[Bug 501956] Re: OpenSSH does not log failed attempts when key authentication is used
Bug Watch Updater
501956 at bugs.launchpad.net
Wed Mar 26 20:32:04 UTC 2014
Launchpad has imported 26 comments from the remote bug at
https://bugzilla.mindrot.org/show_bug.cgi?id=974.
If you reply to an imported comment from within Launchpad, your comment
will be sent to the remote bug automatically. Read more about
Launchpad's inter-bugtracker facilities at
https://help.launchpad.net/InterBugTracking.
------------------------------------------------------------------------
On 2005-01-20T05:23:01+00:00 Ashok-kovai wrote:
OpenSSH doesn't record badlogin attempts in btmp file for all possible
authentication methods supported ( given below ). This patch is an enhancement
to support this feature.
Authentication Methods Supported
---------------------------------
"gssapi-with-mic"
"publickey"
"hostbased"
"password"
"keyboard-interactive"
"challenge-response"
"keyboard-interactive/pam"
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/0
------------------------------------------------------------------------
On 2005-01-20T05:28:53+00:00 Ashok-kovai wrote:
Created attachment 774
BTMP PATCH
BTMP Enhancement Patch attached .
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/1
------------------------------------------------------------------------
On 2005-01-20T05:58:21+00:00 Dtucker wrote:
Redhat (and maybe Solaris?) also have btmp, so setting platform to
"All".
Just so it's clear: the btmp code in loginrec is derived from login from
util-linux correct? If so that's BSD licensed (w/advertising clause) with UCB
as the copyright holder. Since UCB rescinded the advertising clause I think
we're OK to use the code.
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/2
------------------------------------------------------------------------
On 2005-01-20T06:17:07+00:00 Dtucker wrote:
Comment on attachment 774
BTMP PATCH
>+ if ( getuid() != 0 ){
>+ debug("=== calling log_btmp uid %d ===\n", getuid());
>+ mm_log_btmp(authctxt->user,get_canonical_hostname(options.use_dns));
>+ } else {
>+ debug("=== calling log_btmp uid %d ===\n", getuid());
>+ og_btmp(authctxt->user,get_canonical_hostname(options.use_dns));
>+ }
This bit is unnecessary, the PRIVSEP macro is for this purpose, ie:
debug("=== calling log_btmp uid %d ===\n", getuid());
PRIVSEP(log_btmp(authctxt->user,get_canonical_hostname(options.use_dns)));
>+int mm_answer_log_btmp(int socket, Buffer *m){
[...]
>+ buffer_get(m, user ,1024);
>+ buffer_get(m, hostname ,1024);
Sending the username is unecessary as the monitor already knows it (ie
authctxt->user). Hostname can be determined too (see mm_record_login). As a
general rule, as little as possible should be sent from slave to monitor.
It's out of the scope of this bug but I'd prefer to see a generalized
audit_event like in bug #125 in both OpenBSD and Portable, which could be
easily extended to handle cases like this.
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/3
------------------------------------------------------------------------
On 2005-01-20T07:07:34+00:00 Ashok-kovai wrote:
> the btmp code in loginrec is derived from login from util-linux
correct?
Yes referred from util-linux .
> This bit is unnecessary, the PRIVSEP macro is for this purpose, ie:
> debug("=== calling log_btmp uid %d ===\n", getuid());
> PRIVSEP(log_btmp(authctxt->user,get_canonical_hostname(options.use_dns)));
I tried this, PRIVSEP macro may require a redefinition in auth.c. since it
reports a linker error "ld: Unsatisfied symbol "PRIVSEP" in file auth.o"
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/4
------------------------------------------------------------------------
On 2005-01-20T07:15:17+00:00 Dtucker wrote:
(In reply to comment #4)
> I tried this, PRIVSEP macro may require a redefinition in auth.c. since it
> reports a linker error "ld: Unsatisfied symbol "PRIVSEP" in file auth.o"
You just need to add '#include "monitor_wrap.h"' to the headers of
auth.c.
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/5
------------------------------------------------------------------------
On 2005-01-20T08:48:29+00:00 Damien Miller wrote:
Created attachment 776
License from util-linux-2.12p:login-utils/login.c
You must be careful about licensing when importing code. Fortunately this part
of util-linux has a compatible license, but you still must include it when
adding derived code into loginrec.c.
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/6
------------------------------------------------------------------------
On 2005-01-20T10:09:43+00:00 Ashok-kovai wrote:
Created attachment 777
BTMP PATCH
Optimized BTMP patch attached .
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/7
------------------------------------------------------------------------
On 2005-01-20T10:12:03+00:00 Ashok-kovai wrote:
> You just need to add '#include "monitor_wrap.h"' to the headers of auth.c.
Yes, including monitor_wrap.h header file in auth.c solved the problem and
also Optimized the patch further. Thanks
> you still must include it when adding derived code into loginrec.c.
Yes I have included util-linux compatible license in loginrec.c
Note: btmp Path ( /var/adm/btmp ) has been hardcoded in this patch.
Reply at: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/8
------------------------------------------------------------------------
On 2005-01-21T11:18:30+00:00 Ashok-kovai wrote:
Created attachment 780
Optimized BTMP PATCH
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/9
------------------------------------------------------------------------
On 2005-01-21T11:20:52+00:00 Ashok-kovai wrote:
> Sending the username is unecessary as the monitor already knows it (ie
> authctxt->user). Hostname can be determined too (see mm_record_login). As a
> general rule, as little as possible should be sent from slave to monitor.
Yes, I have extracted user and hostname from authctxt->user and
get_canonical_hostname () in monitor.c function .
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/10
------------------------------------------------------------------------
On 2005-01-21T12:13:40+00:00 Ashok-kovai wrote:
Created attachment 781
Optimized Patch Attached
> Sending the username is unecessary as the monitor already knows it (ie
> authctxt->user). Hostname can be determined too (see mm_record_login). As a
> general rule, as little as possible should be sent from slave to
monitor.
Yes, I have extracted user and hostname from authctxt->user and
get_canonical_hostname () in monitor.c function .
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/11
------------------------------------------------------------------------
On 2005-01-21T12:26:09+00:00 Damien Miller wrote:
Comment on attachment 781
Optimized Patch Attached
>--- Orginal/openssh/auth.c 2004-08-12 18:10:25.000000000 +0530
>+++ Patched/openssh/auth.c 2005-01-20 15:13:08.281151112 +0530
>@@ -50,6 +50,7 @@
> #include "misc.h"
> #include "bufaux.h"
> #include "packet.h"
>+#include "monitor_wrap.h"
>
> /* import */
> extern ServerOptions options;
>@@ -230,6 +231,18 @@
> else
> authmsg = authenticated ? "Accepted" : "Failed";
>
>+ if(!authenticated && !authctxt->postponed && (!strcmp(method, "gssapi-with-mic") || !strcmp(method, "publickey") || !strcmp(method, "hostbased"))){
>+ debug("=== calling log_btmp uid %d ===\n", getuid());
>+ PRIVSEP(log_btmp(authctxt->user,get_canonical_hostname(options.use_dns)));
>+ }
>+
>+
>+ if(!authenticated && !authctxt->postponed && (!strcmp(method, "password") || !strcmp(method, " keyboard-interactive") || !strcmp(method,"challenge-response") || !strcmp(method,"keyboard-interactive/pam"))){
>+ if ( getuid() == 0) {
>+ debug("=== calling log_btmp uid %d ===\n", getuid());
These two blocks can be merged. The logging is inconsistent with other debug
calls. The long list of strcmp looks fragile, if we add more auth methods.
>+#define _PATH_BTMP "/var/adm/btmp"
Most of the paths are defined in header files.
>+void
>+log_btmp(const char *username, const char *hostname) {
here (and elsewhere), you aren't following
http://www.openbsd.org/cgi-bin/man.cgi?query=style
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/12
------------------------------------------------------------------------
On 2005-01-21T12:34:38+00:00 Dtucker wrote:
In reply to comment #12)
> >+#define _PATH_BTMP "/var/adm/btmp"
>
> Most of the paths are defined in header files.
This one isn't (in the system headers, that is), at least as far as I can tell.
I figured we'd stick it in the appropriate part of configure when the time
comes (but that's an unnecessary complication right now).
Reply at: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/13
------------------------------------------------------------------------
On 2005-01-24T06:46:14+00:00 Ashok-kovai wrote:
Created attachment 785
Modified BTMP PATCH attached
> if(!authenticated && !authctxt->postponed && (!strcmp(method,
"gssapi-with-mic") || !strcmp(method, "publickey") || !strcmp(method,
"hostbased"))){
> debug("=== calling log_btmp uid %d ===\n", getuid());
>
PRIVSEP(log_btmp(authctxt->user,get_canonical_hostname(options.use_dns)));
> }
>
>
> if(!authenticated && !authctxt->postponed && (!strcmp(method,
"password") || !strcmp(method, " keyboard-interactive") ||
!strcmp(method,"challenge-response") ||
!strcmp(method,"keyboard-interactive/pam"))){
> if ( getuid() == 0) {
> debug("=== calling log_btmp uid %d ===\n", getuid());
> These two blocks can be merged. The logging is inconsistent with other debug
calls. The long list of strcmp looks fragile, > if we add more auth methods.
THese two bloacks were merged as given below.
if (!authenticated && !authctxt->postponed && strcmp(method, "none")) {
debug("Entering log_btmp uid %d ", getuid());
if((!strcmp(method, "gssapi-with-mic") || !strcmp(method, "publickey") ||
!strcmp(method, "hostbased")))
PRIVSEP(log_btmp(authctxt->user,get_canonical_hostname(options.use_dns)));
else if ( getuid()==0)
log_btmp(authctxt->user,get_canonical_hostname(options.use_dns));
}
>void
>log_btmp(const char *username, const char *hostname) {
These coding convention were corrected based on the source file style
guide .
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/14
------------------------------------------------------------------------
On 2005-01-25T11:50:25+00:00 Ashok-kovai wrote:
Created attachment 787
BTMP PATCH Attached
This patch has some correction with that of the pervious one:
1. buffer_append ( ) in mm_log_btmp ( ) is been replaced with
buffer_get_string ( ) to avoid some memory errors due to memcpy copy done from
random heap data.
2 UnWanted entries were removed from two tables 1. struct mon_table
mon_dispatch_postauth20[] 2. struct mon_table mon_dispatch_postauth15[] in
monitor.c .
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/15
------------------------------------------------------------------------
On 2005-02-02T02:06:39+00:00 Dtucker wrote:
Comment on attachment 787
BTMP PATCH Attached
I think we could commit the btmp logging part hooked up to CUSTOM_FAILED_LOGIN
(subject to some changes below) but I think the monitor parts should be
deferred until bug #125 is sorted.
>+#define _PATH_BTMP "/var/adm/btmp"
We'll put this in configure.ac. No big deal.
>+void
>+log_btmp(const char *username, const char *hostname)
>+{
[...]
>+ strcpy(ut.ut_line,"ssh:notty");
We don't use strcpy.
[lots of processing snipped]
>+ if (stat(_PATH_BTMP,&fst) == -1){
[...]
>+ fd = open(_PATH_BTMP, O_WRONLY | O_APPEND);
Not that this is a big deal but stat()ing the file then opening it is racy, and
building the record is a waste of time if you're not going to be able to write
it.
I think the sequence should be: open, fstat, construct record, write.
I'll do a patch with the above changes.
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/16
------------------------------------------------------------------------
On 2005-02-02T06:29:23+00:00 Dtucker wrote:
Created attachment 798
log failed password and kbdint to btmp on Linux and HP-UX
Adapted to use existing record_failed_login hook for password and
keyboard-interactive. Tested OK on Linux (RH9, IPv4 and IPv6) and HP-UX
(11.11, IPv4 only).
It won't do other auth types (pubkey, gssapi, hostbased) at the moment, however
this can be added later (after bug #125 is sorted).
It also extracts the remote socket address via getpeername rather than doing a
lookup on the textual hostname (which is wasteful and may not resolve to the
same address as the connection originated from).
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/17
------------------------------------------------------------------------
On 2005-02-02T06:48:08+00:00 Dtucker wrote:
Created attachment 799
btmp logging: normalise mapped 4in6 addresses too.
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/18
------------------------------------------------------------------------
On 2005-02-02T10:01:53+00:00 Damien Miller wrote:
Comment on attachment 799
btmp logging: normalise mapped 4in6 addresses too.
looks sane to me
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/19
------------------------------------------------------------------------
On 2005-02-02T12:45:42+00:00 Dtucker wrote:
Patch #799 committed, thanks. It will be in the tomorrow's snapshot and the
next major release.
As to logging failures for the other auth types (pubkey, gssapi, hostbased), I
don't think that should be enabled by default since most clients will try those
as a matter of course and some environments might do lockouts based on the failures.
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/20
------------------------------------------------------------------------
On 2005-02-03T05:49:22+00:00 Ashok-kovai wrote:
> + AC_DEFINE(_PATH_BTMP, "/var/log/btmp", [log for bad login attempts])
In HP-UX it is "/var/adm/btmp"
> As to logging failures for the other auth types (pubkey, gssapi, hostbased), I
> don't think that should be enabled by default
How about getting them under a sshd_config directive .
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/21
------------------------------------------------------------------------
On 2005-02-03T06:14:03+00:00 Dtucker wrote:
(In reply to comment #21)
> > + AC_DEFINE(_PATH_BTMP, "/var/log/btmp", [log for bad login attempts])
>
> In HP-UX it is "/var/adm/btmp"
The line you quoted is from the Linux block. On HP-UX it picks up the BTMP_FILE
definition from the system headers (see defines.h). BTMP_FILE is defined on my
11.11 box, if it needs to be added for other versions just let me know which.
> > As to logging failures for the other auth types (pubkey, gssapi, hostbased),
> > Idon't think that should be enabled by default
>
> How about getting them under a sshd_config directive .
I'm not sure. As a rule we try to keep the -Portable only config uptions to a
minimum to preserve our sanity. Maybe a compile-time option to begin with
("-DPARANOID_AUTH_RECORDING" or something).
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/22
------------------------------------------------------------------------
On 2005-02-03T09:07:21+00:00 Ashok-kovai wrote:
Can we log bad login attempts of an invalid user ?
This patch log for "none" method when login attempt is made by a In-valid User.
But works correctly for existing valid user ( doesn't log for "none" method )
1. Disabling "none" doesn't solve
if (authenticated == 0 && !authctxt->postponed && strcmp(method, "none" ) && ...
2. Avoiding Invalid user doesn't solve
if (authenticated == 0 && authctxt->valid && !authctxt->postponed &&
strcmp(method, "none" ) && ....
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/23
------------------------------------------------------------------------
On 2005-02-04T04:22:42+00:00 Dtucker wrote:
(In reply to comment #23)
> This patch log for "none" method when login attempt is made by a invalid user.
> But works correctly for existing valid user (doesn't log for "none" method )
That happens earlier than the auth loop (in getpwnamallow). I'm not sure I want
to change that right now as it's the only place guaranteed to be called for an
invalid user if they try only, eg pubkey authentication then disconnect (because
that occurs purely in the unprivileged child).
We may be able to address that with the AUDIT_EVENTS hooks but those aren't
enabled by default.
Reply at: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/24
------------------------------------------------------------------------
On 2005-03-31T06:00:36+00:00 Senthilkumar-sen wrote:
Created attachment 862
Patch for logging Bad key based Authentications
The attached patch is an enhancement over OpenSSH4.0p1 to support logging of
BAD login attempts for Keybased Authentications.
Reply at:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/501956/comments/25
** Changed in: openssh
Status: Unknown => In Progress
** Changed in: openssh
Importance: Unknown => Wishlist
--
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/501956
Title:
OpenSSH does not log failed attempts when key authentication is used
To manage notifications about this bug go to:
https://bugs.launchpad.net/openssh/+bug/501956/+subscriptions
More information about the Ubuntu-server-bugs
mailing list