From 5c20fa8d2d98a81f95fca7c18cca732836a0e41a Mon Sep 17 00:00:00 2001 From: Jan F Date: Jan 12 2011 10:09:58 +0000 Subject: - add audit of destruction the session keys --- diff --git a/openssh-5.6p1-audit4.patch b/openssh-5.6p1-audit4.patch new file mode 100644 index 0000000..6614f27 --- /dev/null +++ b/openssh-5.6p1-audit4.patch @@ -0,0 +1,232 @@ +diff -up openssh-5.6p1/audit-bsm.c.audit4 openssh-5.6p1/audit-bsm.c +--- openssh-5.6p1/audit-bsm.c.audit4 2011-01-12 10:48:20.000000000 +0100 ++++ openssh-5.6p1/audit-bsm.c 2011-01-12 10:48:54.000000000 +0100 +@@ -395,4 +395,10 @@ audit_kex_body(int ctos, char *enc, char + { + /* not implemented */ + } ++ ++void ++audit_session_key_free_body(int ctos) ++{ ++ /* not implemented */ ++} + #endif /* BSM */ +diff -up openssh-5.6p1/audit.c.audit4 openssh-5.6p1/audit.c +--- openssh-5.6p1/audit.c.audit4 2011-01-12 10:45:58.000000000 +0100 ++++ openssh-5.6p1/audit.c 2011-01-12 10:51:16.000000000 +0100 +@@ -152,6 +152,12 @@ audit_kex(int ctos, char *enc, char *mac + PRIVSEP(audit_kex_body(ctos, enc, mac, comp)); + } + ++void ++audit_session_key_free(int ctos) ++{ ++ PRIVSEP(audit_session_key_free_body(ctos)); ++} ++ + # ifndef CUSTOM_SSH_AUDIT_EVENTS + /* + * Null implementations of audit functions. +@@ -254,5 +260,13 @@ audit_kex_body(int ctos, char *enc, char + debug("audit procol negotiation euid %d direction %d cipher %s mac %s compresion %s", + geteuid(), ctos, enc, mac, compress); + } ++ ++/* ++ * This will be called on succesfull session key discard ++ */ ++audit_session_key_free_body(int ctos) ++{ ++ debug("audit session key discard euid %d direction %d", geteuid(), ctos); ++} + # endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */ + #endif /* SSH_AUDIT_EVENTS */ +diff -up openssh-5.6p1/audit.h.audit4 openssh-5.6p1/audit.h +--- openssh-5.6p1/audit.h.audit4 2011-01-12 10:45:58.000000000 +0100 ++++ openssh-5.6p1/audit.h 2011-01-12 10:45:59.000000000 +0100 +@@ -60,5 +60,7 @@ void audit_unsupported(int); + void audit_kex(int, char *, char *, char *); + void audit_unsupported_body(int); + void audit_kex_body(int, char *, char *, char *); ++void audit_session_key_free(int ctos); ++void audit_session_key_free_body(int ctos); + + #endif /* _SSH_AUDIT_H */ +diff -up openssh-5.6p1/audit-linux.c.audit4 openssh-5.6p1/audit-linux.c +--- openssh-5.6p1/audit-linux.c.audit4 2011-01-12 10:45:58.000000000 +0100 ++++ openssh-5.6p1/audit-linux.c 2011-01-12 10:48:00.000000000 +0100 +@@ -174,13 +174,14 @@ audit_unsupported_body(int what) + #endif + } + ++const static char *direction[] = { "from-server", "from-client", "both" }; ++ + void + audit_kex_body(int ctos, char *enc, char *mac, char *compress) + { + #ifdef AUDIT_CRYPTO_SESSION + char buf[AUDIT_LOG_SIZE]; + int audit_fd, audit_ok; +- const static char *direction[] = { "from-server", "from-client", "both" }; + Cipher *cipher = cipher_by_name(enc); + + snprintf(buf, sizeof(buf), "start direction=%s cipher=%s, ksize=%d rport=%d laddr=%s lport=%d", +@@ -203,4 +204,22 @@ audit_kex_body(int ctos, char *enc, char + #endif + } + ++void ++audit_session_key_free_body(int ctos) ++{ ++ char buf[AUDIT_LOG_SIZE]; ++ int audit_fd, audit_ok; ++ ++ snprintf(buf, sizeof(buf), "destroy kind=session direction=%s", direction[ctos]); ++ audit_fd = audit_open(); ++ if (audit_fd < 0) ++ return; ++ audit_ok = audit_log_acct_message(audit_fd, AUDIT_CRYPTO_KEY_USER, NULL, ++ buf, NULL, -1, NULL, get_remote_ipaddr(), NULL, 1); ++ audit_close(audit_fd); ++ /* do not abort if the error is EPERM and sshd is run as non root user */ ++ if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0))) ++ error("cannot write into audit"); ++} ++ + #endif /* USE_LINUX_AUDIT */ +diff -up openssh-5.6p1/auditstub.c.audit4 openssh-5.6p1/auditstub.c +--- openssh-5.6p1/auditstub.c.audit4 2011-01-12 10:45:58.000000000 +0100 ++++ openssh-5.6p1/auditstub.c 2011-01-12 10:45:59.000000000 +0100 +@@ -37,3 +37,7 @@ audit_kex(int ctos, char *enc, char *mac + { + } + ++void ++audit_session_key_free(int ctos) ++{ ++} +diff -up openssh-5.6p1/monitor.c.audit4 openssh-5.6p1/monitor.c +--- openssh-5.6p1/monitor.c.audit4 2011-01-12 10:45:59.000000000 +0100 ++++ openssh-5.6p1/monitor.c 2011-01-12 10:45:59.000000000 +0100 +@@ -180,6 +180,7 @@ int mm_answer_audit_event(int, Buffer *) + int mm_answer_audit_command(int, Buffer *); + int mm_answer_audit_unsupported_body(int, Buffer *); + int mm_answer_audit_kex_body(int, Buffer *); ++int mm_answer_audit_session_key_free_body(int, Buffer *); + #endif + + static Authctxt *authctxt; +@@ -230,6 +231,7 @@ struct mon_table mon_dispatch_proto20[] + {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, + {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body}, + {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body}, ++ {MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body}, + #endif + #ifdef BSD_AUTH + {MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery}, +@@ -268,6 +270,7 @@ struct mon_table mon_dispatch_postauth20 + {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command}, + {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body}, + {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body}, ++ {MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body}, + #endif + {0, 0, NULL} + }; +@@ -301,6 +304,7 @@ struct mon_table mon_dispatch_proto15[] + {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, + {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body}, + {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body}, ++ {MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body}, + #endif + {0, 0, NULL} + }; +@@ -314,6 +318,7 @@ struct mon_table mon_dispatch_postauth15 + {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command}, + {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body}, + {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body}, ++ {MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body}, + #endif + {0, 0, NULL} + }; +@@ -2252,4 +2257,18 @@ mm_answer_audit_kex_body(int sock, Buffe + return 0; + } + ++int ++mm_answer_audit_session_key_free_body(int sock, Buffer *m) ++{ ++ int ctos; ++ ++ ctos = buffer_get_int(m); ++ ++ audit_session_key_free_body(ctos); ++ ++ buffer_clear(m); ++ ++ mm_request_send(sock, MONITOR_ANS_AUDIT_SESSION_KEY_FREE, m); ++ return 0; ++} + #endif /* SSH_AUDIT_EVENTS */ +diff -up openssh-5.6p1/monitor.h.audit4 openssh-5.6p1/monitor.h +--- openssh-5.6p1/monitor.h.audit4 2011-01-12 10:45:59.000000000 +0100 ++++ openssh-5.6p1/monitor.h 2011-01-12 10:45:59.000000000 +0100 +@@ -68,6 +68,7 @@ enum monitor_reqtype { + MONITOR_REQ_JPAKE_CHECK_CONFIRM, MONITOR_ANS_JPAKE_CHECK_CONFIRM, + MONITOR_REQ_AUDIT_UNSUPPORTED, MONITOR_ANS_AUDIT_UNSUPPORTED, + MONITOR_REQ_AUDIT_KEX, MONITOR_ANS_AUDIT_KEX, ++ MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MONITOR_ANS_AUDIT_SESSION_KEY_FREE, + }; + + struct mm_master; +diff -up openssh-5.6p1/monitor_wrap.c.audit4 openssh-5.6p1/monitor_wrap.c +--- openssh-5.6p1/monitor_wrap.c.audit4 2011-01-12 10:45:59.000000000 +0100 ++++ openssh-5.6p1/monitor_wrap.c 2011-01-12 10:45:59.000000000 +0100 +@@ -1445,4 +1445,17 @@ mm_audit_kex_body(int ctos, char *cipher + + buffer_free(&m); + } ++ ++void ++mm_audit_session_key_free_body(int ctos) ++{ ++ Buffer m; ++ ++ buffer_init(&m); ++ buffer_put_int(&m, ctos); ++ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SESSION_KEY_FREE, &m); ++ mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_SESSION_KEY_FREE, ++ &m); ++ buffer_free(&m); ++} + #endif /* SSH_AUDIT_EVENTS */ +diff -up openssh-5.6p1/monitor_wrap.h.audit4 openssh-5.6p1/monitor_wrap.h +--- openssh-5.6p1/monitor_wrap.h.audit4 2011-01-12 10:45:59.000000000 +0100 ++++ openssh-5.6p1/monitor_wrap.h 2011-01-12 10:45:59.000000000 +0100 +@@ -76,6 +76,7 @@ void mm_audit_event(ssh_audit_event_t); + void mm_audit_run_command(const char *); + void mm_audit_unsupported_body(int); + void mm_audit_kex_body(int, char *, char *, char *); ++void mm_audit_session_key_free_body(int); + #endif + + struct Session; +diff -up openssh-5.6p1/packet.c.audit4 openssh-5.6p1/packet.c +--- openssh-5.6p1/packet.c.audit4 2010-07-16 05:58:37.000000000 +0200 ++++ openssh-5.6p1/packet.c 2011-01-12 10:45:59.000000000 +0100 +@@ -495,6 +495,7 @@ packet_close(void) + buffer_free(&active_state->compression_buffer); + buffer_compress_uninit(); + } ++ audit_session_key_free(2); + cipher_cleanup(&active_state->send_context); + cipher_cleanup(&active_state->receive_context); + } +@@ -749,6 +750,7 @@ set_newkeys(int mode) + } + if (active_state->newkeys[mode] != NULL) { + debug("set_newkeys: rekeying"); ++ audit_session_key_free(mode); + cipher_cleanup(cc); + enc = &active_state->newkeys[mode]->enc; + mac = &active_state->newkeys[mode]->mac; diff --git a/openssh-5.6p1-wIm.patch b/openssh-5.6p1-wIm.patch new file mode 100644 index 0000000..c888bbf --- /dev/null +++ b/openssh-5.6p1-wIm.patch @@ -0,0 +1,74 @@ +diff -up openssh-5.6p1/log.h.wIm openssh-5.6p1/log.h +--- openssh-5.6p1/log.h.wIm 2008-06-13 02:22:54.000000000 +0200 ++++ openssh-5.6p1/log.h 2011-01-11 10:35:32.000000000 +0100 +@@ -63,6 +63,7 @@ void verbose(const char *, ...) __at + void debug(const char *, ...) __attribute__((format(printf, 1, 2))); + void debug2(const char *, ...) __attribute__((format(printf, 1, 2))); + void debug3(const char *, ...) __attribute__((format(printf, 1, 2))); ++void debug_wIm(const char *); + + void do_log(LogLevel, const char *, va_list); + void cleanup_exit(int) __attribute__((noreturn)); +diff -up openssh-5.6p1/Makefile.in.wIm openssh-5.6p1/Makefile.in +--- openssh-5.6p1/Makefile.in.wIm 2010-05-12 08:51:39.000000000 +0200 ++++ openssh-5.6p1/Makefile.in 2011-01-11 10:35:32.000000000 +0100 +@@ -69,7 +69,7 @@ LIBSSH_OBJS=acss.o authfd.o authfile.o b + cipher-bf1.o cipher-ctr.o cipher-3des1.o cleanup.o \ + compat.o compress.o crc32.o deattack.o fatal.o hostfile.o \ + log.o match.o md-sha256.o moduli.o nchan.o packet.o \ +- readpass.o rsa.o ttymodes.o xmalloc.o addrmatch.o \ ++ readpass.o rsa.o ttymodes.o whereIam.o xmalloc.o addrmatch.o \ + atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \ + monitor_fdpass.o rijndael.o ssh-dss.o ssh-rsa.o dh.o kexdh.o \ + kexgex.o kexdhc.o kexgexc.o msg.o progressmeter.o dns.o \ +diff -up openssh-5.6p1/sshd.c.wIm openssh-5.6p1/sshd.c +--- openssh-5.6p1/sshd.c.wIm 2010-04-16 07:56:22.000000000 +0200 ++++ openssh-5.6p1/sshd.c 2011-01-11 10:35:32.000000000 +0100 +@@ -139,6 +139,9 @@ int deny_severity; + + extern char *__progname; + ++/* trace of fork processes */ ++extern int whereIam; ++ + /* Server configuration options. */ + ServerOptions options; + +@@ -652,6 +655,7 @@ privsep_preauth(Authctxt *authctxt) + } else { + /* child */ + ++ whereIam = 1; + close(pmonitor->m_sendfd); + + /* Demote the child */ +@@ -693,6 +697,7 @@ privsep_postauth(Authctxt *authctxt) + exit(0); + } + ++ whereIam = 2; + close(pmonitor->m_sendfd); + + /* Demote the private keys to public keys. */ +@@ -1299,6 +1304,8 @@ main(int ac, char **av) + Key *key; + Authctxt *authctxt; + ++ whereIam = 0; ++ + #ifdef HAVE_SECUREWARE + (void)set_auth_parameters(ac, av); + #endif +diff -up openssh-5.6p1/whereIam.c.wIm openssh-5.6p1/whereIam.c +--- openssh-5.6p1/whereIam.c.wIm 2011-01-11 10:35:32.000000000 +0100 ++++ openssh-5.6p1/whereIam.c 2011-01-11 10:35:32.000000000 +0100 +@@ -0,0 +1,9 @@ ++ ++int whereIam = -1; ++ ++void debug_wIm(const char *txt) ++{ ++ debug("%s wIm = %d, euid=%d", txt, whereIam, geteuid()); ++} ++ ++ diff --git a/openssh.spec b/openssh.spec index e37f2f3..9a2e8e8 100644 --- a/openssh.spec +++ b/openssh.spec @@ -71,7 +71,7 @@ # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1 %define openssh_ver 5.6p1 -%define openssh_rel 21 +%define openssh_rel 22 %define pam_ssh_agent_ver 0.9.2 %define pam_ssh_agent_rel 29 @@ -93,12 +93,16 @@ Source3: sshd.init Source4: http://prdownloads.sourceforge.net/pamsshagentauth/pam_ssh_agent_auth/pam_ssh_agent_auth-%{pam_ssh_agent_ver}.tar.bz2 Source5: pam_ssh_agent-rmheaders +Patch100: openssh-5.6p1-wIm.patch Patch0: openssh-5.6p1-redhat.patch #https://bugzilla.mindrot.org/show_bug.cgi?id=1402 Patch1: openssh-5.6p1-audit.patch Patch2: openssh-5.6p1-audit1a.patch Patch3: openssh-5.6p1-audit2.patch Patch4: openssh-5.6p1-audit3.patch +Patch104: openssh-5.6p1-audit4.patch +#not yet +###Patch105: openssh-5.6p1-audit5.patch #https://bugzilla.mindrot.org/show_bug.cgi?id=1640 Patch5: openssh-5.2p1-vendor.patch Patch10: pam_ssh_agent_auth-0.9-build.patch @@ -272,11 +276,14 @@ The module is most useful for su and sudo service stacks. %prep %setup -q -a 4 +#Do not enable by default +###%patch100 -p1 -b .wIm %patch0 -p1 -b .redhat %patch1 -p1 -b .audit %patch2 -p1 -b .audit1a %patch3 -p1 -b .audit2 %patch4 -p1 -b .audit3 +%patch104 -p1 -b .audit4 %patch5 -p1 -b .vendor %if %{pam_ssh_agent} @@ -596,6 +603,9 @@ fi %endif %changelog +* Wed Jan 12 2011 Jan F. Chadima - 5.6p1-22 + 0.9.2-29 +- add audit of destruction the session keys + * Fri Dec 10 2010 Jan F. Chadima - 5.6p1-21 + 0.9.2-29 - reenable run sshd as non root user - renable rekeying