author | Tomas Kuthan <tomas.kuthan@oracle.com> |
Wed, 15 Jun 2016 02:07:50 -0700 | |
changeset 6189 | a95f9f39fc53 |
parent 5818 | 5f0e7a0f17c2 |
child 7649 | 69d7508f0d66 |
permissions | -rw-r--r-- |
3513
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
1 |
# |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
2 |
# Add Solaris Auditing configuration (--with-audit=solaris) to openssh-6.5p1. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
3 |
# |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
4 |
# Add phase 1 Solaris Auditing of sshd login/logout to openssh-6.5p1. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
5 |
# |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
6 |
# Additional Solaris Auditing should include audit of password |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
7 |
# change. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
8 |
# Presuming it is appropriate, this patch should/will be updated |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
9 |
# with additional files and updates to sources/audit-solaris.c |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
10 |
# |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
11 |
# Code is developed by the Solaris Audit team. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
12 |
# It should/will likely be contributed up stream when done. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
13 |
# This patch relies on sources/audit-solaris.c being copied into |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
14 |
# the openssh source directory by the Makefile that configures |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
15 |
# using --with-audit=solaris. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
16 |
# |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
17 |
# The up stream community has been contacted about the plans. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
18 |
# No reply has yet been received. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
19 |
# |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
20 |
# An additional patch relying on the --with-audit=solaris configuration |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
21 |
# should/will be created for sftp Solaris Audit and password change. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
22 |
# |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
23 |
diff -pur old/INSTALL new/INSTALL |
5818
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
24 |
--- old/INSTALL |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
25 |
+++ new/INSTALL |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
26 |
@@ -92,9 +92,13 @@ http://www.gnu.org/software/autoconf/ |
3513
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
27 |
|
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
28 |
Basic Security Module (BSM): |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
29 |
|
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
30 |
-Native BSM support is know to exist in Solaris from at least 2.5.1, |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
31 |
-FreeBSD 6.1 and OS X. Alternatively, you may use the OpenBSM |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
32 |
-implementation (http://www.openbsm.org). |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
33 |
+Native BSM support is known to exist in Solaris from at least 2.5.1 |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
34 |
+to Solaris 10. From Solaris 11 the previously documented BSM (libbsm) |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
35 |
+interfaces are no longer public and are unsupported. While not public |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
36 |
+interfaces, audit-solaris.c implements Solaris Audit from Solaris 11. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
37 |
+Native BSM support is known to exist in FreeBSD 6.1 and OS X. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
38 |
+Alternatively, you may use the OpenBSM implementation |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
39 |
+(http://www.openbsm.org). |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
40 |
|
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
41 |
|
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
42 |
2. Building / Installation |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
43 |
@@ -147,8 +151,9 @@ name). |
3513
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
44 |
There are a few other options to the configure script: |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
45 |
|
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
46 |
--with-audit=[module] enable additional auditing via the specified module. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
47 |
-Currently, drivers for "debug" (additional info via syslog) and "bsm" |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
48 |
-(Sun's Basic Security Module) are supported. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
49 |
+Currently, drivers for "debug" (additional info via syslog), and "bsm" |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
50 |
+(Sun's Legacy Basic Security Module prior to Solaris 11), and "solaris" |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
51 |
+(Sun's Audit infrastructure from Solaris 11) are supported. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
52 |
|
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
53 |
--with-pam enables PAM support. If PAM support is compiled in, it must |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
54 |
also be enabled in sshd_config (refer to the UsePAM directive). |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
55 |
diff -pur old/Makefile.in new/Makefile.in |
5818
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
56 |
--- old/Makefile.in |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
57 |
+++ new/Makefile.in |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
58 |
@@ -100,7 +100,7 @@ SSHOBJS= ssh.o readconf.o clientloop.o s |
3513
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
59 |
roaming_common.o roaming_client.o |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
60 |
|
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
61 |
SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \ |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
62 |
- audit.o audit-bsm.o audit-linux.o platform.o \ |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
63 |
+ audit.o audit-bsm.o audit-linux.o audit-solaris.o platform.o \ |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
64 |
sshpty.o sshlogin.o servconf.o serverloop.o \ |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
65 |
auth.o auth1.o auth2.o auth-options.o session.o \ |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
66 |
auth-chall.o auth2-chall.o groupaccess.o \ |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
67 |
diff -pur old/README.platform new/README.platform |
5818
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
68 |
--- old/README.platform |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
69 |
+++ new/README.platform |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
70 |
@@ -68,8 +68,8 @@ zlib-devel and pam-devel, on Debian base |
3513
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
71 |
libssl-dev, libz-dev and libpam-dev. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
72 |
|
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
73 |
|
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
74 |
-Solaris |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
75 |
-------- |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
76 |
+Prior to Solaris 11 |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
77 |
+------------------- |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
78 |
If you enable BSM auditing on Solaris, you need to update audit_event(4) |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
79 |
for praudit(1m) to give sensible output. The following line needs to be |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
80 |
added to /etc/security/audit_event: |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
81 |
@@ -82,6 +82,9 @@ There is no official registry of 3rd par |
3513
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
82 |
number is already in use on your system, you may change it at build time |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
83 |
by configure'ing --with-cflags=-DAUE_openssh=32801 then rebuilding. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
84 |
|
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
85 |
+From Solaris 11 |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
86 |
+--------------- |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
87 |
+Solaris Audit is supported by configuring --with-audit=solaris. |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
88 |
|
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
89 |
Platforms using PAM |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
90 |
------------------- |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
91 |
diff -pur old/config.h.in new/config.h.in |
5818
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
92 |
--- old/config.h.in |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
93 |
+++ new/config.h.in |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
94 |
@@ -1635,6 +1635,9 @@ |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
95 |
/* Use Linux audit module */ |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
96 |
#undef USE_LINUX_AUDIT |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
97 |
|
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
98 |
+/* Use Solaris audit module */ |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
99 |
+#undef USE_SOLARIS_AUDIT |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
100 |
+ |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
101 |
/* Enable OpenSSL engine support */ |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
102 |
#undef USE_OPENSSL_ENGINE |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
103 |
|
5818
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
104 |
diff -pur old/configure.ac new/configure.ac |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
105 |
--- old/configure.ac |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
106 |
+++ new/configure.ac |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
107 |
@@ -1517,10 +1517,21 @@ AC_ARG_WITH([libedit], |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
108 |
|
5818
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
109 |
AUDIT_MODULE=none |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
110 |
AC_ARG_WITH([audit], |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
111 |
- [ --with-audit=module Enable audit support (modules=debug,bsm,linux)], |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
112 |
+ [ --with-audit=module Enable audit support (modules=debug,bsm,linux,solaris)], |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
113 |
[ |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
114 |
AC_MSG_CHECKING([for supported audit module]) |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
115 |
case "$withval" in |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
116 |
+ solaris) |
5818
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
117 |
+ AC_MSG_RESULT([solaris]) |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
118 |
+ AUDIT_MODULE=solaris |
5818
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
119 |
+ dnl Checks for headers, libs and functions |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
120 |
+ AC_CHECK_HEADERS([bsm/adt.h], [], |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
121 |
+ [AC_MSG_ERROR([Solaris Audit enabled and bsm/adt.h not found])], |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
122 |
+ [] |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
123 |
+ ) |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
124 |
+ SSHDLIBS="$SSHDLIBS -lbsm" |
5818
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
125 |
+ AC_DEFINE([USE_SOLARIS_AUDIT], [1], [Use Solaris audit module]) |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
126 |
+ ;; |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
127 |
bsm) |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
128 |
AC_MSG_RESULT([bsm]) |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
129 |
AUDIT_MODULE=bsm |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
130 |
diff -pur old/defines.h new/defines.h |
5818
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
131 |
--- old/defines.h |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
132 |
+++ new/defines.h |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
133 |
@@ -635,6 +635,11 @@ struct winsize { |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
134 |
# define CUSTOM_SSH_AUDIT_EVENTS |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
135 |
#endif |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
136 |
|
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
137 |
+#ifdef USE_SOLARIS_AUDIT |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
138 |
+# define SSH_AUDIT_EVENTS |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
139 |
+# define CUSTOM_SSH_AUDIT_EVENTS |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
140 |
+#endif |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
141 |
+ |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
142 |
#if !defined(HAVE___func__) && defined(HAVE___FUNCTION__) |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
143 |
# define __func__ __FUNCTION__ |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
144 |
#elif !defined(HAVE___func__) |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
145 |
diff -pur old/sshd.c new/sshd.c |
5818
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
146 |
--- old/sshd.c |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
147 |
+++ new/sshd.c |
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
148 |
@@ -2234,7 +2234,9 @@ main(int ac, char **av) |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
3513
diff
changeset
|
149 |
} |
3513
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
150 |
|
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
151 |
#ifdef SSH_AUDIT_EVENTS |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
152 |
+#ifndef USE_SOLARIS_AUDIT |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
153 |
audit_event(SSH_AUTH_SUCCESS); |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
154 |
+#endif /* !USE_SOLARIS_AUDIT */ |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
155 |
#endif |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
156 |
|
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
157 |
#ifdef GSSAPI |
5818
5f0e7a0f17c2
21206288 OpenSSH should patch configure.ac and generate configure
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4503
diff
changeset
|
158 |
@@ -2264,6 +2266,10 @@ main(int ac, char **av) |
3513
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
159 |
do_pam_session(); |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
160 |
} |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
161 |
#endif |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
162 |
+#ifdef USE_SOLARIS_AUDIT |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
163 |
+ /* Audit should take place after all successful pam */ |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
164 |
+ audit_event(SSH_AUTH_SUCCESS); |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
165 |
+#endif /* USE_SOLARIS_AUDIT */ |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
166 |
|
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
167 |
/* |
37c4496b7ed3
19629847 OpenSSH does not support Solaris Audit for login/logout.
gww <gary.winiger@oracle.com>
parents:
diff
changeset
|
168 |
* In privilege separation, we fork another child and prepare |