diff -up openssh-6.3p1/Makefile.in.audit openssh-6.3p1/Makefile.in

--- openssh-6.3p1/Makefile.in.audit	2013-06-11 03:26:10.000000000 +0200

+++ openssh-6.3p1/Makefile.in	2013-10-07 15:53:34.246717277 +0200

@@ -73,7 +73,7 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o

 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \

 	kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \

 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \

-	jpake.o schnorr.o ssh-pkcs11.o krl.o

+	jpake.o schnorr.o ssh-pkcs11.o krl.o auditstub.o

 SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \

 	sshconnect.o sshconnect1.o sshconnect2.o mux.o \

diff -up openssh-6.3p1/audit-bsm.c.audit openssh-6.3p1/audit-bsm.c

--- openssh-6.3p1/audit-bsm.c.audit	2012-02-24 00:40:43.000000000 +0100

+++ openssh-6.3p1/audit-bsm.c	2013-10-07 15:53:34.246717277 +0200

@@ -375,10 +375,23 @@ audit_connection_from(const char *host,

 #endif

 }

-void

+int

 audit_run_command(const char *command)

 {

 	/* not implemented */

+	return 0;

+}

+

+void

+audit_end_command(int handle, const char *command)

+{

+	/* not implemented */

+}

+

+void

+audit_count_session_open(void)

+{

+	/* not necessary */

 }

 void

@@ -393,6 +406,12 @@ audit_session_close(struct logininfo *li

 	/* not implemented */

 }

+int

+audit_keyusage(int host_user, const char *type, unsigned bits, char *fp, int rv)

+{

+	/* not implemented */

+}

+

 void

 audit_event(ssh_audit_event_t event)

 {

@@ -454,4 +473,40 @@ audit_event(ssh_audit_event_t event)

 		debug("%s: unhandled event %d", __func__, event);

 	}

 }

+

+void

+audit_unsupported_body(int what)

+{

+	/* not implemented */

+}

+

+void

+audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid, uid_t uid)

+{

+	/* not implemented */

+}

+

+void

+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)

+{

+	/* not implemented */

+}

+

+void

+audit_destroy_sensitive_data(const char *fp)

+{

+	/* not implemented */

+}

+

+void

+audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)

+{

+	/* not implemented */

+}

+

+void

+audit_generate_ephemeral_server_key(const char *fp)

+{

+	/* not implemented */

+}

 #endif /* BSM */

diff -up openssh-6.3p1/audit-linux.c.audit openssh-6.3p1/audit-linux.c

--- openssh-6.3p1/audit-linux.c.audit	2011-01-17 11:15:30.000000000 +0100

+++ openssh-6.3p1/audit-linux.c	2013-10-07 15:53:34.246717277 +0200

@@ -35,13 +35,24 @@

 #include "log.h"

 #include "audit.h"

+#include "key.h"

+#include "hostfile.h"

+#include "auth.h"

+#include "servconf.h"

 #include "canohost.h"

+#include "packet.h"

+#include "cipher.h"

+#define AUDIT_LOG_SIZE 128

+

+extern ServerOptions options;

+extern Authctxt *the_authctxt;

+extern u_int utmp_len;

 const char* audit_username(void);

-int

-linux_audit_record_event(int uid, const char *username,

-    const char *hostname, const char *ip, const char *ttyn, int success)

+static void

+linux_audit_user_logxxx(int uid, const char *username,

+    const char *hostname, const char *ip, const char *ttyn, int success, int event)

 {

 	int audit_fd, rc, saved_errno;

@@ -49,11 +60,11 @@ linux_audit_record_event(int uid, const

 	if (audit_fd < 0) {

 		if (errno == EINVAL || errno == EPROTONOSUPPORT ||

 		    errno == EAFNOSUPPORT)

-			return 1; /* No audit support in kernel */

+			return; /* No audit support in kernel */

 		else

-			return 0; /* Must prevent login */

+			goto fatal_report; /* Must prevent login */

 	}

-	rc = audit_log_acct_message(audit_fd, AUDIT_USER_LOGIN,

+	rc = audit_log_acct_message(audit_fd, event,

 	    NULL, "login", username ? username : "(unknown)",

 	    username == NULL ? uid : -1, hostname, ip, ttyn, success);

 	saved_errno = errno;

@@ -65,35 +76,150 @@ linux_audit_record_event(int uid, const

 	if ((rc == -EPERM) && (geteuid() != 0))

 		rc = 0;

 	errno = saved_errno;

-	return (rc >= 0);

+	if (rc < 0) {

+fatal_report:

+		fatal("linux_audit_write_entry failed: %s", strerror(errno));

+	}

 }

+static void

+linux_audit_user_auth(int uid, const char *username,

+    const char *hostname, const char *ip, const char *ttyn, int success, int event)

+{

+	int audit_fd, rc, saved_errno;

+	static const char *event_name[] = {

+		"maxtries exceeded",

+		"root denied",

+		"success",

+		"none",

+		"password",

+		"challenge-response",

+		"pubkey",

+		"hostbased",

+		"gssapi",

+		"invalid user",

+		"nologin",

+		"connection closed",

+		"connection abandoned",

+		"unknown"

+	};

+

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||

+		    errno == EAFNOSUPPORT)

+			return; /* No audit support in kernel */

+		else

+			goto fatal_report; /* Must prevent login */

+	}

+	

+	if ((event < 0) || (event > SSH_AUDIT_UNKNOWN))

+		event = SSH_AUDIT_UNKNOWN;

+

+	rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH,

+	    NULL, event_name[event], username ? username : "(unknown)",

+	    username == NULL ? uid : -1, hostname, ip, ttyn, success);

+	saved_errno = errno;

+	close(audit_fd);

+	/*

+	 * Do not report error if the error is EPERM and sshd is run as non

+	 * root user.

+	 */

+	if ((rc == -EPERM) && (geteuid() != 0))

+		rc = 0;

+	errno = saved_errno;

+	if (rc < 0) {

+fatal_report:

+		fatal("linux_audit_write_entry failed: %s", strerror(errno));

+	}

+}

+

+int

+audit_keyusage(int host_user, const char *type, unsigned bits, char *fp, int rv)

+{

+	char buf[AUDIT_LOG_SIZE];

+	int audit_fd, rc, saved_errno;

+

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||

+					 errno == EAFNOSUPPORT)

+			return 1; /* No audit support in kernel */

+		else                                                                                                                                       

+			return 0; /* Must prevent login */

+	}

+	snprintf(buf, sizeof(buf), "%s_auth rport=%d", host_user ? "pubkey" : "hostbased", get_remote_port());

+	rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL,

+		buf, audit_username(), -1, NULL, get_remote_ipaddr(), NULL, rv);

+	if ((rc < 0) && ((rc != -1) || (getuid() == 0)))

+		goto out;

+	snprintf(buf, sizeof(buf), "key algo=%s size=%d fp=%s%s rport=%d",

+			type, bits, key_fingerprint_prefix(), fp, get_remote_port());

+	rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL,

+		buf, audit_username(), -1, NULL, get_remote_ipaddr(), NULL, rv);

+out:

+	saved_errno = errno;

+	audit_close(audit_fd);

+	errno = saved_errno;

+	/* do not report error if the error is EPERM and sshd is run as non root user */

+	return (rc >= 0) || ((rc == -EPERM) && (getuid() != 0));

+}

+

+static int user_login_count = 0;

+

 /* Below is the sshd audit API code */

 void

 audit_connection_from(const char *host, int port)

 {

-}

 	/* not implemented */

+}

-void

+int

 audit_run_command(const char *command)

 {

-	/* not implemented */

+	if (!user_login_count++) 

+		linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

+		    NULL, "ssh", 1, AUDIT_USER_LOGIN);

+	linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

+	    NULL, "ssh", 1, AUDIT_USER_START);

+	return 0;

+}

+

+void

+audit_end_command(int handle, const char *command)

+{

+	linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

+	    NULL, "ssh", 1, AUDIT_USER_END);

+	if (user_login_count && !--user_login_count) 

+		linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

+		    NULL, "ssh", 1, AUDIT_USER_LOGOUT);

+}

+

+void

+audit_count_session_open(void)

+{

+	user_login_count++;

 }

 void

 audit_session_open(struct logininfo *li)

 {

-	if (linux_audit_record_event(li->uid, NULL, li->hostname,

-	    NULL, li->line, 1) == 0)

-		fatal("linux_audit_write_entry failed: %s", strerror(errno));

+	if (!user_login_count++) 

+		linux_audit_user_logxxx(li->uid, NULL, li->hostname,

+		    NULL, li->line, 1, AUDIT_USER_LOGIN);

+	linux_audit_user_logxxx(li->uid, NULL, li->hostname,

+	    NULL, li->line, 1, AUDIT_USER_START);

 }

 void

 audit_session_close(struct logininfo *li)

 {

-	/* not implemented */

+	linux_audit_user_logxxx(li->uid, NULL, li->hostname,

+	    NULL, li->line, 1, AUDIT_USER_END);

+	if (user_login_count && !--user_login_count) 

+		linux_audit_user_logxxx(li->uid, NULL, li->hostname,

+		    NULL, li->line, 1, AUDIT_USER_LOGOUT);

 }

 void

@@ -101,21 +227,43 @@ audit_event(ssh_audit_event_t event)

 {

 	switch(event) {

 	case SSH_AUTH_SUCCESS:

-	case SSH_CONNECTION_CLOSE:

+		linux_audit_user_auth(-1, audit_username(), NULL,

+			get_remote_ipaddr(), "ssh", 1, event);

+		break;

+

 	case SSH_NOLOGIN:

-	case SSH_LOGIN_EXCEED_MAXTRIES:

 	case SSH_LOGIN_ROOT_DENIED:

+		linux_audit_user_auth(-1, audit_username(), NULL,

+			get_remote_ipaddr(), "ssh", 0, event);

+		linux_audit_user_logxxx(-1, audit_username(), NULL,

+			get_remote_ipaddr(), "ssh", 0, AUDIT_USER_LOGIN);

 		break;

+	case SSH_LOGIN_EXCEED_MAXTRIES:

 	case SSH_AUTH_FAIL_NONE:

 	case SSH_AUTH_FAIL_PASSWD:

 	case SSH_AUTH_FAIL_KBDINT:

 	case SSH_AUTH_FAIL_PUBKEY:

 	case SSH_AUTH_FAIL_HOSTBASED:

 	case SSH_AUTH_FAIL_GSSAPI:

+		linux_audit_user_auth(-1, audit_username(), NULL,

+			get_remote_ipaddr(), "ssh", 0, event);

+		break;

+

+	case SSH_CONNECTION_CLOSE:

+		if (user_login_count) {

+			while (user_login_count--)

+				linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

+				    NULL, "ssh", 1, AUDIT_USER_END);

+			linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

+			    NULL, "ssh", 1, AUDIT_USER_LOGOUT);

+		}

+		break;

+

+	case SSH_CONNECTION_ABANDON:

 	case SSH_INVALID_USER:

-		linux_audit_record_event(-1, audit_username(), NULL,

-			get_remote_ipaddr(), "sshd", 0);

+		linux_audit_user_logxxx(-1, audit_username(), NULL,

+			get_remote_ipaddr(), "ssh", 0, AUDIT_USER_LOGIN);

 		break;

 	default:

@@ -123,4 +271,135 @@ audit_event(ssh_audit_event_t event)

 	}

 }

+void

+audit_unsupported_body(int what)

+{

+#ifdef AUDIT_CRYPTO_SESSION

+	char buf[AUDIT_LOG_SIZE];

+	const static char *name[] = { "cipher", "mac", "comp" };

+	char *s;

+	int audit_fd;

+

+	snprintf(buf, sizeof(buf), "op=unsupported-%s direction=? cipher=? ksize=? rport=%d laddr=%s lport=%d ",

+		name[what], get_remote_port(), (s = get_local_ipaddr(packet_get_connection_in())),

+		get_local_port());

+	free(s);

+	audit_fd = audit_open();

+	if (audit_fd < 0)

+		/* no problem, the next instruction will be fatal() */

+		return;

+	audit_log_user_message(audit_fd, AUDIT_CRYPTO_SESSION,

+			buf, NULL, get_remote_ipaddr(), NULL, 0);

+	audit_close(audit_fd);

+#endif

+}

+

+const static char *direction[] = { "from-server", "from-client", "both" };

+

+void

+audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,

+	       uid_t uid)

+{

+#ifdef AUDIT_CRYPTO_SESSION

+	char buf[AUDIT_LOG_SIZE];

+	int audit_fd, audit_ok;

+	Cipher *cipher = cipher_by_name(enc);

+	char *s;

+

+	snprintf(buf, sizeof(buf), "op=start direction=%s cipher=%s ksize=%d mac=%s spid=%jd suid=%jd rport=%d laddr=%s lport=%d ",

+		direction[ctos], enc, cipher ? 8 * cipher->key_len : 0, mac,

+		(intmax_t)pid, (intmax_t)uid,

+		get_remote_port(), (s = get_local_ipaddr(packet_get_connection_in())), get_local_port());

+	free(s);

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||

+					 errno == EAFNOSUPPORT)

+			return; /* No audit support in kernel */

+		else                                                                                                                                       

+			fatal("cannot open audit"); /* Must prevent login */

+	}

+	audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_SESSION,

+			buf, NULL, get_remote_ipaddr(), NULL, 1);

+	audit_close(audit_fd);

+	/* do not abort if the error is EPERM and sshd is run as non root user */

+	if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))

+		fatal("cannot write into audit"); /* Must prevent login */

+#endif

+}

+

+void

+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)

+{

+	char buf[AUDIT_LOG_SIZE];

+	int audit_fd, audit_ok;

+	char *s;

+

+	snprintf(buf, sizeof(buf), "op=destroy kind=session fp=? direction=%s spid=%jd suid=%jd rport=%d laddr=%s lport=%d ",

+		 direction[ctos], (intmax_t)pid, (intmax_t)uid,

+		 get_remote_port(),

+		 (s = get_local_ipaddr(packet_get_connection_in())),

+		 get_local_port());

+	free(s);

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno != EINVAL && errno != EPROTONOSUPPORT &&

+					 errno != EAFNOSUPPORT)

+			error("cannot open audit");

+		return;

+	}

+	audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,

+			buf, NULL, get_remote_ipaddr(), NULL, 1);

+	audit_close(audit_fd);

+	/* do not abort if the error is EPERM and sshd is run as non root user */

+	if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))

+		error("cannot write into audit");

+}

+

+void

+audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)

+{

+	char buf[AUDIT_LOG_SIZE];

+	int audit_fd, audit_ok;

+

+	snprintf(buf, sizeof(buf), "op=destroy kind=server fp=%s direction=? spid=%jd suid=%jd ",

+		fp, (intmax_t)pid, (intmax_t)uid);

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno != EINVAL && errno != EPROTONOSUPPORT &&

+					 errno != EAFNOSUPPORT)

+			error("cannot open audit");

+		return;

+	}

+	audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,

+			buf, NULL,

+			listening_for_clients() ? NULL : get_remote_ipaddr(),

+			NULL, 1);

+	audit_close(audit_fd);

+	/* do not abort if the error is EPERM and sshd is run as non root user */

+	if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))

+		error("cannot write into audit");

+}

+

+void

+audit_generate_ephemeral_server_key(const char *fp)

+{

+	char buf[AUDIT_LOG_SIZE];

+	int audit_fd, audit_ok;

+

+	snprintf(buf, sizeof(buf), "op=create kind=server fp=%s direction=? ", fp);

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno != EINVAL && errno != EPROTONOSUPPORT &&

+					 errno != EAFNOSUPPORT)

+			error("cannot open audit");

+		return;

+	}

+	audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,

+			buf, NULL, 0, NULL, 1);

+	audit_close(audit_fd);

+	/* do not abort if the error is EPERM and sshd is run as non root user */

+	if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))

+		error("cannot write into audit");

+}

 #endif /* USE_LINUX_AUDIT */

diff -up openssh-6.3p1/audit.c.audit openssh-6.3p1/audit.c

--- openssh-6.3p1/audit.c.audit	2011-01-17 11:15:30.000000000 +0100

+++ openssh-6.3p1/audit.c	2013-10-07 15:53:34.246717277 +0200

@@ -28,6 +28,7 @@

 #include <stdarg.h>

 #include <string.h>

+#include <unistd.h>

 #ifdef SSH_AUDIT_EVENTS

@@ -36,6 +37,9 @@

 #include "key.h"

 #include "hostfile.h"

 #include "auth.h"

+#include "ssh-gss.h"

+#include "monitor_wrap.h"

+#include "xmalloc.h"

 /*

  * Care must be taken when using this since it WILL NOT be initialized when

@@ -111,6 +115,40 @@ audit_event_lookup(ssh_audit_event_t ev)

 	return(event_lookup[i].name);

 }

+void

+audit_key(int host_user, int *rv, const Key *key)

+{

+	char *fp;

+	const char *crypto_name;

+

+	fp = key_selected_fingerprint(key, SSH_FP_HEX);

+	if (key->type == KEY_RSA1)

+		crypto_name = "ssh-rsa1";

+	else

+		crypto_name = key_ssh_name(key);

+	if (audit_keyusage(host_user, crypto_name, key_size(key), fp, *rv) == 0)

+		*rv = 0;

+	free(fp);

+}

+

+void

+audit_unsupported(int what)

+{

+	PRIVSEP(audit_unsupported_body(what));

+}

+

+void

+audit_kex(int ctos, char *enc, char *mac, char *comp)

+{

+	PRIVSEP(audit_kex_body(ctos, enc, mac, comp, getpid(), getuid()));

+}

+

+void

+audit_session_key_free(int ctos)

+{

+	PRIVSEP(audit_session_key_free_body(ctos, getpid(), getuid()));

+}

+

 # ifndef CUSTOM_SSH_AUDIT_EVENTS

 /*

  * Null implementations of audit functions.

@@ -140,6 +178,17 @@ audit_event(ssh_audit_event_t event)

 }

 /*

+ * Called when a child process has called, or will soon call,

+ * audit_session_open.

+ */

+void

+audit_count_session_open(void)

+{

+	debug("audit count session open euid %d user %s", geteuid(),

+	      audit_username());

+}

+

+/*

  * Called when a user session is started.  Argument is the tty allocated to

  * the session, or NULL if no tty was allocated.

  *

@@ -174,13 +223,91 @@ audit_session_close(struct logininfo *li

 /*

  * This will be called when a user runs a non-interactive command.  Note that

  * it may be called multiple times for a single connection since SSH2 allows

- * multiple sessions within a single connection.

+ * multiple sessions within a single connection.  Returns a "handle" for

+ * audit_end_command.

  */

-void

+int

 audit_run_command(const char *command)

 {

 	debug("audit run command euid %d user %s command '%.200s'", geteuid(),

 	    audit_username(), command);

+	return 0;

+}

+

+/*

+ * This will be called when the non-interactive command finishes.  Note that

+ * it may be called multiple times for a single connection since SSH2 allows

+ * multiple sessions within a single connection.  "handle" should come from

+ * the corresponding audit_run_command.

+ */

+void

+audit_end_command(int handle, const char *command)

+{

+	debug("audit end nopty exec  euid %d user %s command '%.200s'", geteuid(),

+	    audit_username(), command);

+}

+

+/*

+ * This will be called when user is successfully autherized by the RSA1/RSA/DSA key.

+ *

+ * Type is the key type, len is the key length(byte) and fp is the fingerprint of the key.

+ */

+int

+audit_keyusage(int host_user, const char *type, unsigned bits, char *fp, int rv)

+{

+	debug("audit %s key usage euid %d user %s key type %s key length %d fingerprint %s%s, result %d", 

+		host_user ? "pubkey" : "hostbased", geteuid(), audit_username(), type, bits,

+		key_fingerprint_prefix(), fp, rv);

+}

+

+/*

+ * This will be called when the protocol negotiation fails.

+ */

+void

+audit_unsupported_body(int what)

+{

+	debug("audit unsupported protocol euid %d type %d", geteuid(), what);

+}

+

+/*

+ * This will be called on succesfull protocol negotiation.

+ */

+void

+audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,

+	       uid_t uid)

+{

+	debug("audit protocol negotiation euid %d direction %d cipher %s mac %s compresion %s from pid %ld uid %u",

+		(unsigned)geteuid(), ctos, enc, mac, compress, (long)pid,

+	        (unsigned)uid);

+}

+

+/*

+ * This will be called on succesfull session key discard

+ */

+void

+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)

+{

+	debug("audit session key discard euid %u direction %d from pid %ld uid %u",

+		(unsigned)geteuid(), ctos, (long)pid, (unsigned)uid);

+}

+

+/*

+ * This will be called on destroy private part of the server key

+ */

+void

+audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)

+{

+	debug("audit destroy sensitive data euid %d fingerprint %s from pid %ld uid %u",

+		geteuid(), fp, (long)pid, (unsigned)uid);

+}

+

+/*

+ * This will be called on generation of the ephemeral server key

+ */

+void

+audit_generate_ephemeral_server_key(const char *)

+{

+	debug("audit create ephemeral server key euid %d fingerprint %s", geteuid(), fp);

 }

 # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */

 #endif /* SSH_AUDIT_EVENTS */

diff -up openssh-6.3p1/audit.h.audit openssh-6.3p1/audit.h

--- openssh-6.3p1/audit.h.audit	2011-01-17 11:15:30.000000000 +0100

+++ openssh-6.3p1/audit.h	2013-10-07 15:53:34.246717277 +0200

@@ -28,6 +28,7 @@

 # define _SSH_AUDIT_H

 #include "loginrec.h"

+#include "key.h"

 enum ssh_audit_event_type {

 	SSH_LOGIN_EXCEED_MAXTRIES,

@@ -47,11 +48,25 @@ enum ssh_audit_event_type {

 };

 typedef enum ssh_audit_event_type ssh_audit_event_t;

+int	listening_for_clients(void);

+

 void	audit_connection_from(const char *, int);

 void	audit_event(ssh_audit_event_t);

+void	audit_count_session_open(void);

 void	audit_session_open(struct logininfo *);

 void	audit_session_close(struct logininfo *);

-void	audit_run_command(const char *);

+int	audit_run_command(const char *);

+void 	audit_end_command(int, const char *);

 ssh_audit_event_t audit_classify_auth(const char *);

+int	audit_keyusage(int, const char *, unsigned, char *, int);

+void	audit_key(int, int *, const Key *);

+void	audit_unsupported(int);

+void	audit_kex(int, char *, char *, char *);

+void	audit_unsupported_body(int);

+void	audit_kex_body(int, char *, char *, char *, pid_t, uid_t);

+void	audit_session_key_free(int ctos);

+void	audit_session_key_free_body(int ctos, pid_t, uid_t);

+void	audit_destroy_sensitive_data(const char *, pid_t, uid_t);

+void	audit_generate_ephemeral_server_key(const char *);

 #endif /* _SSH_AUDIT_H */

diff -up openssh-6.3p1/auditstub.c.audit openssh-6.3p1/auditstub.c

--- openssh-6.3p1/auditstub.c.audit	2013-10-07 15:53:34.247717272 +0200

+++ openssh-6.3p1/auditstub.c	2013-10-07 15:53:34.247717272 +0200

@@ -0,0 +1,50 @@

+/* $Id: auditstub.c,v 1.1 jfch Exp $ */

+

+/*

+ * Copyright 2010 Red Hat, Inc.  All rights reserved.

+ * Use is subject to license terms.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR

+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT