3 Authentication and authorization logging
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2017
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 * Debug log levels for authentication logging (these both map to
23 * LOG_NOTICE in syslog)
25 #define AUTH_FAILURE_LEVEL 2
26 #define AUTH_SUCCESS_LEVEL 3
27 #define AUTHZ_SUCCESS_LEVEL 4
29 /* 5 is used for both authentication and authorization */
30 #define AUTH_ANONYMOUS_LEVEL 5
31 #define AUTHZ_ANONYMOUS_LEVEL 5
33 #define AUTHZ_JSON_TYPE "Authorization"
34 #define AUTH_JSON_TYPE "Authentication"
37 * JSON message version numbers
39 * If adding a field increment the minor version
40 * If removing or changing the format/meaning of a field
41 * increment the major version.
49 #include "../lib/tsocket/tsocket.h"
50 #include "common_auth.h"
51 #include "lib/util/util_str_escape.h"
52 #include "libcli/security/dom_sid.h"
53 #include "libcli/security/security_token.h"
54 #include "librpc/gen_ndr/server_id.h"
55 #include "source4/lib/messaging/messaging.h"
56 #include "source4/lib/messaging/irpc.h"
57 #include "lib/util/server_id_db.h"
58 #include "lib/param/param.h"
59 #include "librpc/ndr/libndr.h"
60 #include "librpc/gen_ndr/windows_event_ids.h"
61 #include "lib/audit_logging/audit_logging.h"
64 * Determine the type of the password supplied for the
65 * authorisation attempt.
68 static const char* get_password_type(const struct auth_usersupplied_info
*ui
);
73 #include "system/time.h"
76 * Write the json object to the debug logs.
79 static void log_json(struct imessaging_context
*msg_ctx
,
80 struct loadparm_context
*lp_ctx
,
81 struct json_object
*object
,
85 audit_log_json(object
, debug_class
, debug_level
);
86 if (msg_ctx
&& lp_ctx
&& lpcfg_auth_event_notification(lp_ctx
)) {
87 audit_message_send(msg_ctx
,
95 * Determine the Windows logon type for the current authorisation attempt.
97 * Currently Samba only supports
99 * 2 Interactive A user logged on to this computer.
100 * 3 Network A user or computer logged on to this computer from
102 * 8 NetworkCleartext A user logged on to this computer from the network.
103 * The user's password was passed to the authentication
104 * package in its unhashed form.
107 static enum event_logon_type
get_logon_type(
108 const struct auth_usersupplied_info
*ui
)
110 if ((ui
->logon_parameters
& MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED
)
111 || (ui
->password_state
== AUTH_PASSWORD_PLAIN
)) {
112 return EVT_LOGON_NETWORK_CLEAR_TEXT
;
113 } else if (ui
->flags
& USER_INFO_INTERACTIVE_LOGON
) {
114 return EVT_LOGON_INTERACTIVE
;
116 return EVT_LOGON_NETWORK
;
120 * Write a machine parsable json formatted authentication log entry.
122 * IF removing or changing the format/meaning of a field please update the
123 * major version number AUTH_MAJOR
125 * IF adding a new field please update the minor version number AUTH_MINOR
127 * To process the resulting log lines from the commend line use jq to
130 * grep "^ {" log file |
131 * jq -rc '"\(.timestamp)\t\(.Authentication.status)\t
132 * \(.Authentication.clientDomain)\t
133 * \(.Authentication.clientAccount)
134 * \t\(.Authentication.workstation)
135 * \t\(.Authentication.remoteAddress)
136 * \t\(.Authentication.localAddress)"'
138 static void log_authentication_event_json(
139 struct imessaging_context
*msg_ctx
,
140 struct loadparm_context
*lp_ctx
,
141 const struct timeval
*start_time
,
142 const struct auth_usersupplied_info
*ui
,
144 const char *domain_name
,
145 const char *account_name
,
146 const char *unix_username
,
148 enum event_id_type event_id
,
151 struct json_object wrapper
= json_empty_object
;
152 struct json_object authentication
= json_empty_object
;
153 char negotiate_flags
[11];
156 authentication
= json_new_object();
157 if (json_is_invalid(&authentication
)) {
160 rc
= json_add_version(&authentication
, AUTH_MAJOR
, AUTH_MINOR
);
164 rc
= json_add_int(&authentication
,
170 rc
= json_add_int(&authentication
, "logonType", get_logon_type(ui
));
174 rc
= json_add_string(&authentication
, "status", nt_errstr(status
));
178 rc
= json_add_address(&authentication
, "localAddress", ui
->local_host
);
183 json_add_address(&authentication
, "remoteAddress", ui
->remote_host
);
187 rc
= json_add_string(
188 &authentication
, "serviceDescription", ui
->service_description
);
192 rc
= json_add_string(
193 &authentication
, "authDescription", ui
->auth_description
);
197 rc
= json_add_string(
198 &authentication
, "clientDomain", ui
->client
.domain_name
);
202 rc
= json_add_string(
203 &authentication
, "clientAccount", ui
->client
.account_name
);
207 rc
= json_add_string(
208 &authentication
, "workstation", ui
->workstation_name
);
212 rc
= json_add_string(&authentication
, "becameAccount", account_name
);
216 rc
= json_add_string(&authentication
, "becameDomain", domain_name
);
220 rc
= json_add_sid(&authentication
, "becameSid", sid
);
224 rc
= json_add_string(
225 &authentication
, "mappedAccount", ui
->mapped
.account_name
);
229 rc
= json_add_string(
230 &authentication
, "mappedDomain", ui
->mapped
.domain_name
);
234 rc
= json_add_string(&authentication
,
236 ui
->netlogon_trust_account
.computer_name
);
240 rc
= json_add_string(&authentication
,
241 "netlogonTrustAccount",
242 ui
->netlogon_trust_account
.account_name
);
246 snprintf(negotiate_flags
,
247 sizeof( negotiate_flags
),
249 ui
->netlogon_trust_account
.negotiate_flags
);
250 rc
= json_add_string(
251 &authentication
, "netlogonNegotiateFlags", negotiate_flags
);
255 rc
= json_add_int(&authentication
,
256 "netlogonSecureChannelType",
257 ui
->netlogon_trust_account
.secure_channel_type
);
261 rc
= json_add_sid(&authentication
,
262 "netlogonTrustAccountSid",
263 ui
->netlogon_trust_account
.sid
);
267 rc
= json_add_string(
268 &authentication
, "passwordType", get_password_type(ui
));
273 wrapper
= json_new_object();
274 if (json_is_invalid(&wrapper
)) {
277 rc
= json_add_timestamp(&wrapper
);
281 rc
= json_add_string(&wrapper
, "type", AUTH_JSON_TYPE
);
285 rc
= json_add_object(&wrapper
, AUTH_JSON_TYPE
, &authentication
);
291 * While not a general-purpose profiling solution this will
292 * assist some to determine how long NTLM and KDC
293 * authentication takes once this process can handle it. This
294 * covers transactions elsewhere but not (eg) the delay while
295 * this is waiting unread on the input socket.
297 if (start_time
!= NULL
) {
298 struct timeval current_time
= timeval_current();
299 uint64_t duration
= usec_time_diff(¤t_time
,
301 rc
= json_add_int(&authentication
, "duration", duration
);
310 DBGC_AUTH_AUDIT_JSON
,
316 * On a failure authentication will not have been added to wrapper so it
317 * needs to be freed to avoid a leak.
320 json_free(&authentication
);
322 DBG_ERR("Failed to write authentication event JSON log message\n");
326 * Log details of a successful authorization to a service,
327 * in a machine parsable json format
329 * IF removing or changing the format/meaning of a field please update the
330 * major version number AUTHZ_MAJOR
332 * IF adding a new field please update the minor version number AUTHZ_MINOR
334 * To process the resulting log lines from the commend line use jq to
337 * grep "^ {" log_file |\
338 * jq -rc '"\(.timestamp)\t
339 * \(.Authorization.domain)\t
340 * \(.Authorization.account)\t
341 * \(.Authorization.remoteAddress)"'
344 static void log_successful_authz_event_json(
345 struct imessaging_context
*msg_ctx
,
346 struct loadparm_context
*lp_ctx
,
347 const struct tsocket_address
*remote
,
348 const struct tsocket_address
*local
,
349 const char *service_description
,
350 const char *auth_type
,
351 const char *transport_protection
,
352 struct auth_session_info
*session_info
,
355 struct json_object wrapper
= json_empty_object
;
356 struct json_object authorization
= json_empty_object
;
357 char account_flags
[11];
360 authorization
= json_new_object();
361 if (json_is_invalid(&authorization
)) {
364 rc
= json_add_version(&authorization
, AUTHZ_MAJOR
, AUTHZ_MINOR
);
368 rc
= json_add_address(&authorization
, "localAddress", local
);
372 rc
= json_add_address(&authorization
, "remoteAddress", remote
);
376 rc
= json_add_string(
377 &authorization
, "serviceDescription", service_description
);
381 rc
= json_add_string(&authorization
, "authType", auth_type
);
385 rc
= json_add_string(
386 &authorization
, "domain", session_info
->info
->domain_name
);
390 rc
= json_add_string(
391 &authorization
, "account", session_info
->info
->account_name
);
396 &authorization
, "sid", &session_info
->security_token
->sids
[0]);
401 &authorization
, "sessionId", &session_info
->unique_session_token
);
405 rc
= json_add_string(
406 &authorization
, "logonServer", session_info
->info
->logon_server
);
410 rc
= json_add_string(
411 &authorization
, "transportProtection", transport_protection
);
416 snprintf(account_flags
,
417 sizeof(account_flags
),
419 session_info
->info
->acct_flags
);
420 rc
= json_add_string(&authorization
, "accountFlags", account_flags
);
425 wrapper
= json_new_object();
426 if (json_is_invalid(&wrapper
)) {
429 rc
= json_add_timestamp(&wrapper
);
433 rc
= json_add_string(&wrapper
, "type", AUTHZ_JSON_TYPE
);
437 rc
= json_add_object(&wrapper
, AUTHZ_JSON_TYPE
, &authorization
);
445 DBGC_AUTH_AUDIT_JSON
,
451 * On a failure authorization will not have been added to wrapper so it
452 * needs to be freed to avoid a leak.
455 json_free(&authorization
);
457 DBG_ERR("Unable to log Authentication event JSON audit message\n");
462 static void log_no_json(struct imessaging_context
*msg_ctx
,
463 struct loadparm_context
*lp_ctx
)
465 if (msg_ctx
&& lp_ctx
&& lpcfg_auth_event_notification(lp_ctx
)) {
466 static bool auth_event_logged
= false;
467 if (auth_event_logged
== false) {
468 auth_event_logged
= true;
469 DBG_ERR("auth event notification = true but Samba was "
470 "not compiled with jansson\n");
473 static bool json_logged
= false;
474 if (json_logged
== false) {
476 DBG_NOTICE("JSON auth logs not available unless "
477 "compiled with jansson\n");
484 static void log_authentication_event_json(
485 struct imessaging_context
*msg_ctx
,
486 struct loadparm_context
*lp_ctx
,
487 const struct timeval
*start_time
,
488 const struct auth_usersupplied_info
*ui
,
490 const char *domain_name
,
491 const char *account_name
,
492 const char *unix_username
,
494 enum event_id_type event_id
,
497 log_no_json(msg_ctx
, lp_ctx
);
501 static void log_successful_authz_event_json(
502 struct imessaging_context
*msg_ctx
,
503 struct loadparm_context
*lp_ctx
,
504 const struct tsocket_address
*remote
,
505 const struct tsocket_address
*local
,
506 const char *service_description
,
507 const char *auth_type
,
508 const char *transport_protection
,
509 struct auth_session_info
*session_info
,
512 log_no_json(msg_ctx
, lp_ctx
);
519 * Determine the type of the password supplied for the
520 * authorisation attempt.
523 static const char* get_password_type(const struct auth_usersupplied_info
*ui
)
526 const char *password_type
= NULL
;
528 if (ui
->password_type
!= NULL
) {
529 password_type
= ui
->password_type
;
530 } else if (ui
->auth_description
!= NULL
&&
531 strncmp("ServerAuthenticate", ui
->auth_description
, 18) == 0)
533 if (ui
->netlogon_trust_account
.negotiate_flags
534 & NETLOGON_NEG_SUPPORTS_AES
) {
535 password_type
= "HMAC-SHA256";
536 } else if (ui
->netlogon_trust_account
.negotiate_flags
537 & NETLOGON_NEG_STRONG_KEYS
) {
538 password_type
= "HMAC-MD5";
540 password_type
= "DES";
542 } else if (ui
->password_state
== AUTH_PASSWORD_RESPONSE
&&
543 (ui
->logon_parameters
& MSV1_0_ALLOW_MSVCHAPV2
) &&
544 ui
->password
.response
.nt
.length
== 24) {
545 password_type
= "MSCHAPv2";
546 } else if ((ui
->logon_parameters
& MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED
)
547 || (ui
->password_state
== AUTH_PASSWORD_PLAIN
)) {
548 password_type
= "Plaintext";
549 } else if (ui
->password_state
== AUTH_PASSWORD_HASH
) {
550 password_type
= "Supplied-NT-Hash";
551 } else if (ui
->password_state
== AUTH_PASSWORD_RESPONSE
552 && ui
->password
.response
.nt
.length
> 24) {
553 password_type
= "NTLMv2";
554 } else if (ui
->password_state
== AUTH_PASSWORD_RESPONSE
555 && ui
->password
.response
.nt
.length
== 24) {
556 password_type
= "NTLMv1";
557 } else if (ui
->password_state
== AUTH_PASSWORD_RESPONSE
558 && ui
->password
.response
.lanman
.length
== 24) {
559 password_type
= "LANMan";
560 } else if (ui
->password_state
== AUTH_PASSWORD_RESPONSE
561 && ui
->password
.response
.nt
.length
== 0
562 && ui
->password
.response
.lanman
.length
== 0) {
563 password_type
= "No-Password";
565 return password_type
;
569 * Write a human readable authentication log entry.
572 static void log_authentication_event_human_readable(
573 const struct auth_usersupplied_info
*ui
,
575 const char *domain_name
,
576 const char *account_name
,
577 const char *unix_username
,
581 TALLOC_CTX
*frame
= NULL
;
583 const char *ts
= NULL
; /* formatted current time */
584 char *remote
= NULL
; /* formatted remote host */
585 char *local
= NULL
; /* formatted local host */
586 char *nl
= NULL
; /* NETLOGON details if present */
587 char *trust_computer_name
= NULL
;
588 char *trust_account_name
= NULL
;
589 char *logon_line
= NULL
;
590 const char *password_type
= NULL
;
592 frame
= talloc_stackframe();
594 password_type
= get_password_type(ui
);
595 /* Get the current time */
596 ts
= audit_get_timestamp(frame
);
598 /* Only log the NETLOGON details if they are present */
599 if (ui
->netlogon_trust_account
.computer_name
||
600 ui
->netlogon_trust_account
.account_name
) {
601 trust_computer_name
= log_escape(frame
,
602 ui
->netlogon_trust_account
.computer_name
);
603 trust_account_name
= log_escape(frame
,
604 ui
->netlogon_trust_account
.account_name
);
605 nl
= talloc_asprintf(frame
,
606 " NETLOGON computer [%s] trust account [%s]",
607 trust_computer_name
, trust_account_name
);
610 remote
= tsocket_address_string(ui
->remote_host
, frame
);
611 local
= tsocket_address_string(ui
->local_host
, frame
);
613 if (NT_STATUS_IS_OK(status
)) {
614 struct dom_sid_buf sid_buf
;
616 logon_line
= talloc_asprintf(frame
,
617 " became [%s]\\[%s] [%s].",
618 log_escape(frame
, domain_name
),
619 log_escape(frame
, account_name
),
620 dom_sid_str_buf(sid
, &sid_buf
));
622 logon_line
= talloc_asprintf(
624 " mapped to [%s]\\[%s].",
625 log_escape(frame
, ui
->mapped
.domain_name
),
626 log_escape(frame
, ui
->mapped
.account_name
));
629 DEBUGC(DBGC_AUTH_AUDIT
, debug_level
,
630 ("Auth: [%s,%s] user [%s]\\[%s]"
631 " at [%s] with [%s] status [%s]"
632 " workstation [%s] remote host [%s]"
635 ui
->service_description
,
636 ui
->auth_description
,
637 log_escape(frame
, ui
->client
.domain_name
),
638 log_escape(frame
, ui
->client
.account_name
),
642 log_escape(frame
, ui
->workstation_name
),
653 * Log details of an authentication attempt.
654 * Successful and unsuccessful attempts are logged.
656 * NOTE: msg_ctx and lp_ctx is optional, but when supplied allows streaming the
657 * authentication events over the message bus.
659 void log_authentication_event(
660 struct imessaging_context
*msg_ctx
,
661 struct loadparm_context
*lp_ctx
,
662 const struct timeval
*start_time
,
663 const struct auth_usersupplied_info
*ui
,
665 const char *domain_name
,
666 const char *account_name
,
667 const char *unix_username
,
670 /* set the log level */
671 int debug_level
= AUTH_FAILURE_LEVEL
;
672 enum event_id_type event_id
= EVT_ID_UNSUCCESSFUL_LOGON
;
674 if (NT_STATUS_IS_OK(status
)) {
675 debug_level
= AUTH_SUCCESS_LEVEL
;
676 event_id
= EVT_ID_SUCCESSFUL_LOGON
;
677 if (dom_sid_equal(sid
, &global_sid_Anonymous
)) {
678 debug_level
= AUTH_ANONYMOUS_LEVEL
;
682 if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT
, debug_level
)) {
683 log_authentication_event_human_readable(ui
,
691 if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT_JSON
, debug_level
) ||
692 (msg_ctx
&& lp_ctx
&& lpcfg_auth_event_notification(lp_ctx
))) {
693 log_authentication_event_json(msg_ctx
,
710 * Log details of a successful authorization to a service,
711 * in a human readable format.
714 static void log_successful_authz_event_human_readable(
715 const struct tsocket_address
*remote
,
716 const struct tsocket_address
*local
,
717 const char *service_description
,
718 const char *auth_type
,
719 const char *transport_protection
,
720 struct auth_session_info
*session_info
,
723 TALLOC_CTX
*frame
= NULL
;
725 const char *ts
= NULL
; /* formatted current time */
726 char *remote_str
= NULL
; /* formatted remote host */
727 char *local_str
= NULL
; /* formatted local host */
728 struct dom_sid_buf sid_buf
;
730 frame
= talloc_stackframe();
732 /* Get the current time */
733 ts
= audit_get_timestamp(frame
);
735 remote_str
= tsocket_address_string(remote
, frame
);
736 local_str
= tsocket_address_string(local
, frame
);
738 DEBUGC(DBGC_AUTH_AUDIT
, debug_level
,
739 ("Successful AuthZ: [%s,%s] user [%s]\\[%s] [%s]"
742 " local host [%s]\n",
745 log_escape(frame
, session_info
->info
->domain_name
),
746 log_escape(frame
, session_info
->info
->account_name
),
747 dom_sid_str_buf(&session_info
->security_token
->sids
[0],
757 * Log details of a successful authorization to a service.
759 * Only successful authorizations are logged. For clarity:
760 * - NTLM bad passwords will be recorded by log_authentication_event
761 * - Kerberos decrypt failures need to be logged in gensec_gssapi et al
763 * The service may later refuse authorization due to an ACL.
765 * NOTE: msg_ctx and lp_ctx is optional, but when supplied allows streaming the
766 * authentication events over the message bus.
768 void log_successful_authz_event(
769 struct imessaging_context
*msg_ctx
,
770 struct loadparm_context
*lp_ctx
,
771 const struct tsocket_address
*remote
,
772 const struct tsocket_address
*local
,
773 const char *service_description
,
774 const char *auth_type
,
775 const char *transport_protection
,
776 struct auth_session_info
*session_info
)
778 int debug_level
= AUTHZ_SUCCESS_LEVEL
;
780 /* set the log level */
781 if (security_token_is_anonymous(session_info
->security_token
)) {
782 debug_level
= AUTH_ANONYMOUS_LEVEL
;
785 if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT
, debug_level
)) {
786 log_successful_authz_event_human_readable(remote
,
790 transport_protection
,
794 if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT_JSON
, debug_level
) ||
795 (msg_ctx
&& lp_ctx
&& lpcfg_auth_event_notification(lp_ctx
))) {
796 log_successful_authz_event_json(msg_ctx
, lp_ctx
,
801 transport_protection
,