auth/auth_log.c

   1 /*
   2
   3    Authentication and authorization logging
   4
   5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2017
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 /*
  22  * Debug log levels for authentication logging (these both map to
  23  * LOG_NOTICE in syslog)
  24  */
  25 #define AUTH_SUCCESS_LEVEL 4
  26 #define AUTHZ_SUCCESS_LEVEL 5
  27 #define AUTH_FAILURE_LEVEL 2
  28
  29 #include "includes.h"
  30 #include "../lib/tsocket/tsocket.h"
  31 #include "common_auth.h"
  32 #include "lib/util/util_str_escape.h"
  33 #include "libcli/security/dom_sid.h"
  34
  35 /*
  36  * Get a human readable timestamp.
  37  *
  38  * Returns the current time formatted as
  39  *  "Tue, 14 Mar 2017 08:38:42.209028 NZDT"
  40  *
  41  * The returned string is allocated by talloc in the supplied context.
  42  * It is the callers responsibility to free it.
  43  *
  44  */
  45 static const char* get_timestamp( TALLOC_CTX *frame )
  46 {
  47         char buffer[40];        /* formatted time less usec and timezone */
  48         char tz[10];            /* formatted time zone                   */
  49         struct tm* tm_info;     /* current local time                    */
  50         struct timeval tv;      /* current system time                   */
  51         int r;                  /* response code from gettimeofday       */
  52         const char * ts;        /* formatted time stamp                  */
  53
  54         r = gettimeofday(&tv, NULL);
  55         if (r) {
  56                 DBG_ERR("Unable to get time of day: (%d) %s\n",
  57                         errno,
  58                         strerror( errno));
  59                 return NULL;
  60         }
  61
  62         tm_info = localtime(&tv.tv_sec);
  63         if (tm_info == NULL) {
  64                 DBG_ERR("Unable to determine local time\n");
  65                 return NULL;
  66         }
  67
  68         strftime(buffer, sizeof(buffer)-1, "%a, %d %b %Y %H:%M:%S", tm_info);
  69         strftime(tz, sizeof(tz)-1, "%Z", tm_info);
  70         ts = talloc_asprintf(frame, "%s.%06ld %s", buffer, tv.tv_usec, tz);
  71         if (ts == NULL) {
  72                 DBG_ERR("Out of memory formatting time stamp\n");
  73         }
  74         return ts;
  75 }
  76
  77 /*
  78  * Determine the type of the password supplied for the
  79  * authorisation attempt.
  80  *
  81  */
  82 static const char* get_password_type(const struct auth_usersupplied_info *ui)
  83 {
  84
  85         const char *password_type = NULL;
  86
  87         if (ui->password_state == AUTH_PASSWORD_RESPONSE &&
  88             (ui->logon_parameters & MSV1_0_ALLOW_MSVCHAPV2) &&
  89             ui->password.response.nt.length == 24) {
  90                 password_type = "MSCHAPv2";
  91         } else if ((ui->logon_parameters & MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED)
  92                    || (ui->password_state == AUTH_PASSWORD_PLAIN)) {
  93                 password_type = "Plaintext";
  94         } else if (ui->password_state == AUTH_PASSWORD_HASH) {
  95                 password_type = "Supplied-NT-Hash";
  96         } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
  97                    && ui->password.response.nt.length > 24) {
  98                 password_type = "NTLMv2";
  99         } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
 100                    && ui->password.response.nt.length == 24) {
 101                 password_type = "NTLMv1";
 102         } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
 103                    && ui->password.response.lanman.length == 24) {
 104                 password_type = "LANMan";
 105         } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
 106                    && ui->password.response.nt.length == 0
 107                    && ui->password.response.lanman.length == 0) {
 108                 password_type = "No-Password";
 109         }
 110         return password_type;
 111 }
 112
 113 /*
 114  * Log details of an authentication attempt.
 115  * Successful and unsuccessful attempts are logged.
 116  *
 117  */
 118 void log_authentication_event(const struct auth_usersupplied_info *ui,
 119                               NTSTATUS status,
 120                               const char *domain_name,
 121                               const char *account_name,
 122                               const char *unix_username,
 123                               struct dom_sid *sid)
 124 {
 125         TALLOC_CTX *frame = NULL;
 126
 127         const char *ts = NULL;             /* formatted current time      */
 128         char *remote = NULL;               /* formatted remote host       */
 129         char *local = NULL;                /* formatted local host        */
 130         char *nl = NULL;                   /* NETLOGON details if present */
 131         char *trust_computer_name = NULL;
 132         char *trust_account_name = NULL;
 133         char *logon_line = NULL;
 134         const char *password_type = NULL;
 135
 136         /* set the log level */
 137         int  level = NT_STATUS_IS_OK(status) ? AUTH_FAILURE_LEVEL : AUTH_SUCCESS_LEVEL;
 138         if (!CHECK_DEBUGLVLC( DBGC_AUTH_AUDIT, level)) {
 139                 return;
 140         }
 141
 142         frame = talloc_stackframe();
 143
 144         password_type = get_password_type( ui);
 145         /* Get the current time */
 146         ts = get_timestamp(frame);
 147
 148         /* Only log the NETLOGON details if they are present */
 149         if (ui->netlogon_trust_account.computer_name ||
 150             ui->netlogon_trust_account.account_name) {
 151                 trust_computer_name = log_escape(frame,
 152                         ui->netlogon_trust_account.computer_name);
 153                 trust_account_name  = log_escape(frame,
 154                         ui->netlogon_trust_account.account_name);
 155                 nl = talloc_asprintf(frame,
 156                         " NETLOGON computer [%s] trust account [%s]",
 157                         trust_computer_name, trust_account_name);
 158         }
 159
 160         remote = tsocket_address_string(ui->remote_host, frame);
 161         local  = tsocket_address_string(ui->local_host, frame);
 162
 163         if (NT_STATUS_IS_OK(status)) {
 164                 char sid_buf[DOM_SID_STR_BUFLEN];
 165
 166                 dom_sid_string_buf(sid, sid_buf, sizeof(sid_buf));
 167                 logon_line = talloc_asprintf(frame,
 168                                              " became [%s]\\[%s] [%s].",
 169                                              log_escape(frame, domain_name),
 170                                              log_escape(frame, account_name),
 171                                              sid_buf);
 172         } else {
 173                 logon_line = talloc_asprintf(frame,
 174                                              " mapped to [%s]\\[%s].",
 175                                              log_escape(frame, ui->mapped.domain_name),
 176                                              log_escape(frame, ui->mapped.account_name));
 177         }
 178
 179         DEBUGC( DBGC_AUTH_AUDIT, level, (
 180                 "Auth: [%s,%s] user [%s]\\[%s]"
 181                 " at [%s] with [%s] status [%s]"
 182                 " workstation [%s] remote host [%s]"
 183                 "%s local host [%s]"
 184                 " %s\n",
 185                 ui->service_description,
 186                 ui->auth_description,
 187                 log_escape(frame, ui->client.domain_name),
 188                 log_escape(frame, ui->client.account_name),
 189                 ts,
 190                 password_type,
 191                 nt_errstr( status),
 192                 log_escape(frame, ui->workstation_name),
 193                 remote,
 194                 logon_line,
 195                 local,
 196                 nl ? nl : ""
 197                 ));
 198
 199         talloc_free(frame);
 200 }
 201
 202
 203 /*
 204  * Log details of a successful authorization to a service.
 205  *
 206  * Only successful authorizations are logged.  For clarity:
 207  * - NTLM bad passwords will be recorded by the above
 208  * - Kerberos decrypt failures need to be logged in gensec_gssapi et al
 209  *
 210  * The service may later refuse authorization due to an ACL.
 211  *
 212  */
 213 void log_successful_authz_event(const struct tsocket_address *remote,
 214                                 const struct tsocket_address *local,
 215                                 const char *service_description,
 216                                 const char *auth_type,
 217                                 struct auth_session_info *session_info)
 218 {
 219         TALLOC_CTX *frame = NULL;
 220
 221         const char *ts = NULL;       /* formatted current time      */
 222         char *remote_str = NULL;     /* formatted remote host       */
 223         char *local_str = NULL;      /* formatted local host        */
 224         char sid_buf[DOM_SID_STR_BUFLEN];
 225
 226         /* set the log level */
 227         if (!CHECK_DEBUGLVLC( DBGC_AUTH_AUDIT, AUTHZ_SUCCESS_LEVEL)) {
 228                 return;
 229         }
 230
 231         frame = talloc_stackframe();
 232
 233         /* Get the current time */
 234         ts = get_timestamp(frame);
 235
 236         remote_str = tsocket_address_string(remote, frame);
 237         local_str  = tsocket_address_string(local, frame);
 238
 239         dom_sid_string_buf(&session_info->security_token->sids[0], sid_buf, sizeof(sid_buf));
 240
 241         DEBUGC( DBGC_AUTH_AUDIT, AUTHZ_SUCCESS_LEVEL, (
 242                 "Successful AuthZ: [%s,%s] user [%s]\\[%s] [%s]"
 243                 " at [%s]"
 244                 " Remote host [%s]"
 245                 " local host [%s]\n",
 246                 service_description,
 247                 auth_type,
 248                 log_escape(frame, session_info->info->domain_name),
 249                 log_escape(frame, session_info->info->account_name),
 250                 sid_buf,
 251                 ts,
 252                 remote_str,
 253                 local_str));
 254
 255         talloc_free(frame);
 256 }