;
183 : }
184 29608 : rc = json_add_int(&authentication, "logonType", get_logon_type(ui));
185 29608 : if (rc != 0) {
186 0 : goto failure;
187 : }
188 29608 : rc = json_add_string(&authentication, "status", nt_errstr(status));
189 29608 : if (rc != 0) {
190 0 : goto failure;
191 : }
192 29608 : rc = json_add_address(&authentication, "localAddress", ui->local_host);
193 29608 : if (rc != 0) {
194 0 : goto failure;
195 : }
196 28224 : rc =
197 29608 : json_add_address(&authentication, "remoteAddress", ui->remote_host);
198 29608 : if (rc != 0) {
199 0 : goto failure;
200 : }
201 29608 : rc = json_add_string(
202 1384 : &authentication, "serviceDescription", ui->service_description);
203 29608 : if (rc != 0) {
204 0 : goto failure;
205 : }
206 29608 : rc = json_add_string(
207 1384 : &authentication, "authDescription", ui->auth_description);
208 29608 : if (rc != 0) {
209 0 : goto failure;
210 : }
211 29608 : rc = json_add_string(
212 : &authentication, "clientDomain", clientDomain);
213 29608 : if (rc != 0) {
214 0 : goto failure;
215 : }
216 29608 : rc = json_add_string(
217 : &authentication, "clientAccount", clientAccount);
218 29608 : if (rc != 0) {
219 0 : goto failure;
220 : }
221 29608 : rc = json_add_string(
222 1384 : &authentication, "workstation", ui->workstation_name);
223 29608 : if (rc != 0) {
224 0 : goto failure;
225 : }
226 29608 : rc = json_add_string(&authentication, "becameAccount", account_name);
227 29608 : if (rc != 0) {
228 0 : goto failure;
229 : }
230 29608 : rc = json_add_string(&authentication, "becameDomain", domain_name);
231 29608 : if (rc != 0) {
232 0 : goto failure;
233 : }
234 29608 : rc = json_add_sid(&authentication, "becameSid", sid);
235 29608 : if (rc != 0) {
236 0 : goto failure;
237 : }
238 29608 : rc = json_add_string(
239 1384 : &authentication, "mappedAccount", ui->mapped.account_name);
240 29608 : if (rc != 0) {
241 0 : goto failure;
242 : }
243 29608 : rc = json_add_string(
244 1384 : &authentication, "mappedDomain", ui->mapped.domain_name);
245 29608 : if (rc != 0) {
246 0 : goto failure;
247 : }
248 29608 : rc = json_add_string(&authentication,
249 : "netlogonComputer",
250 1384 : ui->netlogon_trust_account.computer_name);
251 29608 : if (rc != 0) {
252 0 : goto failure;
253 : }
254 29608 : rc = json_add_string(&authentication,
255 : "netlogonTrustAccount",
256 1384 : ui->netlogon_trust_account.account_name);
257 29608 : if (rc != 0) {
258 0 : goto failure;
259 : }
260 29608 : snprintf(negotiate_flags,
261 : sizeof( negotiate_flags),
262 : "0x%08X",
263 1384 : ui->netlogon_trust_account.negotiate_flags);
264 29608 : rc = json_add_string(
265 : &authentication, "netlogonNegotiateFlags", negotiate_flags);
266 29608 : if (rc != 0) {
267 0 : goto failure;
268 : }
269 29608 : rc = json_add_int(&authentication,
270 : "netlogonSecureChannelType",
271 29608 : ui->netlogon_trust_account.secure_channel_type);
272 29608 : if (rc != 0) {
273 0 : goto failure;
274 : }
275 29608 : rc = json_add_sid(&authentication,
276 : "netlogonTrustAccountSid",
277 29608 : ui->netlogon_trust_account.sid);
278 29608 : if (rc != 0) {
279 0 : goto failure;
280 : }
281 29608 : rc = json_add_string(
282 : &authentication, "passwordType", get_password_type(ui));
283 29608 : if (rc != 0) {
284 0 : goto failure;
285 : }
286 :
287 29608 : wrapper = json_new_object();
288 29608 : if (json_is_invalid(&wrapper)) {
289 0 : goto failure;
290 : }
291 29608 : rc = json_add_timestamp(&wrapper);
292 29608 : if (rc != 0) {
293 0 : goto failure;
294 : }
295 29608 : rc = json_add_string(&wrapper, "type", AUTH_JSON_TYPE);
296 29608 : if (rc != 0) {
297 0 : goto failure;
298 : }
299 29608 : rc = json_add_object(&wrapper, AUTH_JSON_TYPE, &authentication);
300 29608 : if (rc != 0) {
301 0 : goto failure;
302 : }
303 :
304 : /*
305 : * While not a general-purpose profiling solution this will
306 : * assist some to determine how long NTLM and KDC
307 : * authentication takes once this process can handle it. This
308 : * covers transactions elsewhere but not (eg) the delay while
309 : * this is waiting unread on the input socket.
310 : */
311 29608 : if (start_time != NULL) {
312 27420 : struct timeval current_time = timeval_current();
313 27420 : uint64_t duration = usec_time_diff(¤t_time,
314 : start_time);
315 27420 : rc = json_add_int(&authentication, "duration", duration);
316 27420 : if (rc != 0) {
317 0 : goto failure;
318 : }
319 : }
320 :
321 29608 : log_json(msg_ctx,
322 : lp_ctx,
323 : &wrapper,
324 : DBGC_AUTH_AUDIT_JSON,
325 : debug_level);
326 29608 : json_free(&wrapper);
327 29608 : return;
328 0 : failure:
329 : /*
330 : * On a failure authentication will not have been added to wrapper so it
331 : * needs to be freed to avoid a leak.
332 : *
333 : */
334 0 : json_free(&authentication);
335 0 : json_free(&wrapper);
336 0 : DBG_ERR("Failed to write authentication event JSON log message\n");
337 : }
338 :
339 : /*
340 : * Log details of a successful authorization to a service,
341 : * in a machine parsable json format
342 : *
343 : * IF removing or changing the format/meaning of a field please update the
344 : * major version number AUTHZ_MAJOR
345 : *
346 : * IF adding a new field please update the minor version number AUTHZ_MINOR
347 : *
348 : * To process the resulting log lines from the commend line use jq to
349 : * parse the json.
350 : *
351 : * grep "^ {" log_file |\
352 : * jq -rc '"\(.timestamp)\t
353 : * \(.Authorization.domain)\t
354 : * \(.Authorization.account)\t
355 : * \(.Authorization.remoteAddress)"'
356 : *
357 : */
358 22553 : static void log_successful_authz_event_json(
359 : struct imessaging_context *msg_ctx,
360 : struct loadparm_context *lp_ctx,
361 : const struct tsocket_address *remote,
362 : const struct tsocket_address *local,
363 : const char *service_description,
364 : const char *auth_type,
365 : const char *transport_protection,
366 : struct auth_session_info *session_info,
367 : int debug_level)
368 : {
369 22553 : struct json_object wrapper = json_empty_object;
370 22553 : struct json_object authorization = json_empty_object;
371 : char account_flags[11];
372 22553 : int rc = 0;
373 :
374 22553 : authorization = json_new_object();
375 22553 : if (json_is_invalid(&authorization)) {
376 0 : goto failure;
377 : }
378 22553 : rc = json_add_version(&authorization, AUTHZ_MAJOR, AUTHZ_MINOR);
379 22553 : if (rc != 0) {
380 0 : goto failure;
381 : }
382 22553 : rc = json_add_address(&authorization, "localAddress", local);
383 22553 : if (rc != 0) {
384 0 : goto failure;
385 : }
386 22553 : rc = json_add_address(&authorization, "remoteAddress", remote);
387 22553 : if (rc != 0) {
388 0 : goto failure;
389 : }
390 22553 : rc = json_add_string(
391 : &authorization, "serviceDescription", service_description);
392 22553 : if (rc != 0) {
393 0 : goto failure;
394 : }
395 22553 : rc = json_add_string(&authorization, "authType", auth_type);
396 22553 : if (rc != 0) {
397 0 : goto failure;
398 : }
399 22553 : rc = json_add_string(
400 22553 : &authorization, "domain", session_info->info->domain_name);
401 22553 : if (rc != 0) {
402 0 : goto failure;
403 : }
404 22553 : rc = json_add_string(
405 22553 : &authorization, "account", session_info->info->account_name);
406 22553 : if (rc != 0) {
407 0 : goto failure;
408 : }
409 22553 : rc = json_add_sid(
410 22553 : &authorization, "sid", &session_info->security_token->sids[0]);
411 22553 : if (rc != 0) {
412 0 : goto failure;
413 : }
414 22553 : rc = json_add_guid(
415 22553 : &authorization, "sessionId", &session_info->unique_session_token);
416 22553 : if (rc != 0) {
417 0 : goto failure;
418 : }
419 22553 : rc = json_add_string(
420 22553 : &authorization, "logonServer", session_info->info->logon_server);
421 22553 : if (rc != 0) {
422 0 : goto failure;
423 : }
424 22553 : rc = json_add_string(
425 : &authorization, "transportProtection", transport_protection);
426 22553 : if (rc != 0) {
427 0 : goto failure;
428 : }
429 :
430 22553 : snprintf(account_flags,
431 : sizeof(account_flags),
432 : "0x%08X",
433 22553 : session_info->info->acct_flags);
434 22553 : rc = json_add_string(&authorization, "accountFlags", account_flags);
435 22553 : if (rc != 0) {
436 0 : goto failure;
437 : }
438 :
439 22553 : wrapper = json_new_object();
440 22553 : if (json_is_invalid(&wrapper)) {
441 0 : goto failure;
442 : }
443 22553 : rc = json_add_timestamp(&wrapper);
444 22553 : if (rc != 0) {
445 0 : goto failure;
446 : }
447 22553 : rc = json_add_string(&wrapper, "type", AUTHZ_JSON_TYPE);
448 22553 : if (rc != 0) {
449 0 : goto failure;
450 : }
451 22553 : rc = json_add_object(&wrapper, AUTHZ_JSON_TYPE, &authorization);
452 22553 : if (rc != 0) {
453 0 : goto failure;
454 : }
455 :
456 22553 : log_json(msg_ctx,
457 : lp_ctx,
458 : &wrapper,
459 : DBGC_AUTH_AUDIT_JSON,
460 : debug_level);
461 22553 : json_free(&wrapper);
462 22553 : return;
463 0 : failure:
464 : /*
465 : * On a failure authorization will not have been added to wrapper so it
466 : * needs to be freed to avoid a leak.
467 : *
468 : */
469 0 : json_free(&authorization);
470 0 : json_free(&wrapper);
471 0 : DBG_ERR("Unable to log Authentication event JSON audit message\n");
472 : }
473 :
474 : #else
475 :
476 : static void log_no_json(struct imessaging_context *msg_ctx,
477 : struct loadparm_context *lp_ctx)
478 : {
479 : if (msg_ctx && lp_ctx && lpcfg_auth_event_notification(lp_ctx)) {
480 : static bool auth_event_logged = false;
481 : if (auth_event_logged == false) {
482 : auth_event_logged = true;
483 : DBG_ERR("auth event notification = true but Samba was "
484 : "not compiled with jansson\n");
485 : }
486 : } else {
487 : static bool json_logged = false;
488 : if (json_logged == false) {
489 : json_logged = true;
490 : DBG_NOTICE("JSON auth logs not available unless "
491 : "compiled with jansson\n");
492 : }
493 : }
494 :
495 : return;
496 : }
497 :
498 : static void log_authentication_event_json(
499 : struct imessaging_context *msg_ctx,
500 : struct loadparm_context *lp_ctx,
501 : const struct timeval *start_time,
502 : const struct auth_usersupplied_info *ui,
503 : NTSTATUS status,
504 : const char *domain_name,
505 : const char *account_name,
506 : struct dom_sid *sid,
507 : enum event_id_type event_id,
508 : int debug_level)
509 : {
510 : log_no_json(msg_ctx, lp_ctx);
511 : return;
512 : }
513 :
514 : static void log_successful_authz_event_json(
515 : struct imessaging_context *msg_ctx,
516 : struct loadparm_context *lp_ctx,
517 : const struct tsocket_address *remote,
518 : const struct tsocket_address *local,
519 : const char *service_description,
520 : const char *auth_type,
521 : const char *transport_protection,
522 : struct auth_session_info *session_info,
523 : int debug_level)
524 : {
525 : log_no_json(msg_ctx, lp_ctx);
526 : return;
527 : }
528 :
529 : #endif
530 :
531 : /*
532 : * Determine the type of the password supplied for the
533 : * authorisation attempt.
534 : *
535 : */
536 29608 : static const char* get_password_type(const struct auth_usersupplied_info *ui)
537 : {
538 :
539 29608 : const char *password_type = NULL;
540 :
541 29608 : if (ui->password_type != NULL) {
542 12073 : password_type = ui->password_type;
543 33352 : } else if (ui->auth_description != NULL &&
544 16747 : strncmp("ServerAuthenticate", ui->auth_description, 18) == 0)
545 : {
546 2849 : if (ui->netlogon_trust_account.negotiate_flags
547 987 : & NETLOGON_NEG_SUPPORTS_AES) {
548 739 : password_type = "HMAC-SHA256";
549 496 : } else if (ui->netlogon_trust_account.negotiate_flags
550 248 : & NETLOGON_NEG_STRONG_KEYS) {
551 76 : password_type = "HMAC-MD5";
552 : } else {
553 172 : password_type = "DES";
554 : }
555 31213 : } else if (ui->password_state == AUTH_PASSWORD_RESPONSE &&
556 15817 : (ui->logon_parameters & MSV1_0_ALLOW_MSVCHAPV2) &&
557 4 : ui->password.response.nt.length == 24) {
558 4 : password_type = "MSCHAPv2";
559 16544 : } else if ((ui->logon_parameters & MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED)
560 16298 : || (ui->password_state == AUTH_PASSWORD_PLAIN)) {
561 246 : password_type = "Plaintext";
562 16298 : } else if (ui->password_state == AUTH_PASSWORD_HASH) {
563 432 : password_type = "Supplied-NT-Hash";
564 15866 : } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
565 15801 : && ui->password.response.nt.length > 24) {
566 11168 : password_type = "NTLMv2";
567 4698 : } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
568 4633 : && ui->password.response.nt.length == 24) {
569 2884 : password_type = "NTLMv1";
570 1814 : } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
571 1749 : && ui->password.response.lanman.length == 24) {
572 900 : password_type = "LANMan";
573 914 : } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
574 849 : && ui->password.response.nt.length == 0
575 609 : && ui->password.response.lanman.length == 0) {
576 405 : password_type = "No-Password";
577 : }
578 29608 : return password_type;
579 : }
580 :
581 : /*
582 : * Write a human readable authentication log entry.
583 : *
584 : */
585 0 : static void log_authentication_event_human_readable(
586 : const struct auth_usersupplied_info *ui,
587 : NTSTATUS status,
588 : const char *domain_name,
589 : const char *account_name,
590 : struct dom_sid *sid,
591 : int debug_level)
592 : {
593 0 : TALLOC_CTX *frame = NULL;
594 :
595 0 : const char *ts = NULL; /* formatted current time */
596 0 : char *remote = NULL; /* formatted remote host */
597 0 : char *local = NULL; /* formatted local host */
598 0 : char *nl = NULL; /* NETLOGON details if present */
599 0 : char *trust_computer_name = NULL;
600 0 : char *trust_account_name = NULL;
601 0 : char *logon_line = NULL;
602 0 : const char *password_type = NULL;
603 0 : const char *clientDomain = ui->orig_client.domain_name ?
604 0 : ui->orig_client.domain_name :
605 : ui->client.domain_name;
606 0 : const char *clientAccount = ui->orig_client.account_name ?
607 0 : ui->orig_client.account_name :
608 : ui->client.account_name;
609 :
610 0 : frame = talloc_stackframe();
611 :
612 0 : password_type = get_password_type(ui);
613 : /* Get the current time */
614 0 : ts = audit_get_timestamp(frame);
615 :
616 : /* Only log the NETLOGON details if they are present */
617 0 : if (ui->netlogon_trust_account.computer_name ||
618 0 : ui->netlogon_trust_account.account_name) {
619 0 : trust_computer_name = log_escape(frame,
620 0 : ui->netlogon_trust_account.computer_name);
621 0 : trust_account_name = log_escape(frame,
622 0 : ui->netlogon_trust_account.account_name);
623 0 : nl = talloc_asprintf(frame,
624 : " NETLOGON computer [%s] trust account [%s]",
625 : trust_computer_name, trust_account_name);
626 : }
627 :
628 0 : remote = tsocket_address_string(ui->remote_host, frame);
629 0 : local = tsocket_address_string(ui->local_host, frame);
630 :
631 0 : if (NT_STATUS_IS_OK(status)) {
632 : struct dom_sid_buf sid_buf;
633 :
634 0 : logon_line = talloc_asprintf(frame,
635 : " became [%s]\\[%s] [%s].",
636 : log_escape(frame, domain_name),
637 : log_escape(frame, account_name),
638 : dom_sid_str_buf(sid, &sid_buf));
639 : } else {
640 0 : logon_line = talloc_asprintf(
641 : frame,
642 : " mapped to [%s]\\[%s].",
643 0 : log_escape(frame, ui->mapped.domain_name),
644 0 : log_escape(frame, ui->mapped.account_name));
645 : }
646 :
647 0 : DEBUGC(DBGC_AUTH_AUDIT, debug_level,
648 : ("Auth: [%s,%s] user [%s]\\[%s]"
649 : " at [%s] with [%s] status [%s]"
650 : " workstation [%s] remote host [%s]"
651 : "%s local host [%s]"
652 : " %s\n",
653 : ui->service_description,
654 : ui->auth_description,
655 : log_escape(frame, clientDomain),
656 : log_escape(frame, clientAccount),
657 : ts,
658 : password_type,
659 : nt_errstr(status),
660 : log_escape(frame, ui->workstation_name),
661 : remote,
662 : logon_line,
663 : local,
664 : nl ? nl : ""
665 : ));
666 :
667 0 : talloc_free(frame);
668 0 : }
669 :
670 : /*
671 : * Log details of an authentication attempt.
672 : * Successful and unsuccessful attempts are logged.
673 : *
674 : * NOTE: msg_ctx and lp_ctx is optional, but when supplied allows streaming the
675 : * authentication events over the message bus.
676 : */
677 43709 : void log_authentication_event(
678 : struct imessaging_context *msg_ctx,
679 : struct loadparm_context *lp_ctx,
680 : const struct timeval *start_time,
681 : const struct auth_usersupplied_info *ui,
682 : NTSTATUS status,
683 : const char *domain_name,
684 : const char *account_name,
685 : struct dom_sid *sid)
686 : {
687 : /* set the log level */
688 43709 : int debug_level = AUTH_FAILURE_LEVEL;
689 43709 : enum event_id_type event_id = EVT_ID_UNSUCCESSFUL_LOGON;
690 :
691 43709 : if (NT_STATUS_IS_OK(status)) {
692 36936 : debug_level = AUTH_SUCCESS_LEVEL;
693 36936 : event_id = EVT_ID_SUCCESSFUL_LOGON;
694 36936 : if (dom_sid_equal(sid, &global_sid_Anonymous)) {
695 317 : debug_level = AUTH_ANONYMOUS_LEVEL;
696 : }
697 : }
698 :
699 43709 : if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT, debug_level)) {
700 0 : log_authentication_event_human_readable(ui,
701 : status,
702 : domain_name,
703 : account_name,
704 : sid,
705 : debug_level);
706 : }
707 43709 : if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT_JSON, debug_level) ||
708 43590 : (msg_ctx && lp_ctx && lpcfg_auth_event_notification(lp_ctx))) {
709 29608 : log_authentication_event_json(msg_ctx,
710 : lp_ctx,
711 : start_time,
712 : ui,
713 : status,
714 : domain_name,
715 : account_name,
716 : sid,
717 : event_id,
718 : debug_level);
719 : }
720 43709 : }
721 :
722 :
723 :
724 : /*
725 : * Log details of a successful authorization to a service,
726 : * in a human readable format.
727 : *
728 : */
729 0 : static void log_successful_authz_event_human_readable(
730 : const struct tsocket_address *remote,
731 : const struct tsocket_address *local,
732 : const char *service_description,
733 : const char *auth_type,
734 : struct auth_session_info *session_info,
735 : int debug_level)
736 : {
737 0 : TALLOC_CTX *frame = NULL;
738 :
739 0 : const char *ts = NULL; /* formatted current time */
740 0 : char *remote_str = NULL; /* formatted remote host */
741 0 : char *local_str = NULL; /* formatted local host */
742 : struct dom_sid_buf sid_buf;
743 :
744 0 : frame = talloc_stackframe();
745 :
746 : /* Get the current time */
747 0 : ts = audit_get_timestamp(frame);
748 :
749 0 : remote_str = tsocket_address_string(remote, frame);
750 0 : local_str = tsocket_address_string(local, frame);
751 :
752 0 : DEBUGC(DBGC_AUTH_AUDIT, debug_level,
753 : ("Successful AuthZ: [%s,%s] user [%s]\\[%s] [%s]"
754 : " at [%s]"
755 : " Remote host [%s]"
756 : " local host [%s]\n",
757 : service_description,
758 : auth_type,
759 : log_escape(frame, session_info->info->domain_name),
760 : log_escape(frame, session_info->info->account_name),
761 : dom_sid_str_buf(&session_info->security_token->sids[0],
762 : &sid_buf),
763 : ts,
764 : remote_str,
765 : local_str));
766 :
767 0 : talloc_free(frame);
768 0 : }
769 :
770 : /*
771 : * Log details of a successful authorization to a service.
772 : *
773 : * Only successful authorizations are logged. For clarity:
774 : * - NTLM bad passwords will be recorded by log_authentication_event
775 : * - Kerberos decrypt failures need to be logged in gensec_gssapi et al
776 : *
777 : * The service may later refuse authorization due to an ACL.
778 : *
779 : * NOTE: msg_ctx and lp_ctx is optional, but when supplied allows streaming the
780 : * authentication events over the message bus.
781 : */
782 45859 : void log_successful_authz_event(
783 : struct imessaging_context *msg_ctx,
784 : struct loadparm_context *lp_ctx,
785 : const struct tsocket_address *remote,
786 : const struct tsocket_address *local,
787 : const char *service_description,
788 : const char *auth_type,
789 : const char *transport_protection,
790 : struct auth_session_info *session_info)
791 : {
792 45859 : int debug_level = AUTHZ_SUCCESS_LEVEL;
793 :
794 : /* set the log level */
795 45859 : if (security_token_is_anonymous(session_info->security_token)) {
796 7894 : debug_level = AUTH_ANONYMOUS_LEVEL;
797 : }
798 :
799 45859 : if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT, debug_level)) {
800 0 : log_successful_authz_event_human_readable(remote,
801 : local,
802 : service_description,
803 : auth_type,
804 : session_info,
805 : debug_level);
806 : }
807 45859 : if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT_JSON, debug_level) ||
808 42745 : (msg_ctx && lp_ctx && lpcfg_auth_event_notification(lp_ctx))) {
809 22553 : log_successful_authz_event_json(msg_ctx, lp_ctx,
810 : remote,
811 : local,
812 : service_description,
813 : auth_type,
814 : transport_protection,
815 : session_info,
816 : debug_level);
817 : }
818 45859 : }
|
