3 Authentication and authorization logging
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2017
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 * Debug log levels for authentication logging (these both map to
23 * LOG_NOTICE in syslog)
25 #define AUTH_FAILURE_LEVEL 2
26 #define AUTH_SUCCESS_LEVEL 3
27 #define AUTHZ_SUCCESS_LEVEL 4
29 /* 5 is used for both authentication and authorization */
30 #define AUTH_ANONYMOUS_LEVEL 5
31 #define AUTHZ_ANONYMOUS_LEVEL 5
33 #define AUTHZ_JSON_TYPE "Authorization"
34 #define AUTH_JSON_TYPE "Authentication"
37 * JSON message version numbers
39 * If adding a field increment the minor version
40 * If removing or changing the format/meaning of a field
41 * increment the major version.
49 #include "../lib/tsocket/tsocket.h"
50 #include "common_auth.h"
51 #include "lib/util/util_str_escape.h"
52 #include "libcli/security/dom_sid.h"
53 #include "libcli/security/security_token.h"
54 #include "librpc/gen_ndr/server_id.h"
55 #include "source4/lib/messaging/messaging.h"
56 #include "source4/lib/messaging/irpc.h"
57 #include "lib/util/server_id_db.h"
58 #include "lib/param/param.h"
59 #include "librpc/ndr/libndr.h"
60 #include "lib/audit_logging/audit_logging.h"
63 * Determine the type of the password supplied for the
64 * authorisation attempt.
67 static const char* get_password_type(const struct auth_usersupplied_info
*ui
);
72 #include "system/time.h"
75 * Write the json object to the debug logs.
78 static void log_json(struct imessaging_context
*msg_ctx
,
79 struct loadparm_context
*lp_ctx
,
80 struct json_object
*object
,
84 audit_log_json(object
, debug_class
, debug_level
);
85 if (msg_ctx
&& lp_ctx
&& lpcfg_auth_event_notification(lp_ctx
)) {
86 audit_message_send(msg_ctx
,
94 * Write a machine parsable json formatted authentication log entry.
96 * IF removing or changing the format/meaning of a field please update the
97 * major version number AUTH_MAJOR
99 * IF adding a new field please update the minor version number AUTH_MINOR
101 * To process the resulting log lines from the commend line use jq to
104 * grep "^ {" log file |
105 * jq -rc '"\(.timestamp)\t\(.Authentication.status)\t
106 * \(.Authentication.clientDomain)\t
107 * \(.Authentication.clientAccount)
108 * \t\(.Authentication.workstation)
109 * \t\(.Authentication.remoteAddress)
110 * \t\(.Authentication.localAddress)"'
112 static void log_authentication_event_json(
113 struct imessaging_context
*msg_ctx
,
114 struct loadparm_context
*lp_ctx
,
115 const struct timeval
*start_time
,
116 const struct auth_usersupplied_info
*ui
,
118 const char *domain_name
,
119 const char *account_name
,
120 const char *unix_username
,
124 struct json_object wrapper
= json_empty_object
;
125 struct json_object authentication
= json_empty_object
;
126 char negotiate_flags
[11];
129 authentication
= json_new_object();
130 if (json_is_invalid(&authentication
)) {
133 rc
= json_add_version(&authentication
, AUTH_MAJOR
, AUTH_MINOR
);
137 rc
= json_add_string(&authentication
, "status", nt_errstr(status
));
141 rc
= json_add_address(&authentication
, "localAddress", ui
->local_host
);
146 json_add_address(&authentication
, "remoteAddress", ui
->remote_host
);
150 rc
= json_add_string(
151 &authentication
, "serviceDescription", ui
->service_description
);
155 rc
= json_add_string(
156 &authentication
, "authDescription", ui
->auth_description
);
160 rc
= json_add_string(
161 &authentication
, "clientDomain", ui
->client
.domain_name
);
165 rc
= json_add_string(
166 &authentication
, "clientAccount", ui
->client
.account_name
);
170 rc
= json_add_string(
171 &authentication
, "workstation", ui
->workstation_name
);
175 rc
= json_add_string(&authentication
, "becameAccount", account_name
);
179 rc
= json_add_string(&authentication
, "becameDomain", domain_name
);
183 rc
= json_add_sid(&authentication
, "becameSid", sid
);
187 rc
= json_add_string(
188 &authentication
, "mappedAccount", ui
->mapped
.account_name
);
192 rc
= json_add_string(
193 &authentication
, "mappedDomain", ui
->mapped
.domain_name
);
197 rc
= json_add_string(&authentication
,
199 ui
->netlogon_trust_account
.computer_name
);
203 rc
= json_add_string(&authentication
,
204 "netlogonTrustAccount",
205 ui
->netlogon_trust_account
.account_name
);
209 snprintf(negotiate_flags
,
210 sizeof( negotiate_flags
),
212 ui
->netlogon_trust_account
.negotiate_flags
);
213 rc
= json_add_string(
214 &authentication
, "netlogonNegotiateFlags", negotiate_flags
);
218 rc
= json_add_int(&authentication
,
219 "netlogonSecureChannelType",
220 ui
->netlogon_trust_account
.secure_channel_type
);
224 rc
= json_add_sid(&authentication
,
225 "netlogonTrustAccountSid",
226 ui
->netlogon_trust_account
.sid
);
230 rc
= json_add_string(
231 &authentication
, "passwordType", get_password_type(ui
));
236 wrapper
= json_new_object();
237 if (json_is_invalid(&wrapper
)) {
240 rc
= json_add_timestamp(&wrapper
);
244 rc
= json_add_string(&wrapper
, "type", AUTH_JSON_TYPE
);
248 rc
= json_add_object(&wrapper
, AUTH_JSON_TYPE
, &authentication
);
254 * While not a general-purpose profiling solution this will
255 * assist some to determine how long NTLM and KDC
256 * authentication takes once this process can handle it. This
257 * covers transactions elsewhere but not (eg) the delay while
258 * this is waiting unread on the input socket.
260 if (start_time
!= NULL
) {
261 struct timeval current_time
= timeval_current();
262 uint64_t duration
= usec_time_diff(¤t_time
,
264 rc
= json_add_int(&authentication
, "duration", duration
);
273 DBGC_AUTH_AUDIT_JSON
,
279 * On a failure authentication will not have been added to wrapper so it
280 * needs to be freed to avoid a leak.
283 json_free(&authentication
);
285 DBG_ERR("Failed to write authentication event JSON log message\n");
289 * Log details of a successful authorization to a service,
290 * in a machine parsable json format
292 * IF removing or changing the format/meaning of a field please update the
293 * major version number AUTHZ_MAJOR
295 * IF adding a new field please update the minor version number AUTHZ_MINOR
297 * To process the resulting log lines from the commend line use jq to
300 * grep "^ {" log_file |\
301 * jq -rc '"\(.timestamp)\t
302 * \(.Authorization.domain)\t
303 * \(.Authorization.account)\t
304 * \(.Authorization.remoteAddress)"'
307 static void log_successful_authz_event_json(
308 struct imessaging_context
*msg_ctx
,
309 struct loadparm_context
*lp_ctx
,
310 const struct tsocket_address
*remote
,
311 const struct tsocket_address
*local
,
312 const char *service_description
,
313 const char *auth_type
,
314 const char *transport_protection
,
315 struct auth_session_info
*session_info
,
318 struct json_object wrapper
= json_empty_object
;
319 struct json_object authorization
= json_empty_object
;
320 char account_flags
[11];
323 authorization
= json_new_object();
324 if (json_is_invalid(&authorization
)) {
327 rc
= json_add_version(&authorization
, AUTHZ_MAJOR
, AUTHZ_MINOR
);
331 rc
= json_add_address(&authorization
, "localAddress", local
);
335 rc
= json_add_address(&authorization
, "remoteAddress", remote
);
339 rc
= json_add_string(
340 &authorization
, "serviceDescription", service_description
);
344 rc
= json_add_string(&authorization
, "authType", auth_type
);
348 rc
= json_add_string(
349 &authorization
, "domain", session_info
->info
->domain_name
);
353 rc
= json_add_string(
354 &authorization
, "account", session_info
->info
->account_name
);
359 &authorization
, "sid", &session_info
->security_token
->sids
[0]);
364 &authorization
, "sessionId", &session_info
->unique_session_token
);
368 rc
= json_add_string(
369 &authorization
, "logonServer", session_info
->info
->logon_server
);
373 rc
= json_add_string(
374 &authorization
, "transportProtection", transport_protection
);
379 snprintf(account_flags
,
380 sizeof(account_flags
),
382 session_info
->info
->acct_flags
);
383 rc
= json_add_string(&authorization
, "accountFlags", account_flags
);
388 wrapper
= json_new_object();
389 if (json_is_invalid(&wrapper
)) {
392 rc
= json_add_timestamp(&wrapper
);
396 rc
= json_add_string(&wrapper
, "type", AUTHZ_JSON_TYPE
);
400 rc
= json_add_object(&wrapper
, AUTHZ_JSON_TYPE
, &authorization
);
408 DBGC_AUTH_AUDIT_JSON
,
414 * On a failure authorization will not have been added to wrapper so it
415 * needs to be freed to avoid a leak.
418 json_free(&authorization
);
420 DBG_ERR("Unable to log Authentication event JSON audit message\n");
425 static void log_no_json(struct imessaging_context
*msg_ctx
,
426 struct loadparm_context
*lp_ctx
)
428 if (msg_ctx
&& lp_ctx
&& lpcfg_auth_event_notification(lp_ctx
)) {
429 static bool auth_event_logged
= false;
430 if (auth_event_logged
== false) {
431 auth_event_logged
= true;
432 DBG_ERR("auth event notification = true but Samba was "
433 "not compiled with jansson\n");
436 static bool json_logged
= false;
437 if (json_logged
== false) {
439 DBG_NOTICE("JSON auth logs not available unless "
440 "compiled with jansson\n");
447 static void log_authentication_event_json(
448 struct imessaging_context
*msg_ctx
,
449 struct loadparm_context
*lp_ctx
,
450 const struct timeval
*start_time
,
451 const struct auth_usersupplied_info
*ui
,
453 const char *domain_name
,
454 const char *account_name
,
455 const char *unix_username
,
459 log_no_json(msg_ctx
, lp_ctx
);
463 static void log_successful_authz_event_json(
464 struct imessaging_context
*msg_ctx
,
465 struct loadparm_context
*lp_ctx
,
466 const struct tsocket_address
*remote
,
467 const struct tsocket_address
*local
,
468 const char *service_description
,
469 const char *auth_type
,
470 const char *transport_protection
,
471 struct auth_session_info
*session_info
,
474 log_no_json(msg_ctx
, lp_ctx
);
481 * Determine the type of the password supplied for the
482 * authorisation attempt.
485 static const char* get_password_type(const struct auth_usersupplied_info
*ui
)
488 const char *password_type
= NULL
;
490 if (ui
->password_type
!= NULL
) {
491 password_type
= ui
->password_type
;
492 } else if (ui
->auth_description
!= NULL
&&
493 strncmp("ServerAuthenticate", ui
->auth_description
, 18) == 0)
495 if (ui
->netlogon_trust_account
.negotiate_flags
496 & NETLOGON_NEG_SUPPORTS_AES
) {
497 password_type
= "HMAC-SHA256";
498 } else if (ui
->netlogon_trust_account
.negotiate_flags
499 & NETLOGON_NEG_STRONG_KEYS
) {
500 password_type
= "HMAC-MD5";
502 password_type
= "DES";
504 } else if (ui
->password_state
== AUTH_PASSWORD_RESPONSE
&&
505 (ui
->logon_parameters
& MSV1_0_ALLOW_MSVCHAPV2
) &&
506 ui
->password
.response
.nt
.length
== 24) {
507 password_type
= "MSCHAPv2";
508 } else if ((ui
->logon_parameters
& MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED
)
509 || (ui
->password_state
== AUTH_PASSWORD_PLAIN
)) {
510 password_type
= "Plaintext";
511 } else if (ui
->password_state
== AUTH_PASSWORD_HASH
) {
512 password_type
= "Supplied-NT-Hash";
513 } else if (ui
->password_state
== AUTH_PASSWORD_RESPONSE
514 && ui
->password
.response
.nt
.length
> 24) {
515 password_type
= "NTLMv2";
516 } else if (ui
->password_state
== AUTH_PASSWORD_RESPONSE
517 && ui
->password
.response
.nt
.length
== 24) {
518 password_type
= "NTLMv1";
519 } else if (ui
->password_state
== AUTH_PASSWORD_RESPONSE
520 && ui
->password
.response
.lanman
.length
== 24) {
521 password_type
= "LANMan";
522 } else if (ui
->password_state
== AUTH_PASSWORD_RESPONSE
523 && ui
->password
.response
.nt
.length
== 0
524 && ui
->password
.response
.lanman
.length
== 0) {
525 password_type
= "No-Password";
527 return password_type
;
531 * Write a human readable authentication log entry.
534 static void log_authentication_event_human_readable(
535 const struct auth_usersupplied_info
*ui
,
537 const char *domain_name
,
538 const char *account_name
,
539 const char *unix_username
,
543 TALLOC_CTX
*frame
= NULL
;
545 const char *ts
= NULL
; /* formatted current time */
546 char *remote
= NULL
; /* formatted remote host */
547 char *local
= NULL
; /* formatted local host */
548 char *nl
= NULL
; /* NETLOGON details if present */
549 char *trust_computer_name
= NULL
;
550 char *trust_account_name
= NULL
;
551 char *logon_line
= NULL
;
552 const char *password_type
= NULL
;
554 frame
= talloc_stackframe();
556 password_type
= get_password_type(ui
);
557 /* Get the current time */
558 ts
= audit_get_timestamp(frame
);
560 /* Only log the NETLOGON details if they are present */
561 if (ui
->netlogon_trust_account
.computer_name
||
562 ui
->netlogon_trust_account
.account_name
) {
563 trust_computer_name
= log_escape(frame
,
564 ui
->netlogon_trust_account
.computer_name
);
565 trust_account_name
= log_escape(frame
,
566 ui
->netlogon_trust_account
.account_name
);
567 nl
= talloc_asprintf(frame
,
568 " NETLOGON computer [%s] trust account [%s]",
569 trust_computer_name
, trust_account_name
);
572 remote
= tsocket_address_string(ui
->remote_host
, frame
);
573 local
= tsocket_address_string(ui
->local_host
, frame
);
575 if (NT_STATUS_IS_OK(status
)) {
576 char sid_buf
[DOM_SID_STR_BUFLEN
];
578 dom_sid_string_buf(sid
, sid_buf
, sizeof(sid_buf
));
579 logon_line
= talloc_asprintf(frame
,
580 " became [%s]\\[%s] [%s].",
581 log_escape(frame
, domain_name
),
582 log_escape(frame
, account_name
),
585 logon_line
= talloc_asprintf(
587 " mapped to [%s]\\[%s].",
588 log_escape(frame
, ui
->mapped
.domain_name
),
589 log_escape(frame
, ui
->mapped
.account_name
));
592 DEBUGC(DBGC_AUTH_AUDIT
, debug_level
,
593 ("Auth: [%s,%s] user [%s]\\[%s]"
594 " at [%s] with [%s] status [%s]"
595 " workstation [%s] remote host [%s]"
598 ui
->service_description
,
599 ui
->auth_description
,
600 log_escape(frame
, ui
->client
.domain_name
),
601 log_escape(frame
, ui
->client
.account_name
),
605 log_escape(frame
, ui
->workstation_name
),
616 * Log details of an authentication attempt.
617 * Successful and unsuccessful attempts are logged.
619 * NOTE: msg_ctx and lp_ctx is optional, but when supplied allows streaming the
620 * authentication events over the message bus.
622 void log_authentication_event(
623 struct imessaging_context
*msg_ctx
,
624 struct loadparm_context
*lp_ctx
,
625 const struct timeval
*start_time
,
626 const struct auth_usersupplied_info
*ui
,
628 const char *domain_name
,
629 const char *account_name
,
630 const char *unix_username
,
633 /* set the log level */
634 int debug_level
= AUTH_FAILURE_LEVEL
;
636 if (NT_STATUS_IS_OK(status
)) {
637 debug_level
= AUTH_SUCCESS_LEVEL
;
638 if (dom_sid_equal(sid
, &global_sid_Anonymous
)) {
639 debug_level
= AUTH_ANONYMOUS_LEVEL
;
643 if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT
, debug_level
)) {
644 log_authentication_event_human_readable(ui
,
652 if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT_JSON
, debug_level
) ||
653 (msg_ctx
&& lp_ctx
&& lpcfg_auth_event_notification(lp_ctx
))) {
654 log_authentication_event_json(msg_ctx
,
670 * Log details of a successful authorization to a service,
671 * in a human readable format.
674 static void log_successful_authz_event_human_readable(
675 const struct tsocket_address
*remote
,
676 const struct tsocket_address
*local
,
677 const char *service_description
,
678 const char *auth_type
,
679 const char *transport_protection
,
680 struct auth_session_info
*session_info
,
683 TALLOC_CTX
*frame
= NULL
;
685 const char *ts
= NULL
; /* formatted current time */
686 char *remote_str
= NULL
; /* formatted remote host */
687 char *local_str
= NULL
; /* formatted local host */
688 char sid_buf
[DOM_SID_STR_BUFLEN
];
690 frame
= talloc_stackframe();
692 /* Get the current time */
693 ts
= audit_get_timestamp(frame
);
695 remote_str
= tsocket_address_string(remote
, frame
);
696 local_str
= tsocket_address_string(local
, frame
);
698 dom_sid_string_buf(&session_info
->security_token
->sids
[0],
702 DEBUGC(DBGC_AUTH_AUDIT
, debug_level
,
703 ("Successful AuthZ: [%s,%s] user [%s]\\[%s] [%s]"
706 " local host [%s]\n",
709 log_escape(frame
, session_info
->info
->domain_name
),
710 log_escape(frame
, session_info
->info
->account_name
),
720 * Log details of a successful authorization to a service.
722 * Only successful authorizations are logged. For clarity:
723 * - NTLM bad passwords will be recorded by log_authentication_event
724 * - Kerberos decrypt failures need to be logged in gensec_gssapi et al
726 * The service may later refuse authorization due to an ACL.
728 * NOTE: msg_ctx and lp_ctx is optional, but when supplied allows streaming the
729 * authentication events over the message bus.
731 void log_successful_authz_event(
732 struct imessaging_context
*msg_ctx
,
733 struct loadparm_context
*lp_ctx
,
734 const struct tsocket_address
*remote
,
735 const struct tsocket_address
*local
,
736 const char *service_description
,
737 const char *auth_type
,
738 const char *transport_protection
,
739 struct auth_session_info
*session_info
)
741 int debug_level
= AUTHZ_SUCCESS_LEVEL
;
743 /* set the log level */
744 if (security_token_is_anonymous(session_info
->security_token
)) {
745 debug_level
= AUTH_ANONYMOUS_LEVEL
;
748 if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT
, debug_level
)) {
749 log_successful_authz_event_human_readable(remote
,
753 transport_protection
,
757 if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT_JSON
, debug_level
) ||
758 (msg_ctx
&& lp_ctx
&& lpcfg_auth_event_notification(lp_ctx
))) {
759 log_successful_authz_event_json(msg_ctx
, lp_ctx
,
764 transport_protection
,