sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-22 05:57:43 +03:00
Code

auth_log: Also log the final type of authentication (ntlmssp,krb5)

Browse Source 
Administrators really care about how their users were authenticated, so make
this clear.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz>
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
This commit is contained in:
Andrew Bartlett 2017-03-01 16:00:03 +13:00
parent 46a800fae3
commit 0e508853fc
11 changed files with 91 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
auth/auth_log.c
View File

@ -213,6 +213,7 @@ void log_authentication_event(const struct auth_usersupplied_info *ui,
void log_successful_authz_event(const struct tsocket_address *remote,
const struct tsocket_address *local,
const char *service_description,
const char *auth_type,
struct auth_session_info *session_info)
{
TALLOC_CTX *frame = NULL;
@ -238,11 +239,12 @@ void log_successful_authz_event(const struct tsocket_address *remote,
dom_sid_string_buf(&session_info->security_token->sids[0], sid_buf, sizeof(sid_buf));
DEBUGC( DBGC_AUTH_AUDIT, AUTHZ_SUCCESS_LEVEL, (
"Successful AuthZ: [%s] user [%s]\\[%s] [%s]"
"Successful AuthZ: [%s,%s] user [%s]\\[%s] [%s]"
" at [%s]"
" Remote host [%s]"
" local host [%s]\n",
service_description,
auth_type,
log_escape(frame, session_info->info->domain_name),
log_escape(frame, session_info->info->account_name),
sid_buf,

1
auth/common_auth.h
View File

@ -156,5 +156,6 @@ void log_authentication_event(const struct auth_usersupplied_info *ui,
void log_successful_authz_event(const struct tsocket_address *remote,
const struct tsocket_address *local,
const char *service_description,
const char *auth_type,
struct auth_session_info *session_info);
#endif

16
auth/gensec/gensec.c
View File

@ -193,6 +193,15 @@ _PUBLIC_ NTSTATUS gensec_session_key(struct gensec_security *gensec_security,
return gensec_security->ops->session_key(gensec_security, mem_ctx, session_key);
}
const char *gensec_final_auth_type(struct gensec_security *gensec_security)
{
if (!gensec_security->ops->final_auth_type) {
return gensec_security->ops->name;
}
return gensec_security->ops->final_auth_type(gensec_security);
}
/*
* Log details of a successful GENSEC authorization to a service.
*
@ -210,7 +219,12 @@ static void log_successful_gensec_authz_event(struct gensec_security *gensec_sec
= gensec_get_local_address(gensec_security);
const char *service_description
= gensec_get_target_service_description(gensec_security);
log_successful_authz_event(remote, local, service_description, session_info);
const char *final_auth_type
= gensec_final_auth_type(gensec_security);
log_successful_authz_event(remote, local,
service_description,
final_auth_type,
session_info);
}

3
auth/gensec/gensec.h
View File

@ -34,6 +34,9 @@
#define GENSEC_OID_KERBEROS5_OLD "1.2.840.48018.1.2.2"
#define GENSEC_OID_KERBEROS5_USER2USER "1.2.840.113554.1.2.2.3"
#define GENSEC_FINAL_AUTH_TYPE_KRB5 "krb5"
#define GENSEC_FINAL_AUTH_TYPE_NTLMSSP "NTLMSSP"
enum gensec_priority {
GENSEC_SPNEGO = 90,
GENSEC_GSSAPI = 80,

3
auth/gensec/gensec_internal.h
View File

@ -85,6 +85,7 @@ struct gensec_security_ops {
bool (*have_feature)(struct gensec_security *gensec_security,
uint32_t feature);
NTTIME (*expire_time)(struct gensec_security *gensec_security);
const char *(*final_auth_type)(struct gensec_security *gensec_security);
bool enabled;
bool kerberos;
enum gensec_priority priority;
@ -126,4 +127,6 @@ struct gensec_critical_sizes {
NTSTATUS gensec_may_reset_crypto(struct gensec_security *gensec_security,
bool full_reset);
const char *gensec_final_auth_type(struct gensec_security *gensec_security);
#endif /* __GENSEC_H__ */

12
auth/gensec/spnego.c
View File

@ -1651,6 +1651,17 @@ static NTTIME gensec_spnego_expire_time(struct gensec_security *gensec_security)
return gensec_expire_time(spnego_state->sub_sec_security);
}
static const char *gensec_spnego_final_auth_type(struct gensec_security *gensec_security)
{
struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
if (!spnego_state->sub_sec_security) {
return "NONE";
} else {
return gensec_final_auth_type(spnego_state->sub_sec_security);
}
}
static const char *gensec_spnego_oids[] = {
GENSEC_OID_SPNEGO,
NULL
@ -1678,6 +1689,7 @@ static const struct gensec_security_ops gensec_spnego_security_ops = {
.want_feature = gensec_spnego_want_feature,
.have_feature = gensec_spnego_have_feature,
.expire_time = gensec_spnego_expire_time,
.final_auth_type = gensec_spnego_final_auth_type,
.enabled = true,
.priority = GENSEC_SPNEGO
};

6
auth/ntlmssp/ntlmssp.c
View File

@ -207,6 +207,11 @@ static NTSTATUS gensec_ntlmssp_may_reset_crypto(struct gensec_security *gensec_s
return NT_STATUS_OK;
}
static const char *gensec_ntlmssp_final_auth_type(struct gensec_security *gensec_security)
{
return GENSEC_FINAL_AUTH_TYPE_NTLMSSP;
}
static const char *gensec_ntlmssp_oids[] = {
GENSEC_OID_NTLMSSP,
NULL
@ -232,6 +237,7 @@ static const struct gensec_security_ops gensec_ntlmssp_security_ops = {
.session_key = gensec_ntlmssp_session_key,
.session_info = gensec_ntlmssp_session_info,
.have_feature = gensec_ntlmssp_have_feature,
.final_auth_type = gensec_ntlmssp_final_auth_type,
.enabled = true,
.priority = GENSEC_NTLMSSP
};

9
auth/ntlmssp/ntlmssp_server.c
View File

@ -721,7 +721,14 @@ static NTSTATUS ntlmssp_server_check_password(struct gensec_security *gensec_sec
user_info->local_host = gensec_get_local_address(gensec_security);
user_info->service_description
= gensec_get_target_service_description(gensec_security);
user_info->auth_description = "NTLMSSP";
/*
* This will just be the string "NTLMSSP" from
* gensec_ntlmssp_final_auth_type, but ensures it stays in sync
* with the same use in the authorization logging triggered by
* gensec_session_info() later
*/
user_info->auth_description = gensec_final_auth_type(gensec_security);
user_info->password_state = AUTH_PASSWORD_RESPONSE;
user_info->password.response.lanman = ntlmssp_state->lm_resp;

16
source3/librpc/crypto/gse.c
View File

@ -1275,6 +1275,21 @@ static size_t gensec_gse_sig_size(struct gensec_security *gensec_security,
return gse_ctx->sig_size;
}
static const char *gensec_gse_final_auth_type(struct gensec_security *gensec_security)
{
struct gse_context *gse_ctx =
talloc_get_type_abort(gensec_security->private_data,
struct gse_context);
/* Only return the string for GSSAPI/Krb5 */
if (smb_gss_oid_equal(&gse_ctx->gss_mech,
gss_mech_krb5)) {
return GENSEC_FINAL_AUTH_TYPE_KRB5;
} else {
return "gensec_gse: UNKNOWN MECH";
}
}
static const char *gensec_gse_krb5_oids[] = {
GENSEC_OID_KERBEROS5_OLD,
GENSEC_OID_KERBEROS5,
@ -1302,6 +1317,7 @@ const struct gensec_security_ops gensec_gse_krb5_security_ops = {
.unwrap = gensec_gse_unwrap,
.have_feature = gensec_gse_have_feature,
.expire_time = gensec_gse_expire_time,
.final_auth_type = gensec_gse_final_auth_type,
.enabled = true,
.kerberos = true,
.priority = GENSEC_GSSAPI

16
source4/auth/gensec/gensec_gssapi.c
View File

@ -1539,6 +1539,19 @@ static size_t gensec_gssapi_sig_size(struct gensec_security *gensec_security, si
return gensec_gssapi_state->sig_size;
}
static const char *gensec_gssapi_final_auth_type(struct gensec_security *gensec_security)
{
struct gensec_gssapi_state *gensec_gssapi_state
= talloc_get_type(gensec_security->private_data, struct gensec_gssapi_state);
/* Only return the string for GSSAPI/Krb5 */
if (smb_gss_oid_equal(gensec_gssapi_state->gss_oid,
gss_mech_krb5)) {
return GENSEC_FINAL_AUTH_TYPE_KRB5;
} else {
return "gensec_gssapi: UNKNOWN MECH";
}
}
static const char *gensec_gssapi_krb5_oids[] = {
GENSEC_OID_KERBEROS5_OLD,
GENSEC_OID_KERBEROS5,
@ -1572,6 +1585,7 @@ static const struct gensec_security_ops gensec_gssapi_spnego_security_ops = {
.unwrap = gensec_gssapi_unwrap,
.have_feature = gensec_gssapi_have_feature,
.expire_time = gensec_gssapi_expire_time,
.final_auth_type = gensec_gssapi_final_auth_type,
.enabled = false,
.kerberos = true,
.priority = GENSEC_GSSAPI
@ -1599,6 +1613,7 @@ static const struct gensec_security_ops gensec_gssapi_krb5_security_ops = {
.unwrap = gensec_gssapi_unwrap,
.have_feature = gensec_gssapi_have_feature,
.expire_time = gensec_gssapi_expire_time,
.final_auth_type = gensec_gssapi_final_auth_type,
.enabled = true,
.kerberos = true,
.priority = GENSEC_GSSAPI
@ -1619,6 +1634,7 @@ static const struct gensec_security_ops gensec_gssapi_sasl_krb5_security_ops = {
.unwrap = gensec_gssapi_unwrap,
.have_feature = gensec_gssapi_have_feature,
.expire_time = gensec_gssapi_expire_time,
.final_auth_type = gensec_gssapi_final_auth_type,
.enabled = true,
.kerberos = true,
.priority = GENSEC_GSSAPI

9
source4/auth/gensec/gensec_krb5.c
View File

@ -1038,6 +1038,11 @@ static bool gensec_krb5_have_feature(struct gensec_security *gensec_security,
return false;
}
static const char *gensec_krb5_final_auth_type(struct gensec_security *gensec_security)
{
return GENSEC_FINAL_AUTH_TYPE_KRB5;
}
static const char *gensec_krb5_oids[] = {
GENSEC_OID_KERBEROS5,
GENSEC_OID_KERBEROS5_OLD,
@ -1055,9 +1060,10 @@ static const struct gensec_security_ops gensec_fake_gssapi_krb5_security_ops = {
.session_key = gensec_krb5_session_key,
.session_info = gensec_krb5_session_info,
.have_feature = gensec_krb5_have_feature,
.final_auth_type = gensec_krb5_final_auth_type,
.enabled = false,
.kerberos = true,
.priority = GENSEC_KRB5
.priority = GENSEC_KRB5,
};
static const struct gensec_security_ops gensec_krb5_security_ops = {
@ -1070,6 +1076,7 @@ static const struct gensec_security_ops gensec_krb5_security_ops = {
.have_feature = gensec_krb5_have_feature,
.wrap = gensec_krb5_wrap,
.unwrap = gensec_krb5_unwrap,
.final_auth_type = gensec_krb5_final_auth_type,
.enabled = true,
.kerberos = true,
.priority = GENSEC_KRB5