auth: Generate a human readable Authentication log message.
[nivanova/samba-autobuild/.git] / auth / auth_log.c
1 /*
2
3    Authentication and authorization logging
4
5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2017
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 /*
22  * Debug log levels for authentication logging (these both map to
23  * LOG_NOTICE in syslog)
24  */
25 #define AUTH_SUCCESS_LEVEL 4
26 #define AUTHZ_SUCCESS_LEVEL 5
27 #define AUTH_FAILURE_LEVEL 2
28
29 #include "includes.h"
30 #include "../lib/tsocket/tsocket.h"
31 #include "common_auth.h"
32 #include "lib/util/util_str_escape.h"
33 #include "libcli/security/dom_sid.h"
34
35 /*
36  * Get a human readable timestamp.
37  *
38  * Returns the current time formatted as
39  *  "Tue, 14 Mar 2017 08:38:42.209028 NZDT"
40  *
41  * The returned string is allocated by talloc in the supplied context.
42  * It is the callers responsibility to free it.
43  *
44  */
45 static const char* get_timestamp( TALLOC_CTX *frame )
46 {
47         char buffer[40];        /* formatted time less usec and timezone */
48         char tz[10];            /* formatted time zone                   */
49         struct tm* tm_info;     /* current local time                    */
50         struct timeval tv;      /* current system time                   */
51         int r;                  /* response code from gettimeofday       */
52         const char * ts;        /* formatted time stamp                  */
53
54         r = gettimeofday(&tv, NULL);
55         if (r) {
56                 DBG_ERR("Unable to get time of day: (%d) %s\n",
57                         errno,
58                         strerror( errno));
59                 return NULL;
60         }
61
62         tm_info = localtime(&tv.tv_sec);
63         if (tm_info == NULL) {
64                 DBG_ERR("Unable to determine local time\n");
65                 return NULL;
66         }
67
68         strftime(buffer, sizeof(buffer)-1, "%a, %d %b %Y %H:%M:%S", tm_info);
69         strftime(tz, sizeof(tz)-1, "%Z", tm_info);
70         ts = talloc_asprintf(frame, "%s.%06ld %s", buffer, tv.tv_usec, tz);
71         if (ts == NULL) {
72                 DBG_ERR("Out of memory formatting time stamp\n");
73         }
74         return ts;
75 }
76
77 /*
78  * Log details of an authentication attempt.
79  * Successful and unsuccessful attempts are logged.
80  *
81  */
82 void log_authentication_event(const struct auth_usersupplied_info *ui,
83                               NTSTATUS status,
84                               const char *domain_name,
85                               const char *account_name,
86                               const char *unix_username,
87                               struct dom_sid *sid)
88 {
89         TALLOC_CTX *frame = NULL;
90
91         const char *ts = NULL;             /* formatted current time      */
92         char *remote = NULL;               /* formatted remote host       */
93         char *local = NULL;                /* formatted local host        */
94         char *nl = NULL;                   /* NETLOGON details if present */
95         char *trust_computer_name = NULL;
96         char *trust_account_name = NULL;
97         char *logon_line = NULL;
98
99         /* set the log level */
100         int  level = NT_STATUS_IS_OK(status) ? AUTH_FAILURE_LEVEL : AUTH_SUCCESS_LEVEL;
101         if (!CHECK_DEBUGLVLC( DBGC_AUTH_AUDIT, level)) {
102                 return;
103         }
104
105         frame = talloc_stackframe();
106
107         /* Get the current time */
108         ts = get_timestamp(frame);
109
110         /* Only log the NETLOGON details if they are present */
111         if (ui->netlogon_trust_account.computer_name ||
112             ui->netlogon_trust_account.account_name) {
113                 trust_computer_name = log_escape(frame,
114                         ui->netlogon_trust_account.computer_name);
115                 trust_account_name  = log_escape(frame,
116                         ui->netlogon_trust_account.account_name);
117                 nl = talloc_asprintf(frame,
118                         " NETLOGON computer [%s] trust account [%s]",
119                         trust_computer_name, trust_account_name);
120         }
121
122         remote = tsocket_address_string(ui->remote_host, frame);
123         local  = tsocket_address_string(ui->local_host, frame);
124
125         if (NT_STATUS_IS_OK(status)) {
126                 char sid_buf[DOM_SID_STR_BUFLEN];
127
128                 dom_sid_string_buf(sid, sid_buf, sizeof(sid_buf));
129                 logon_line = talloc_asprintf(frame,
130                                              " became [%s]\\[%s] [%s].",
131                                              log_escape(frame, domain_name),
132                                              log_escape(frame, account_name),
133                                              sid_buf);
134         } else {
135                 logon_line = talloc_asprintf(frame,
136                                              " mapped to [%s]\\[%s].",
137                                              log_escape(frame, ui->mapped.domain_name),
138                                              log_escape(frame, ui->mapped.account_name));
139         }
140
141         DEBUGC( DBGC_AUTH_AUDIT, level, (
142                 "Auth: [%s,%s] user [%s]\\[%s]"
143                 " at [%s] status [%s]"
144                 " workstation [%s] remote host [%s]"
145                 "%s local host [%s]"
146                 " %s\n",
147                 ui->service_description,
148                 ui->auth_description,
149                 log_escape(frame, ui->client.domain_name),
150                 log_escape(frame, ui->client.account_name),
151                 ts,
152                 nt_errstr( status),
153                 log_escape(frame, ui->workstation_name),
154                 remote,
155                 logon_line,
156                 local,
157                 nl ? nl : ""
158                 ));
159
160         talloc_free(frame);
161 }