3 Authentication and authorization logging
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2017
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 * Debug log levels for authentication logging (these both map to
23 * LOG_NOTICE in syslog)
25 #define AUTH_FAILURE_LEVEL 2
26 #define AUTH_SUCCESS_LEVEL 3
27 #define AUTHZ_SUCCESS_LEVEL 4
29 /* 5 is used for both authentication and authorization */
30 #define AUTH_ANONYMOUS_LEVEL 5
31 #define AUTHZ_ANONYMOUS_LEVEL 5
33 #define AUTHZ_JSON_TYPE "Authorization"
34 #define AUTH_JSON_TYPE "Authentication"
37 * JSON message version numbers
39 * If adding a field increment the minor version
40 * If removing or changing the format/meaning of a field
41 * increment the major version.
49 #include "../lib/tsocket/tsocket.h"
50 #include "common_auth.h"
51 #include "lib/util/util_str_escape.h"
52 #include "libcli/security/dom_sid.h"
53 #include "libcli/security/security_token.h"
56 * Get a human readable timestamp.
58 * Returns the current time formatted as
59 * "Tue, 14 Mar 2017 08:38:42.209028 NZDT"
61 * The returned string is allocated by talloc in the supplied context.
62 * It is the callers responsibility to free it.
65 static const char* get_timestamp( TALLOC_CTX *frame )
67 char buffer[40]; /* formatted time less usec and timezone */
68 char tz[10]; /* formatted time zone */
69 struct tm* tm_info; /* current local time */
70 struct timeval tv; /* current system time */
71 int r; /* response code from gettimeofday */
72 const char * ts; /* formatted time stamp */
74 r = gettimeofday(&tv, NULL);
76 DBG_ERR("Unable to get time of day: (%d) %s\n",
82 tm_info = localtime(&tv.tv_sec);
83 if (tm_info == NULL) {
84 DBG_ERR("Unable to determine local time\n");
88 strftime(buffer, sizeof(buffer)-1, "%a, %d %b %Y %H:%M:%S", tm_info);
89 strftime(tz, sizeof(tz)-1, "%Z", tm_info);
90 ts = talloc_asprintf(frame, "%s.%06ld %s", buffer, tv.tv_usec, tz);
92 DBG_ERR("Out of memory formatting time stamp\n");
98 * Determine the type of the password supplied for the
99 * authorisation attempt.
102 static const char* get_password_type(const struct auth_usersupplied_info *ui);
107 #include "system/time.h"
110 * Context required by the JSON generation
114 struct json_context {
120 * Write the json object to the debug lines.
123 static void log_json( struct json_context *context,
124 const char *type, int debug_class, int debug_level)
128 if( context->error) {
132 json = json_dumps( context->root, 0);
134 DBG_ERR( "Unable to convert JSON object to string\n");
135 context->error = true;
139 DEBUGC( debug_class, debug_level, ( "JSON %s: %s\n", type, json));
148 * Create a new json logging context.
150 * Free with a call to free_json_context
153 static struct json_context get_json_context( void) {
155 struct json_context context;
156 context.error = false;
158 context.root = json_object();
159 if (context.root == NULL) {
160 context.error = true;
161 DBG_ERR("Unable to create json_object\n");
167 * free a previously created json_context
170 static void free_json_context(struct json_context *context)
173 json_decref( context->root);
178 * Output a JSON pair with name name and integer value value
181 static void add_int(struct json_context *context,
187 if (context->error) {
191 rc = json_object_set_new( context->root, name, json_integer( value));
193 DBG_ERR("Unable to set name [%s] value [%d]\n", name, value);
194 context->error = true;
200 * Output a JSON pair with name name and string value value
203 static void add_string(struct json_context *context,
209 if (context->error) {
214 rc = json_object_set_new(context->root, name, json_string(value));
216 rc = json_object_set_new(context->root, name, json_null());
219 DBG_ERR("Unable to set name [%s] value [%s]\n", name, value);
220 context->error = true;
226 * Output a JSON pair with name name and object value
229 static void add_object(struct json_context *context,
231 struct json_context *value)
236 context->error = true;
238 if (context->error) {
241 rc = json_object_set_new(context->root, name, value->root);
243 DBG_ERR("Unable to add object [%s]\n", name);
244 context->error = true;
249 * Output a version object
251 * "version":{"major":1,"minor":0}
254 static void add_version( struct json_context *context, int major, int minor)
256 struct json_context version = get_json_context();
257 add_int(&version, "major", major);
258 add_int(&version, "minor", minor);
259 add_object(context, "version", &version);
263 * Output the current date and time as a timestamp in ISO 8601 format
265 * "timestamp":"2017-03-06T17:18:04.455081+1300"
268 static void add_timestamp( struct json_context *context)
270 char buffer[40]; /* formatted time less usec and timezone */
271 char timestamp[50]; /* the formatted ISO 8601 time stamp */
272 char tz[10]; /* formatted time zone */
273 struct tm* tm_info; /* current local time */
274 struct timeval tv; /* current system time */
275 int r; /* response code from gettimeofday */
277 if (context->error) {
281 r = gettimeofday(&tv, NULL);
283 DBG_ERR("Unable to get time of day: (%d) %s\n",
286 context->error = true;
290 tm_info = localtime(&tv.tv_sec);
291 if (tm_info == NULL) {
292 DBG_ERR("Unable to determine local time\n");
293 context->error = true;
297 strftime(buffer, sizeof(buffer)-1, "%Y-%m-%dT%T", tm_info);
298 strftime(tz, sizeof(tz)-1, "%z", tm_info);
299 snprintf(timestamp, sizeof(timestamp),"%s.%06ld%s",
300 buffer, tv.tv_usec, tz);
301 add_string(context,"timestamp", timestamp);
306 * Output an address pair, with name name.
308 * "localAddress":"ipv6::::0"
311 static void add_address(struct json_context *context,
313 const struct tsocket_address *address)
316 TALLOC_CTX *frame = talloc_stackframe();
318 if (context->error) {
322 s = tsocket_address_string(address, frame);
323 add_string(context, name, s);
329 * Output a SID with name name
334 static void add_sid(struct json_context *context,
336 const struct dom_sid *sid)
338 char sid_buf[DOM_SID_STR_BUFLEN];
340 if (context->error) {
344 dom_sid_string_buf(sid, sid_buf, sizeof(sid_buf));
345 add_string(context, name, sid_buf);
349 * Write a machine parsable json formatted authentication log entry.
351 * IF removing or changing the format/meaning of a field please update the
352 * major version number AUTH_MAJOR
354 * IF adding a new field please update the minor version number AUTH_MINOR
356 * To process the resulting log lines from the commend line use jq to
359 * grep "JSON Authentication" log file |
361 * jq -rc '"\(.timestamp)\t\(.Authentication.status)\t
362 * \(.Authentication.clientDomain)\t
363 * \(.Authentication.clientAccount)
364 * \t\(.Authentication.workstation)
365 * \t\(.Authentication.remoteAddress)
366 * \t\(.Authentication.localAddress)"'
368 static void log_authentication_event_json(
369 const struct auth_usersupplied_info *ui,
371 const char *domain_name,
372 const char *account_name,
373 const char *unix_username,
377 struct json_context context = get_json_context();
378 struct json_context authentication;
379 char negotiate_flags[11];
381 add_timestamp(&context);
382 add_string(&context, "type", AUTH_JSON_TYPE);
384 authentication = get_json_context();
385 add_version(&authentication, AUTH_MAJOR, AUTH_MINOR);
386 add_string(&authentication, "status", nt_errstr( status));
387 add_address(&authentication, "localAddress", ui->local_host);
388 add_address(&authentication, "remoteAddress", ui->remote_host);
389 add_string(&authentication,
390 "serviceDescription",
391 ui->service_description);
392 add_string(&authentication, "authDescription", ui->auth_description);
393 add_string(&authentication, "clientDomain", ui->client.domain_name);
394 add_string(&authentication, "clientAccount", ui->client.account_name);
395 add_string(&authentication, "workstation", ui->workstation_name);
396 add_string(&authentication, "becameAccount", account_name);
397 add_string(&authentication, "becameDomain", domain_name);
398 add_sid(&authentication, "becameSid", sid);
399 add_string(&authentication, "mappedAccount", ui->mapped.account_name);
400 add_string(&authentication, "mappedDomain", ui->mapped.domain_name);
401 add_string(&authentication,
403 ui->netlogon_trust_account.computer_name);
404 add_string(&authentication,
405 "netlogonTrustAccount",
406 ui->netlogon_trust_account.account_name);
407 snprintf(negotiate_flags,
408 sizeof( negotiate_flags),
410 ui->netlogon_trust_account.negotiate_flags);
411 add_string(&authentication, "netlogonNegotiateFlags", negotiate_flags);
412 add_int(&authentication,
413 "netlogonSecureChannelType",
414 ui->netlogon_trust_account.secure_channel_type);
415 add_sid(&authentication,
416 "netlogonTrustAccountSid",
417 ui->netlogon_trust_account.sid);
418 add_string(&authentication, "passwordType", get_password_type( ui));
419 add_object(&context,AUTH_JSON_TYPE, &authentication);
421 log_json(&context, AUTH_JSON_TYPE, DBGC_AUTH_AUDIT, debug_level);
422 free_json_context(&context);
426 * Log details of a successful authorization to a service,
427 * in a machine parsable json format
429 * IF removing or changing the format/meaning of a field please update the
430 * major version number AUTHZ_MAJOR
432 * IF adding a new field please update the minor version number AUTHZ_MINOR
434 * To process the resulting log lines from the commend line use jq to
437 * grep "JSON Authentication" log_file |\
438 * sed "s;^[^{]*;;" |\
439 * jq -rc '"\(.timestamp)\t
440 * \(.Authorization.domain)\t
441 * \(.Authorization.account)\t
442 * \(.Authorization.remoteAddress)"'
445 static void log_successful_authz_event_json(
446 const struct tsocket_address *remote,
447 const struct tsocket_address *local,
448 const char *service_description,
449 const char *auth_type,
450 const char *transport_protection,
451 struct auth_session_info *session_info,
454 struct json_context context = get_json_context();
455 struct json_context authorization;
456 char account_flags[11];
458 //start_object(&context, NULL);
459 add_timestamp(&context);
460 add_string(&context, "type", AUTHZ_JSON_TYPE);
461 authorization = get_json_context();
462 add_version(&authorization, AUTHZ_MAJOR, AUTHZ_MINOR);
463 add_address(&authorization, "localAddress", local);
464 add_address(&authorization, "remoteAddress", remote);
465 add_string(&authorization, "serviceDescription", service_description);
466 add_string(&authorization, "authType", auth_type);
467 add_string(&authorization, "domain", session_info->info->domain_name);
468 add_string(&authorization, "account", session_info->info->account_name);
469 add_sid(&authorization, "sid", &session_info->security_token->sids[0]);
470 add_string(&authorization,
472 session_info->info->logon_server);
473 add_string(&authorization, "transportProtection", transport_protection);
475 snprintf(account_flags,
476 sizeof( account_flags),
478 session_info->info->acct_flags);
479 add_string(&authorization, "accountFlags", account_flags);
480 add_object(&context,AUTHZ_JSON_TYPE, &authorization);
486 free_json_context(&context);
491 static void log_authentication_event_json(
492 const struct auth_usersupplied_info *ui,
494 const char *domain_name,
495 const char *account_name,
496 const char *unix_username,
503 static void log_successful_authz_event_json(
504 const struct tsocket_address *remote,
505 const struct tsocket_address *local,
506 const char *service_description,
507 const char *auth_type,
508 const char *transport_protection,
509 struct auth_session_info *session_info,
518 * Determine the type of the password supplied for the
519 * authorisation attempt.
522 static const char* get_password_type(const struct auth_usersupplied_info *ui)
525 const char *password_type = NULL;
527 if (ui->password_state == AUTH_PASSWORD_RESPONSE &&
528 (ui->logon_parameters & MSV1_0_ALLOW_MSVCHAPV2) &&
529 ui->password.response.nt.length == 24) {
530 password_type = "MSCHAPv2";
531 } else if ((ui->logon_parameters & MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED)
532 || (ui->password_state == AUTH_PASSWORD_PLAIN)) {
533 password_type = "Plaintext";
534 } else if (ui->password_state == AUTH_PASSWORD_HASH) {
535 password_type = "Supplied-NT-Hash";
536 } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
537 && ui->password.response.nt.length > 24) {
538 password_type = "NTLMv2";
539 } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
540 && ui->password.response.nt.length == 24) {
541 password_type = "NTLMv1";
542 } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
543 && ui->password.response.lanman.length == 24) {
544 password_type = "LANMan";
545 } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
546 && ui->password.response.nt.length == 0
547 && ui->password.response.lanman.length == 0) {
548 password_type = "No-Password";
550 return password_type;
554 * Write a human readable authentication log entry.
557 static void log_authentication_event_human_readable(
558 const struct auth_usersupplied_info *ui,
560 const char *domain_name,
561 const char *account_name,
562 const char *unix_username,
566 TALLOC_CTX *frame = NULL;
568 const char *ts = NULL; /* formatted current time */
569 char *remote = NULL; /* formatted remote host */
570 char *local = NULL; /* formatted local host */
571 char *nl = NULL; /* NETLOGON details if present */
572 char *trust_computer_name = NULL;
573 char *trust_account_name = NULL;
574 char *logon_line = NULL;
575 const char *password_type = NULL;
577 frame = talloc_stackframe();
579 password_type = get_password_type( ui);
580 /* Get the current time */
581 ts = get_timestamp(frame);
583 /* Only log the NETLOGON details if they are present */
584 if (ui->netlogon_trust_account.computer_name ||
585 ui->netlogon_trust_account.account_name) {
586 trust_computer_name = log_escape(frame,
587 ui->netlogon_trust_account.computer_name);
588 trust_account_name = log_escape(frame,
589 ui->netlogon_trust_account.account_name);
590 nl = talloc_asprintf(frame,
591 " NETLOGON computer [%s] trust account [%s]",
592 trust_computer_name, trust_account_name);
595 remote = tsocket_address_string(ui->remote_host, frame);
596 local = tsocket_address_string(ui->local_host, frame);
598 if (NT_STATUS_IS_OK(status)) {
599 char sid_buf[DOM_SID_STR_BUFLEN];
601 dom_sid_string_buf(sid, sid_buf, sizeof(sid_buf));
602 logon_line = talloc_asprintf(frame,
603 " became [%s]\\[%s] [%s].",
604 log_escape(frame, domain_name),
605 log_escape(frame, account_name),
608 logon_line = talloc_asprintf(
610 " mapped to [%s]\\[%s].",
611 log_escape(frame, ui->mapped.domain_name),
612 log_escape(frame, ui->mapped.account_name));
615 DEBUGC( DBGC_AUTH_AUDIT, debug_level, (
616 "Auth: [%s,%s] user [%s]\\[%s]"
617 " at [%s] with [%s] status [%s]"
618 " workstation [%s] remote host [%s]"
621 ui->service_description,
622 ui->auth_description,
623 log_escape(frame, ui->client.domain_name),
624 log_escape(frame, ui->client.account_name),
628 log_escape(frame, ui->workstation_name),
639 * Log details of an authentication attempt.
640 * Successful and unsuccessful attempts are logged.
642 * NOTE: msg_ctx and lp_ctx is optional, but when supplied allows streaming the
643 * authentication events over the message bus.
645 void log_authentication_event( const struct auth_usersupplied_info *ui,
647 const char *domain_name,
648 const char *account_name,
649 const char *unix_username,
652 /* set the log level */
653 int debug_level = AUTH_FAILURE_LEVEL;
655 if (NT_STATUS_IS_OK(status)) {
656 debug_level = AUTH_SUCCESS_LEVEL;
657 if (dom_sid_equal(sid, &global_sid_Anonymous)) {
658 debug_level = AUTH_ANONYMOUS_LEVEL;
662 if (CHECK_DEBUGLVLC( DBGC_AUTH_AUDIT, debug_level)) {
663 log_authentication_event_human_readable(ui,
671 if (CHECK_DEBUGLVLC( DBGC_AUTH_AUDIT_JSON, debug_level)) {
672 log_authentication_event_json(ui,
685 * Log details of a successful authorization to a service,
686 * in a human readable format.
689 static void log_successful_authz_event_human_readable(
690 const struct tsocket_address *remote,
691 const struct tsocket_address *local,
692 const char *service_description,
693 const char *auth_type,
694 const char *transport_protection,
695 struct auth_session_info *session_info,
698 TALLOC_CTX *frame = NULL;
700 const char *ts = NULL; /* formatted current time */
701 char *remote_str = NULL; /* formatted remote host */
702 char *local_str = NULL; /* formatted local host */
703 char sid_buf[DOM_SID_STR_BUFLEN];
705 frame = talloc_stackframe();
707 /* Get the current time */
708 ts = get_timestamp(frame);
710 remote_str = tsocket_address_string(remote, frame);
711 local_str = tsocket_address_string(local, frame);
713 dom_sid_string_buf(&session_info->security_token->sids[0],
717 DEBUGC( DBGC_AUTH_AUDIT, debug_level, (
718 "Successful AuthZ: [%s,%s] user [%s]\\[%s] [%s]"
721 " local host [%s]\n",
724 log_escape(frame, session_info->info->domain_name),
725 log_escape(frame, session_info->info->account_name),
735 * Log details of a successful authorization to a service.
737 * Only successful authorizations are logged. For clarity:
738 * - NTLM bad passwords will be recorded by log_authentication_event
739 * - Kerberos decrypt failures need to be logged in gensec_gssapi et al
741 * The service may later refuse authorization due to an ACL.
743 * NOTE: msg_ctx and lp_ctx is optional, but when supplied allows streaming the
744 * authentication events over the message bus.
746 void log_successful_authz_event(const struct tsocket_address *remote,
747 const struct tsocket_address *local,
748 const char *service_description,
749 const char *auth_type,
750 const char *transport_protection,
751 struct auth_session_info *session_info)
753 int debug_level = AUTHZ_SUCCESS_LEVEL;
755 /* set the log level */
756 if (security_token_is_anonymous(session_info->security_token)) {
757 debug_level = AUTH_ANONYMOUS_LEVEL;
760 if (CHECK_DEBUGLVLC( DBGC_AUTH_AUDIT, debug_level)) {
761 log_successful_authz_event_human_readable(remote,
765 transport_protection,
769 if (CHECK_DEBUGLVLC( DBGC_AUTH_AUDIT_JSON, debug_level)) {
770 log_successful_authz_event_json(remote,
774 transport_protection,