diff -up openssh-7.0p1/audit-bsm.c.audit openssh-7.0p1/audit-bsm.c

--- openssh-7.0p1/audit-bsm.c.audit	2015-08-11 10:57:29.000000000 +0200

+++ openssh-7.0p1/audit-bsm.c	2015-08-12 11:33:00.409914290 +0200

@@ -375,10 +375,23 @@ audit_connection_from(const char *host,

 #endif

 }

-void

+int

 audit_run_command(const char *command)

 {

 	/* not implemented */

+	return 0;

+}

+

+void

+audit_end_command(int handle, const char *command)

+{

+	/* not implemented */

+}

+

+void

+audit_count_session_open(void)

+{

+	/* not necessary */

 }

 void

@@ -393,6 +406,12 @@ audit_session_close(struct logininfo *li

 	/* not implemented */

 }

+int

+audit_keyusage(int host_user, const char *type, unsigned bits, char *fp, int rv)

+{

+	/* not implemented */

+}

+

 void

 audit_event(ssh_audit_event_t event)

 {

@@ -454,4 +473,40 @@ audit_event(ssh_audit_event_t event)

 		debug("%s: unhandled event %d", __func__, event);

 	}

 }

+

+void

+audit_unsupported_body(int what)

+{

+	/* not implemented */

+}

+

+void

+audit_kex_body(int ctos, char *enc, char *mac, char *compress, char *pfs, pid_t pid, uid_t uid)

+{

+	/* not implemented */

+}

+

+void

+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)

+{

+	/* not implemented */

+}

+

+void

+audit_destroy_sensitive_data(const char *fp)

+{

+	/* not implemented */

+}

+

+void

+audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)

+{

+	/* not implemented */

+}

+

+void

+audit_generate_ephemeral_server_key(const char *fp)

+{

+	/* not implemented */

+}

 #endif /* BSM */

diff -up openssh-7.0p1/audit.c.audit openssh-7.0p1/audit.c

--- openssh-7.0p1/audit.c.audit	2015-08-11 10:57:29.000000000 +0200

+++ openssh-7.0p1/audit.c	2015-08-12 11:33:00.410914289 +0200

@@ -28,6 +28,7 @@

 #include <stdarg.h>

 #include <string.h>

+#include <unistd.h>

 #ifdef SSH_AUDIT_EVENTS

@@ -36,6 +37,11 @@

 #include "key.h"

 #include "hostfile.h"

 #include "auth.h"

+#include "ssh-gss.h"

+#include "monitor_wrap.h"

+#include "xmalloc.h"

+#include "misc.h"

+#include "servconf.h"

 /*

  * Care must be taken when using this since it WILL NOT be initialized when

@@ -43,6 +49,7 @@

  * audit_event(CONNECTION_ABANDON) is called.  Test for NULL before using.

  */

 extern Authctxt *the_authctxt;

+extern ServerOptions options;

 /* Maybe add the audit class to struct Authmethod? */

 ssh_audit_event_t

@@ -71,13 +78,10 @@ audit_classify_auth(const char *method)

 const char *

 audit_username(void)

 {

-	static const char unknownuser[] = "(unknown user)";

-	static const char invaliduser[] = "(invalid user)";

+	static const char unknownuser[] = "(unknown)";

-	if (the_authctxt == NULL || the_authctxt->user == NULL)

+	if (the_authctxt == NULL || the_authctxt->user == NULL || !the_authctxt->valid)

 		return (unknownuser);

-	if (!the_authctxt->valid)

-		return (invaliduser);

 	return (the_authctxt->user);

 }

@@ -111,6 +115,40 @@ audit_event_lookup(ssh_audit_event_t ev)

 	return(event_lookup[i].name);

 }

+void

+audit_key(int host_user, int *rv, const Key *key)

+{

+	char *fp;

+	const char *crypto_name;

+

+	fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX);

+	if (key->type == KEY_RSA1)

+		crypto_name = "ssh-rsa1";

+	else

+		crypto_name = key_ssh_name(key);

+	if (audit_keyusage(host_user, crypto_name, key_size(key), fp, *rv) == 0)

+		*rv = 0;

+	free(fp);

+}

+

+void

+audit_unsupported(int what)

+{

+	PRIVSEP(audit_unsupported_body(what));

+}

+

+void

+audit_kex(int ctos, char *enc, char *mac, char *comp, char *pfs)

+{

+	PRIVSEP(audit_kex_body(ctos, enc, mac, comp, pfs, getpid(), getuid()));

+}

+

+void

+audit_session_key_free(int ctos)

+{

+	PRIVSEP(audit_session_key_free_body(ctos, getpid(), getuid()));

+}

+

 # ifndef CUSTOM_SSH_AUDIT_EVENTS

 /*

  * Null implementations of audit functions.

@@ -140,6 +178,17 @@ audit_event(ssh_audit_event_t event)

 }

 /*

+ * Called when a child process has called, or will soon call,

+ * audit_session_open.

+ */

+void

+audit_count_session_open(void)

+{

+	debug("audit count session open euid %d user %s", geteuid(),

+	      audit_username());

+}

+

+/*

  * Called when a user session is started.  Argument is the tty allocated to

  * the session, or NULL if no tty was allocated.

  *

@@ -174,13 +223,91 @@ audit_session_close(struct logininfo *li

 /*

  * This will be called when a user runs a non-interactive command.  Note that

  * it may be called multiple times for a single connection since SSH2 allows

- * multiple sessions within a single connection.

+ * multiple sessions within a single connection.  Returns a "handle" for

+ * audit_end_command.

  */

-void

+int

 audit_run_command(const char *command)

 {

 	debug("audit run command euid %d user %s command '%.200s'", geteuid(),

 	    audit_username(), command);

+	return 0;

+}

+

+/*

+ * This will be called when the non-interactive command finishes.  Note that

+ * it may be called multiple times for a single connection since SSH2 allows

+ * multiple sessions within a single connection.  "handle" should come from

+ * the corresponding audit_run_command.

+ */

+void

+audit_end_command(int handle, const char *command)

+{

+	debug("audit end nopty exec  euid %d user %s command '%.200s'", geteuid(),

+	    audit_username(), command);

+}

+

+/*

+ * This will be called when user is successfully autherized by the RSA1/RSA/DSA key.

+ *

+ * Type is the key type, len is the key length(byte) and fp is the fingerprint of the key.

+ */

+int

+audit_keyusage(int host_user, const char *type, unsigned bits, char *fp, int rv)

+{

+	debug("audit %s key usage euid %d user %s key type %s key length %d fingerprint %s%s, result %d", 

+		host_user ? "pubkey" : "hostbased", geteuid(), audit_username(), type, bits,

+		sshkey_fingerprint_prefix(), fp, rv);

+}

+

+/*

+ * This will be called when the protocol negotiation fails.

+ */

+void

+audit_unsupported_body(int what)

+{

+	debug("audit unsupported protocol euid %d type %d", geteuid(), what);

+}

+

+/*

+ * This will be called on succesfull protocol negotiation.

+ */

+void

+audit_kex_body(int ctos, char *enc, char *mac, char *compress, char *pfs, pid_t pid,

+	       uid_t uid)

+{

+	debug("audit protocol negotiation euid %d direction %d cipher %s mac %s compresion %s pfs %s from pid %ld uid %u",

+		(unsigned)geteuid(), ctos, enc, mac, compress, pfs, (long)pid,

+	        (unsigned)uid);

+}

+

+/*

+ * This will be called on succesfull session key discard

+ */

+void

+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)

+{

+	debug("audit session key discard euid %u direction %d from pid %ld uid %u",

+		(unsigned)geteuid(), ctos, (long)pid, (unsigned)uid);

+}

+

+/*

+ * This will be called on destroy private part of the server key

+ */

+void

+audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)

+{

+	debug("audit destroy sensitive data euid %d fingerprint %s from pid %ld uid %u",

+		geteuid(), fp, (long)pid, (unsigned)uid);

+}

+

+/*

+ * This will be called on generation of the ephemeral server key

+ */

+void

+audit_generate_ephemeral_server_key(const char *)

+{

+	debug("audit create ephemeral server key euid %d fingerprint %s", geteuid(), fp);

 }

 # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */

 #endif /* SSH_AUDIT_EVENTS */

diff -up openssh-7.0p1/audit.h.audit openssh-7.0p1/audit.h

--- openssh-7.0p1/audit.h.audit	2015-08-11 10:57:29.000000000 +0200

+++ openssh-7.0p1/audit.h	2015-08-12 11:33:00.410914289 +0200

@@ -28,6 +28,7 @@

 # define _SSH_AUDIT_H

 #include "loginrec.h"

+#include "key.h"

 enum ssh_audit_event_type {

 	SSH_LOGIN_EXCEED_MAXTRIES,

@@ -47,11 +48,25 @@ enum ssh_audit_event_type {

 };

 typedef enum ssh_audit_event_type ssh_audit_event_t;

+int	listening_for_clients(void);

+

 void	audit_connection_from(const char *, int);

 void	audit_event(ssh_audit_event_t);

+void	audit_count_session_open(void);

 void	audit_session_open(struct logininfo *);

 void	audit_session_close(struct logininfo *);

-void	audit_run_command(const char *);

+int	audit_run_command(const char *);

+void 	audit_end_command(int, const char *);

 ssh_audit_event_t audit_classify_auth(const char *);

+int	audit_keyusage(int, const char *, unsigned, char *, int);

+void	audit_key(int, int *, const Key *);

+void	audit_unsupported(int);

+void	audit_kex(int, char *, char *, char *, char *);

+void	audit_unsupported_body(int);

+void	audit_kex_body(int, char *, char *, char *, char *, pid_t, uid_t);

+void	audit_session_key_free(int ctos);

+void	audit_session_key_free_body(int ctos, pid_t, uid_t);

+void	audit_destroy_sensitive_data(const char *, pid_t, uid_t);

+void	audit_generate_ephemeral_server_key(const char *);

 #endif /* _SSH_AUDIT_H */

diff -up openssh-7.0p1/audit-linux.c.audit openssh-7.0p1/audit-linux.c

--- openssh-7.0p1/audit-linux.c.audit	2015-08-11 10:57:29.000000000 +0200

+++ openssh-7.0p1/audit-linux.c	2015-08-12 11:33:00.411914287 +0200

@@ -35,13 +35,25 @@

 #include "log.h"

 #include "audit.h"

+#include "key.h"

+#include "hostfile.h"

+#include "auth.h"

+#include "misc.h"      /* servconf.h needs misc.h for struct ForwardOptions */

+#include "servconf.h"

 #include "canohost.h"

+#include "packet.h"

+#include "cipher.h"

+#define AUDIT_LOG_SIZE 256

+

+extern ServerOptions options;

+extern Authctxt *the_authctxt;

+extern u_int utmp_len;

 const char* audit_username(void);

-int

-linux_audit_record_event(int uid, const char *username,

-    const char *hostname, const char *ip, const char *ttyn, int success)

+static void

+linux_audit_user_logxxx(int uid, const char *username,

+    const char *hostname, const char *ip, const char *ttyn, int success, int event)

 {

 	int audit_fd, rc, saved_errno;

@@ -49,11 +61,11 @@ linux_audit_record_event(int uid, const

 	if (audit_fd < 0) {

 		if (errno == EINVAL || errno == EPROTONOSUPPORT ||

 		    errno == EAFNOSUPPORT)

-			return 1; /* No audit support in kernel */

+			return; /* No audit support in kernel */

 		else

-			return 0; /* Must prevent login */

+			goto fatal_report; /* Must prevent login */

 	}

-	rc = audit_log_acct_message(audit_fd, AUDIT_USER_LOGIN,

+	rc = audit_log_acct_message(audit_fd, event,

 	    NULL, "login", username ? username : "(unknown)",

 	    username == NULL ? uid : -1, hostname, ip, ttyn, success);

 	saved_errno = errno;

@@ -65,35 +77,154 @@ linux_audit_record_event(int uid, const

 	if ((rc == -EPERM) && (geteuid() != 0))

 		rc = 0;

 	errno = saved_errno;

-	return (rc >= 0);

+	if (rc < 0) {

+fatal_report:

+		fatal("linux_audit_write_entry failed: %s", strerror(errno));

+	}

 }

+static void

+linux_audit_user_auth(int uid, const char *username,

+    const char *hostname, const char *ip, const char *ttyn, int success, int event)

+{

+	int audit_fd, rc, saved_errno;

+	static const char *event_name[] = {

+		"maxtries exceeded",

+		"root denied",

+		"success",

+		"none",

+		"password",

+		"challenge-response",

+		"pubkey",

+		"hostbased",

+		"gssapi",

+		"invalid user",

+		"nologin",

+		"connection closed",

+		"connection abandoned",

+		"unknown"

+	};

+

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||

+		    errno == EAFNOSUPPORT)

+			return; /* No audit support in kernel */

+		else

+			goto fatal_report; /* Must prevent login */

+	}

+	

+	if ((event < 0) || (event > SSH_AUDIT_UNKNOWN))

+		event = SSH_AUDIT_UNKNOWN;

+

+	rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH,

+	    NULL, event_name[event], username ? username : "(unknown)",

+	    username == NULL ? uid : -1, hostname, ip, ttyn, success);

+	saved_errno = errno;

+	close(audit_fd);

+	/*

+	 * Do not report error if the error is EPERM and sshd is run as non

+	 * root user.

+	 */

+	if ((rc == -EPERM) && (geteuid() != 0))

+		rc = 0;

+	errno = saved_errno;

+	if (rc < 0) {

+fatal_report:

+		fatal("linux_audit_write_entry failed: %s", strerror(errno));

+	}

+}

+

+int

+audit_keyusage(int host_user, const char *type, unsigned bits, char *fp, int rv)

+{

+	char buf[AUDIT_LOG_SIZE];

+	int audit_fd, rc, saved_errno;

+

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||

+					 errno == EAFNOSUPPORT)

+			return 1; /* No audit support in kernel */

+		else                                                                                                                                       

+			return 0; /* Must prevent login */

+	}

+	snprintf(buf, sizeof(buf), "%s_auth rport=%d", host_user ? "pubkey" : "hostbased", get_remote_port());

+	rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL,

+		buf, audit_username(), -1, NULL, get_remote_ipaddr(), NULL, rv);

+	if ((rc < 0) && ((rc != -1) || (getuid() == 0)))

+		goto out;

+	/* is the fingerprint_prefix() still needed? 

+	snprintf(buf, sizeof(buf), "key algo=%s size=%d fp=%s%s rport=%d",

+			type, bits, sshkey_fingerprint_prefix(), fp, get_remote_port());

+	*/

+	snprintf(buf, sizeof(buf), "key algo=%s size=%d fp=%s rport=%d",

+			type, bits, fp, get_remote_port());

+	rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL,

+		buf, audit_username(), -1, NULL, get_remote_ipaddr(), NULL, rv);

+out:

+	saved_errno = errno;

+	audit_close(audit_fd);

+	errno = saved_errno;

+	/* do not report error if the error is EPERM and sshd is run as non root user */

+	return (rc >= 0) || ((rc == -EPERM) && (getuid() != 0));

+}

+

+static int user_login_count = 0;

+

 /* Below is the sshd audit API code */

 void

 audit_connection_from(const char *host, int port)

 {

-}

 	/* not implemented */

+}

-void

+int

 audit_run_command(const char *command)

 {

-	/* not implemented */

+	if (!user_login_count++) 

+		linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

+		    NULL, "ssh", 1, AUDIT_USER_LOGIN);

+	linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

+	    NULL, "ssh", 1, AUDIT_USER_START);

+	return 0;

+}

+

+void

+audit_end_command(int handle, const char *command)

+{

+	linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

+	    NULL, "ssh", 1, AUDIT_USER_END);

+	if (user_login_count && !--user_login_count) 

+		linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

+		    NULL, "ssh", 1, AUDIT_USER_LOGOUT);

+}

+

+void

+audit_count_session_open(void)

+{

+	user_login_count++;

 }

 void

 audit_session_open(struct logininfo *li)

 {

-	if (linux_audit_record_event(li->uid, NULL, li->hostname,

-	    NULL, li->line, 1) == 0)

-		fatal("linux_audit_write_entry failed: %s", strerror(errno));

+	if (!user_login_count++) 

+		linux_audit_user_logxxx(li->uid, NULL, li->hostname,

+		    NULL, li->line, 1, AUDIT_USER_LOGIN);

+	linux_audit_user_logxxx(li->uid, NULL, li->hostname,

+	    NULL, li->line, 1, AUDIT_USER_START);

 }

 void

 audit_session_close(struct logininfo *li)

 {

-	/* not implemented */

+	linux_audit_user_logxxx(li->uid, NULL, li->hostname,

+	    NULL, li->line, 1, AUDIT_USER_END);

+	if (user_login_count && !--user_login_count) 

+		linux_audit_user_logxxx(li->uid, NULL, li->hostname,

+		    NULL, li->line, 1, AUDIT_USER_LOGOUT);

 }

 void

@@ -101,21 +232,43 @@ audit_event(ssh_audit_event_t event)

 {

 	switch(event) {

 	case SSH_AUTH_SUCCESS:

-	case SSH_CONNECTION_CLOSE:

+		linux_audit_user_auth(-1, audit_username(), NULL,

+			get_remote_ipaddr(), "ssh", 1, event);

+		break;

+

 	case SSH_NOLOGIN:

-	case SSH_LOGIN_EXCEED_MAXTRIES:

 	case SSH_LOGIN_ROOT_DENIED:

+		linux_audit_user_auth(-1, audit_username(), NULL,

+			get_remote_ipaddr(), "ssh", 0, event);

+		linux_audit_user_logxxx(-1, audit_username(), NULL,

+			get_remote_ipaddr(), "ssh", 0, AUDIT_USER_LOGIN);

 		break;

+	case SSH_LOGIN_EXCEED_MAXTRIES:

 	case SSH_AUTH_FAIL_NONE:

 	case SSH_AUTH_FAIL_PASSWD:

 	case SSH_AUTH_FAIL_KBDINT:

 	case SSH_AUTH_FAIL_PUBKEY:

 	case SSH_AUTH_FAIL_HOSTBASED:

 	case SSH_AUTH_FAIL_GSSAPI:

+		linux_audit_user_auth(-1, audit_username(), NULL,

+			get_remote_ipaddr(), "ssh", 0, event);

+		break;

+

+	case SSH_CONNECTION_CLOSE:

+		if (user_login_count) {

+			while (user_login_count--)

+				linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

+				    NULL, "ssh", 1, AUDIT_USER_END);

+			linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

+			    NULL, "ssh", 1, AUDIT_USER_LOGOUT);

+		}

+		break;

+

+	case SSH_CONNECTION_ABANDON:

 	case SSH_INVALID_USER:

-		linux_audit_record_event(-1, audit_username(), NULL,

-			get_remote_ipaddr(), "sshd", 0);

+		linux_audit_user_logxxx(-1, audit_username(), NULL,

+			get_remote_ipaddr(), "ssh", 0, AUDIT_USER_LOGIN);

 		break;

 	default:

@@ -123,4 +276,135 @@ audit_event(ssh_audit_event_t event)

 	}

 }

+void

+audit_unsupported_body(int what)

+{

+#ifdef AUDIT_CRYPTO_SESSION

+	char buf[AUDIT_LOG_SIZE];

+	const static char *name[] = { "cipher", "mac", "comp" };

+	char *s;

+	int audit_fd;

+

+	snprintf(buf, sizeof(buf), "op=unsupported-%s direction=? cipher=? ksize=? rport=%d laddr=%s lport=%d ",

+		name[what], get_remote_port(), (s = get_local_ipaddr(packet_get_connection_in())),

+		get_local_port());

+	free(s);

+	audit_fd = audit_open();

+	if (audit_fd < 0)

+		/* no problem, the next instruction will be fatal() */

+		return;

+	audit_log_user_message(audit_fd, AUDIT_CRYPTO_SESSION,

+			buf, NULL, get_remote_ipaddr(), NULL, 0);

+	audit_close(audit_fd);

+#endif

+}

+

+const static char *direction[] = { "from-server", "from-client", "both" };

+

+void

+audit_kex_body(int ctos, char *enc, char *mac, char *compress, char *pfs, pid_t pid,

+	       uid_t uid)

+{

+#ifdef AUDIT_CRYPTO_SESSION

+	char buf[AUDIT_LOG_SIZE];

+	int audit_fd, audit_ok;

+	const struct sshcipher *cipher = cipher_by_name(enc);

+	char *s;

+

+	snprintf(buf, sizeof(buf), "op=start direction=%s cipher=%s ksize=%d mac=%s pfs=%s spid=%jd suid=%jd rport=%d laddr=%s lport=%d ",

+		direction[ctos], enc, cipher ? 8 * cipher->key_len : 0, mac, pfs,

+		(intmax_t)pid, (intmax_t)uid,

+		get_remote_port(), (s = get_local_ipaddr(packet_get_connection_in())), get_local_port());

+	free(s);

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||

+					 errno == EAFNOSUPPORT)

+			return; /* No audit support in kernel */

+		else                                                                                                                                       

+			fatal("cannot open audit"); /* Must prevent login */

+	}

+	audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_SESSION,

+			buf, NULL, get_remote_ipaddr(), NULL, 1);

+	audit_close(audit_fd);

+	/* do not abort if the error is EPERM and sshd is run as non root user */

+	if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))

+		fatal("cannot write into audit"); /* Must prevent login */

+#endif

+}

+

+void

+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)

+{

+	char buf[AUDIT_LOG_SIZE];

+	int audit_fd, audit_ok;

+	char *s;

+

+	snprintf(buf, sizeof(buf), "op=destroy kind=session fp=? direction=%s spid=%jd suid=%jd rport=%d laddr=%s lport=%d ",

+		 direction[ctos], (intmax_t)pid, (intmax_t)uid,

+		 get_remote_port(),

+		 (s = get_local_ipaddr(packet_get_connection_in())),

+		 get_local_port());

+	free(s);

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno != EINVAL && errno != EPROTONOSUPPORT &&

+					 errno != EAFNOSUPPORT)

+			error("cannot open audit");

+		return;

+	}

+	audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,

+			buf, NULL, get_remote_ipaddr(), NULL, 1);

+	audit_close(audit_fd);

+	/* do not abort if the error is EPERM and sshd is run as non root user */

+	if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))

+		error("cannot write into audit");

+}

+

+void

+audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)

+{

+	char buf[AUDIT_LOG_SIZE];

+	int audit_fd, audit_ok;

+

+	snprintf(buf, sizeof(buf), "op=destroy kind=server fp=%s direction=? spid=%jd suid=%jd ",

+		fp, (intmax_t)pid, (intmax_t)uid);

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno != EINVAL && errno != EPROTONOSUPPORT &&

+					 errno != EAFNOSUPPORT)

+			error("cannot open audit");

+		return;

+	}

+	audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,

+			buf, NULL,

+			listening_for_clients() ? NULL : get_remote_ipaddr(),

+			NULL, 1);

+	audit_close(audit_fd);

+	/* do not abort if the error is EPERM and sshd is run as non root user */

+	if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))

+		error("cannot write into audit");

+}

+

+void

+audit_generate_ephemeral_server_key(const char *fp)

+{

+	char buf[AUDIT_LOG_SIZE];

+	int audit_fd, audit_ok;

+

+	snprintf(buf, sizeof(buf), "op=create kind=server fp=%s direction=? ", fp);

+	audit_fd = audit_open();

+	if (audit_fd < 0) {

+		if (errno != EINVAL && errno != EPROTONOSUPPORT &&

+					 errno != EAFNOSUPPORT)

+			error("cannot open audit");

+		return;

+	}

+	audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,

+			buf, NULL, 0, NULL, 1);

+	audit_close(audit_fd);

+	/* do not abort if the error is EPERM and sshd is run as non root user */

+	if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))

+		error("cannot write into audit");

+}

 #endif /* USE_LINUX_AUDIT */

diff -up openssh-7.0p1/auditstub.c.audit openssh-7.0p1/auditstub.c

--- openssh-7.0p1/auditstub.c.audit	2015-08-12 11:33:00.411914287 +0200

+++ openssh-7.0p1/auditstub.c	2015-08-12 11:33:00.411914287 +0200

@@ -0,0 +1,50 @@

+/* $Id: auditstub.c,v 1.1 jfch Exp $ */

+

+/*

+ * Copyright 2010 Red Hat, Inc.  All rights reserved.

+ * Use is subject to license terms.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR

+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ *

+ * Red Hat author: Jan F. Chadima <jchadima@redhat.com>

+ */

+

+#include <sys/types.h>

+

+void

+audit_unsupported(int n)

+{

+}

+

+void

+audit_kex(int ctos, char *enc, char *mac, char *comp, char *pfs)

+{

+}

+

+void

+audit_session_key_free(int ctos)

+{

+}

+

+void

+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)

+{

+}

diff -up openssh-7.0p1/auth2.c.audit openssh-7.0p1/auth2.c

--- openssh-7.0p1/auth2.c.audit	2015-08-12 11:33:00.349914384 +0200

+++ openssh-7.0p1/auth2.c	2015-08-12 11:33:00.411914287 +0200

@@ -249,9 +249,6 @@ input_userauth_request(int type, u_int32

 		} else {

 			logit("input_userauth_request: invalid user %s", user);

 			authctxt->pw = fakepw();

-#ifdef SSH_AUDIT_EVENTS

-			PRIVSEP(audit_event(SSH_INVALID_USER));

-#endif

 		}

 #ifdef USE_PAM

 		if (options.use_pam)

diff -up openssh-7.0p1/auth2-hostbased.c.audit openssh-7.0p1/auth2-hostbased.c

--- openssh-7.0p1/auth2-hostbased.c.audit	2015-08-12 11:33:00.303914456 +0200

+++ openssh-7.0p1/auth2-hostbased.c	2015-08-12 11:33:00.412914286 +0200

@@ -146,7 +146,7 @@ userauth_hostbased(Authctxt *authctxt)

 	/* test for allowed key and correct signature */

 	authenticated = 0;

 	if (PRIVSEP(hostbased_key_allowed(authctxt->pw, cuser, chost, key)) &&

-	    PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b),

+	    PRIVSEP(hostbased_key_verify(key, sig, slen, buffer_ptr(&b),

 			buffer_len(&b))) == 1)

 		authenticated = 1;

@@ -163,6 +163,18 @@ done:

 	return authenticated;

 }

+int

+hostbased_key_verify(const Key *key, const u_char *sig, u_int slen, const u_char *data, u_int datalen)

+{

+	int rv;

+

+	rv = key_verify(key, sig, slen, data, datalen);

+#ifdef SSH_AUDIT_EVENTS

+	audit_key(0, &rv, key);

+#endif

+	return rv;

+}

+

 /* return 1 if given hostkey is allowed */

 int

 hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,

diff -up openssh-7.0p1/auth2-pubkey.c.audit openssh-7.0p1/auth2-pubkey.c

--- openssh-7.0p1/auth2-pubkey.c.audit	2015-08-12 11:33:00.318914432 +0200

+++ openssh-7.0p1/auth2-pubkey.c	2015-08-12 11:33:00.412914286 +0200

@@ -175,7 +175,7 @@ userauth_pubkey(Authctxt *authctxt)

 		/* test for correct signature */

 		authenticated = 0;

 		if (PRIVSEP(user_key_allowed(authctxt->pw, key, 1)) &&

-		    PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b),

+		    PRIVSEP(user_key_verify(key, sig, slen, buffer_ptr(&b),

 		    buffer_len(&b))) == 1) {

 			authenticated = 1;

 			/* Record the successful key to prevent reuse */

@@ -253,6 +253,18 @@ pubkey_auth_info(Authctxt *authctxt, con

 	free(extra);

 }

+int

+user_key_verify(const Key *key, const u_char *sig, u_int slen, const u_char *data, u_int datalen)

+{

+	int rv;

+

+	rv = key_verify(key, sig, slen, data, datalen);

+#ifdef SSH_AUDIT_EVENTS

+	audit_key(1, &rv, key);

+#endif

+	return rv;

+}

+

 /*

  * Splits 's' into an argument vector. Handles quoted string and basic

  * escape characters (\\, \", \'). Caller must free the argument vector

diff -up openssh-7.0p1/auth.c.audit openssh-7.0p1/auth.c

--- openssh-7.0p1/auth.c.audit	2015-08-11 10:57:29.000000000 +0200

+++ openssh-7.0p1/auth.c	2015-08-12 11:33:00.412914286 +0200

@@ -645,9 +645,6 @@ getpwnamallow(const char *user)

 		record_failed_login(user,

 		    get_canonical_hostname(options.use_dns), "ssh");

 #endif

-#ifdef SSH_AUDIT_EVENTS

-		audit_event(SSH_INVALID_USER);

-#endif /* SSH_AUDIT_EVENTS */

 		return (NULL);

 	}

 	if (!allowed_user(pw))

diff -up openssh-7.0p1/auth.h.audit openssh-7.0p1/auth.h

--- openssh-7.0p1/auth.h.audit	2015-08-12 11:33:00.302914457 +0200

+++ openssh-7.0p1/auth.h	2015-08-12 11:33:00.412914286 +0200

@@ -195,6 +195,7 @@ void	abandon_challenge_response(Authctxt

 char	*expand_authorized_keys(const char *, struct passwd *pw);

 char	*authorized_principals_file(struct passwd *);

+int	 user_key_verify(const Key *, const u_char *, u_int, const u_char *, u_int);

 FILE	*auth_openkeyfile(const char *, struct passwd *, int);

 FILE	*auth_openprincipals(const char *, struct passwd *, int);

@@ -213,6 +214,7 @@ int	 get_hostkey_index(Key *, int, struc

 int	 ssh1_session_key(BIGNUM *);

 int	 sshd_hostkey_sign(Key *, Key *, u_char **, size_t *,

 	     const u_char *, size_t, u_int);

+int	 hostbased_key_verify(const Key *, const u_char *, u_int, const u_char *, u_int);

 /* debug messages during authentication */

 void	 auth_debug_add(const char *fmt,...) __attribute__((format(printf, 1, 2)));

diff -up openssh-7.0p1/auth-rsa.c.audit openssh-7.0p1/auth-rsa.c

--- openssh-7.0p1/auth-rsa.c.audit	2015-08-11 10:57:29.000000000 +0200

+++ openssh-7.0p1/auth-rsa.c	2015-08-12 11:33:00.412914286 +0200

@@ -95,7 +95,10 @@ auth_rsa_verify_response(Key *key, BIGNU