source/utils/net_rpc_audit.c

   1 /*
   2    Samba Unix/Linux SMB client library
   3    Distributed SMB/CIFS Server Management Utility
   4    Copyright (C) 2006 Guenther Deschner
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
  18
  19 #include "includes.h"
  20 #include "utils/net.h"
  21
  22 /********************************************************************
  23 ********************************************************************/
  24
  25 static int net_help_audit(int argc, const char **argv)
  26 {
  27         d_printf("net rpc audit list                       View configured Auditing policies\n");
  28         d_printf("net rpc audit enable                     Enable Auditing\n");
  29         d_printf("net rpc audit disable                    Disable Auditing\n");
  30         d_printf("net rpc audit get <category>             View configured Auditing policy setting\n");
  31         d_printf("net rpc audit set <category> <policy>    Set Auditing policies\n\n");
  32         d_printf("\tcategory can be one of: SYSTEM, LOGON, OBJECT, PRIVILEGE, PROCESS, POLICY, SAM, DIRECTORY or ACCOUNT\n");
  33         d_printf("\tpolicy can be one of: SUCCESS, FAILURE, ALL or NONE\n\n");
  34
  35         return -1;
  36 }
  37
  38 /********************************************************************
  39 ********************************************************************/
  40
  41 static void print_auditing_category(const char *policy, const char *value)
  42 {
  43         fstring padding;
  44         int pad_len, col_len = 30;
  45
  46         if (policy == NULL) {
  47                 policy = "Unknown";
  48         }
  49         if (value == NULL) {
  50                 value = "Invalid";
  51         }
  52
  53         /* calculate padding space for d_printf to look nicer */
  54         pad_len = col_len - strlen(policy);
  55         padding[pad_len] = 0;
  56         do padding[--pad_len] = ' '; while (pad_len > 0);
  57
  58         d_printf("\t%s%s%s\n", policy, padding, value);
  59 }
  60
  61
  62 /********************************************************************
  63 ********************************************************************/
  64
  65 static NTSTATUS rpc_audit_get_internal(const DOM_SID *domain_sid,
  66                                        const char *domain_name,
  67                                        struct cli_state *cli,
  68                                        struct rpc_pipe_client *pipe_hnd,
  69                                        TALLOC_CTX *mem_ctx,
  70                                        int argc,
  71                                        const char **argv)
  72 {
  73         POLICY_HND pol;
  74         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
  75         LSA_INFO_CTR dom;
  76         int i;
  77
  78         uint32 info_class = 2;
  79         uint32 audit_category;
  80
  81         if (argc < 1 || argc > 2) {
  82                 d_printf("insufficient arguments\n");
  83                 net_help_audit(argc, argv);
  84                 return NT_STATUS_INVALID_PARAMETER;
  85         }
  86
  87         if (!get_audit_category_from_param(argv[0], &audit_category)) {
  88                 d_printf("invalid auditing category: %s\n", argv[0]);
  89                 return NT_STATUS_INVALID_PARAMETER;
  90         }
  91
  92         result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, True,
  93                                         SEC_RIGHTS_MAXIMUM_ALLOWED,
  94                                         &pol);
  95
  96         if (!NT_STATUS_IS_OK(result)) {
  97                 goto done;
  98         }
  99
 100         result = rpccli_lsa_query_info_policy_new(pipe_hnd, mem_ctx, &pol,
 101                                                   info_class,
 102                                                   &dom);
 103
 104         if (!NT_STATUS_IS_OK(result)) {
 105                 goto done;
 106         }
 107
 108         for (i=0; i < dom.info.id2.count1; i++) {
 109
 110                 const char *val = NULL, *policy = NULL;
 111
 112                 if (i != audit_category) {
 113                         continue;
 114                 }
 115
 116                 val = audit_policy_str(mem_ctx, dom.info.id2.auditsettings[i]);
 117                 policy = audit_description_str(i);
 118                 print_auditing_category(policy, val);
 119         }
 120
 121  done:
 122         if (!NT_STATUS_IS_OK(result)) {
 123                 d_printf("failed to get auditing policy: %s\n", nt_errstr(result));
 124         }
 125
 126         return result;
 127 }
 128
 129 /********************************************************************
 130 ********************************************************************/
 131
 132 static NTSTATUS rpc_audit_set_internal(const DOM_SID *domain_sid,
 133                                        const char *domain_name,
 134                                        struct cli_state *cli,
 135                                        struct rpc_pipe_client *pipe_hnd,
 136                                        TALLOC_CTX *mem_ctx,
 137                                        int argc,
 138                                        const char **argv)
 139 {
 140         POLICY_HND pol;
 141         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 142         LSA_INFO_CTR dom;
 143
 144         uint32 info_class = 2;
 145         uint32 audit_policy, audit_category;
 146
 147         if (argc < 2 || argc > 3) {
 148                 d_printf("insufficient arguments\n");
 149                 net_help_audit(argc, argv);
 150                 return NT_STATUS_INVALID_PARAMETER;
 151         }
 152
 153         if (!get_audit_category_from_param(argv[0], &audit_category)) {
 154                 d_printf("invalid auditing category: %s\n", argv[0]);
 155                 return NT_STATUS_INVALID_PARAMETER;
 156         }
 157
 158         audit_policy = LSA_AUDIT_POLICY_CLEAR;
 159
 160         if (strequal(argv[1], "Success")) {
 161                 audit_policy |= LSA_AUDIT_POLICY_SUCCESS;
 162         } else if (strequal(argv[1], "Failure")) {
 163                 audit_policy |= LSA_AUDIT_POLICY_FAILURE;
 164         } else if (strequal(argv[1], "All")) {
 165                 audit_policy |= LSA_AUDIT_POLICY_ALL;
 166         } else if (strequal(argv[1], "None")) {
 167                 audit_policy = LSA_AUDIT_POLICY_CLEAR;
 168         } else {
 169                 d_printf("invalid auditing policy: %s\n", argv[1]);
 170                 return NT_STATUS_INVALID_PARAMETER;
 171         }
 172
 173         result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, True,
 174                                         SEC_RIGHTS_MAXIMUM_ALLOWED,
 175                                         &pol);
 176
 177         if (!NT_STATUS_IS_OK(result)) {
 178                 goto done;
 179         }
 180
 181         result = rpccli_lsa_query_info_policy_new(pipe_hnd, mem_ctx, &pol,
 182                                                   info_class,
 183                                                   &dom);
 184
 185         if (!NT_STATUS_IS_OK(result)) {
 186                 goto done;
 187         }
 188
 189         dom.info.id2.auditsettings[audit_category] = audit_policy;
 190
 191         result = rpccli_lsa_set_info_policy(pipe_hnd, mem_ctx, &pol,
 192                                             info_class,
 193                                             dom);
 194         if (!NT_STATUS_IS_OK(result)) {
 195                 goto done;
 196         }
 197
 198         result = rpccli_lsa_query_info_policy_new(pipe_hnd, mem_ctx, &pol,
 199                                                   info_class,
 200                                                   &dom);
 201
 202         {
 203                 const char *val = audit_policy_str(mem_ctx, dom.info.id2.auditsettings[audit_category]);
 204                 const char *policy = audit_description_str(audit_category);
 205                 print_auditing_category(policy, val);
 206         }
 207
 208  done:
 209         if (!NT_STATUS_IS_OK(result)) {
 210                 d_printf("failed to set audit policy: %s\n", nt_errstr(result));
 211         }
 212
 213         return result;
 214 }
 215
 216 static NTSTATUS rpc_audit_enable_internal_ext(struct rpc_pipe_client *pipe_hnd,
 217                                               TALLOC_CTX *mem_ctx,
 218                                               int argc,
 219                                               const char **argv,
 220                                               BOOL enable)
 221 {
 222         POLICY_HND pol;
 223         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 224         LSA_INFO_CTR dom;
 225
 226         uint32 info_class = 2;
 227
 228         result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, True,
 229                                         SEC_RIGHTS_MAXIMUM_ALLOWED,
 230                                         &pol);
 231
 232         if (!NT_STATUS_IS_OK(result)) {
 233                 goto done;
 234         }
 235
 236         result = rpccli_lsa_query_info_policy_new(pipe_hnd, mem_ctx, &pol,
 237                                                   info_class,
 238                                                   &dom);
 239
 240         if (!NT_STATUS_IS_OK(result)) {
 241                 goto done;
 242         }
 243
 244         dom.info.id2.auditing_enabled = enable;
 245
 246         result = rpccli_lsa_set_info_policy(pipe_hnd, mem_ctx, &pol,
 247                                             info_class,
 248                                             dom);
 249
 250         if (!NT_STATUS_IS_OK(result)) {
 251                 goto done;
 252         }
 253
 254  done:
 255         if (!NT_STATUS_IS_OK(result)) {
 256                 d_printf("failed to %s audit policy: %s\n", enable ? "enable":"disable",
 257                         nt_errstr(result));
 258         }
 259
 260         return result;
 261 }
 262 /********************************************************************
 263 ********************************************************************/
 264
 265 static NTSTATUS rpc_audit_disable_internal(const DOM_SID *domain_sid,
 266                                            const char *domain_name,
 267                                            struct cli_state *cli,
 268                                            struct rpc_pipe_client *pipe_hnd,
 269                                            TALLOC_CTX *mem_ctx,
 270                                            int argc,
 271                                            const char **argv)
 272 {
 273         return rpc_audit_enable_internal_ext(pipe_hnd, mem_ctx, argc, argv, False);
 274 }
 275
 276 /********************************************************************
 277 ********************************************************************/
 278
 279 static NTSTATUS rpc_audit_enable_internal(const DOM_SID *domain_sid,
 280                                           const char *domain_name,
 281                                           struct cli_state *cli,
 282                                           struct rpc_pipe_client *pipe_hnd,
 283                                           TALLOC_CTX *mem_ctx,
 284                                           int argc,
 285                                           const char **argv)
 286 {
 287         return rpc_audit_enable_internal_ext(pipe_hnd, mem_ctx, argc, argv, True);
 288 }
 289
 290 /********************************************************************
 291 ********************************************************************/
 292
 293 static NTSTATUS rpc_audit_list_internal(const DOM_SID *domain_sid,
 294                                         const char *domain_name,
 295                                         struct cli_state *cli,
 296                                         struct rpc_pipe_client *pipe_hnd,
 297                                         TALLOC_CTX *mem_ctx,
 298                                         int argc,
 299                                         const char **argv)
 300 {
 301         POLICY_HND pol;
 302         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 303         LSA_INFO_CTR dom;
 304         int i;
 305
 306         uint32 info_class = 2;
 307
 308         result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, True,
 309                                         SEC_RIGHTS_MAXIMUM_ALLOWED,
 310                                         &pol);
 311
 312         if (!NT_STATUS_IS_OK(result)) {
 313                 goto done;
 314         }
 315
 316         result = rpccli_lsa_query_info_policy_new(pipe_hnd, mem_ctx, &pol,
 317                                                   info_class,
 318                                                   &dom);
 319
 320         if (!NT_STATUS_IS_OK(result)) {
 321                 goto done;
 322         }
 323
 324         printf("Auditing:\t\t");
 325         switch (dom.info.id2.auditing_enabled) {
 326                 case True:
 327                         printf("Enabled");
 328                         break;
 329                 case False:
 330                         printf("Disabled");
 331                         break;
 332                 default:
 333                         printf("unknown (%d)", dom.info.id2.auditing_enabled);
 334                         break;
 335         }
 336         printf("\n");
 337
 338         printf("Auditing categories:\t%d\n", dom.info.id2.count1);
 339         printf("Auditing settings:\n");
 340
 341         for (i=0; i < dom.info.id2.count1; i++) {
 342                 const char *val = audit_policy_str(mem_ctx, dom.info.id2.auditsettings[i]);
 343                 const char *policy = audit_description_str(i);
 344                 print_auditing_category(policy, val);
 345         }
 346
 347  done:
 348         if (!NT_STATUS_IS_OK(result)) {
 349                 d_printf("failed to list auditing policies: %s\n", nt_errstr(result));
 350         }
 351
 352         return result;
 353 }
 354
 355
 356
 357 /********************************************************************
 358 ********************************************************************/
 359
 360 static int rpc_audit_get(int argc, const char **argv)
 361 {
 362         return run_rpc_command(NULL, PI_LSARPC, 0,
 363                 rpc_audit_get_internal, argc, argv);
 364 }
 365
 366 /********************************************************************
 367 ********************************************************************/
 368
 369 static int rpc_audit_set(int argc, const char **argv)
 370 {
 371         return run_rpc_command(NULL, PI_LSARPC, 0,
 372                 rpc_audit_set_internal, argc, argv);
 373 }
 374
 375 /********************************************************************
 376 ********************************************************************/
 377
 378 static int rpc_audit_enable(int argc, const char **argv)
 379 {
 380         return run_rpc_command(NULL, PI_LSARPC, 0,
 381                 rpc_audit_enable_internal, argc, argv);
 382 }
 383
 384 /********************************************************************
 385 ********************************************************************/
 386
 387 static int rpc_audit_disable(int argc, const char **argv)
 388 {
 389         return run_rpc_command(NULL, PI_LSARPC, 0,
 390                 rpc_audit_disable_internal, argc, argv);
 391 }
 392
 393 /********************************************************************
 394 ********************************************************************/
 395
 396 static int rpc_audit_list(int argc, const char **argv)
 397 {
 398         return run_rpc_command(NULL, PI_LSARPC, 0,
 399                 rpc_audit_list_internal, argc, argv);
 400 }
 401
 402 /********************************************************************
 403 ********************************************************************/
 404
 405 int net_rpc_audit(int argc, const char **argv)
 406 {
 407         struct functable func[] = {
 408                 {"get", rpc_audit_get},
 409                 {"set", rpc_audit_set},
 410                 {"enable", rpc_audit_enable},
 411                 {"disable", rpc_audit_disable},
 412                 {"list", rpc_audit_list},
 413                 {NULL, NULL}
 414         };
 415
 416         if (argc)
 417                 return net_run_function(argc, argv, func, net_help_audit);
 418
 419         return net_help_audit(argc, argv);
 420 }