logo_kerberos.gif

Difference between revisions of "Projects/Audit"

From K5Wiki
Jump to: navigation, search
(Detailed Design-3)
Line 60: Line 60:
 
TODO: Consider a new authorization data element AD_TKT_ID per http://tools.ietf.org/html/draft-ietf-krb-wg-cammac-04 draft to securely communicate ticket id between all Kerberos exchange participants.
  
TODO: Consider a new authorization data element AD_TKT_ID per http://tools.ietf.org/html/draft-ietf-krb-wg-cammac-04 draft to securely communicate ticket id between all Kerberos exchange participants.
   
⚫
=== Design 3 (variadic functions) ===
  
   
−
Use C variadic function to construct/parse key-value pairs.
  
  ⚫
=== Design 1 (one-API-per-event) ===
−
 
  +
  +
This design exercises the idea of one-API-per-KDC-event. The benefit of this approach is it's very low cost to KDC. However, any modification in the list of the auditable events will cause the API to be changed.
  +
  +
  +
NOTE: 'event_id' is an assigned ID of the auditable event and 'status' indicates whether the event succeeded (status = 1) or failed (status = 0).
  +
  +
==== KDC facing API ====
  +
  +
/* Audit plugin loaded/unloaded */
  +
krb5_error_code
  +
load_audit_plugin(krb5_context context);
  +
krb5_error_code
  +
unload_audit_plugin(krb5_context context);
  ⚫
/* KDC started /stopped */
  +
krb5_error_code
  +
kau_kdc_start(krb5_context context, int status);
  +
krb5_error_code
  +
kau_kdc_stop(krb5_context context, krb5_error_code status);
  +
krb5_error_code
  +
kau_as_req(krb5_context context, struct as_req_state *state, int status);
  +
krb5_error_code
  +
kau_tgs(krb5_context context, struct tgs_req_audit_state *state, int status);
  +
  ⚫
struct as_req_state {
  ⚫
loop_respond_fn respond;
  ⚫
void *arg;
  ⚫
...
  ⚫
char *tkt_id;
  ⚫
};
  ⚫
struct tgs_req_audit_state {
  ⚫
krb5_kdc_req *request;
  ⚫
krb5_timestamp authtime;
  ⚫
char *sname, *cname, *s4u_name, *u2ucname;
  ⚫
krb5_principal altprinc;
  ⚫
char *xrealm;
  ⚫
const krb5_fulladdr *from;
  ⚫
unsigned int c_flags;
  ⚫
const char *status; /* KDC status message */
  ⚫
krb5_enctype useenctype;
  ⚫
krb5_boolean tkt_renewed;
  ⚫
krb5_boolean is_referral;
  +
char *tkt_id;
  +
};
  +
  +
==== Pluggable interface ====
  +
  +
/* Audit plugin vtable */
  +
typedef struct krb5_audit_vtable_st {
  +
/* Mandatory: name of module. */
  +
char *name;
  +
kau_open_fn open;
  +
kau_close_fn close;
  +
kau_kdc_start_fn kdc_start;
  +
kau_kdc_stop_fn kdc_stop;
  +
kau_as_req_fn as_req;
  +
kau_tgs_fn tgs;
  +
} *krb5_audit_vtable;
  +
  +
typedef krb5_error_code
  +
(*kau_open_fn)(kau_ctx *au_ctx);
  +
typedef krb5_error_code
  +
(*kau_close_fn)(kau_ctx au_ctx);
  +
typedef krb5_error_code
  +
(*kau_kdc_start_fn)(kau_ctx au_ctx, krb5_deltat clockskew, const char *realm_port,
  +
krb5_boolean allow_weak_crypto, const char *plugins, const char *plugin_dir, int status);
  +
typedef krb5_error_code
  +
(*kau_kdc_stop_fn)(kau_ctx au_ctx, krb5_error_code status);
  +
typedef krb5_error_code
  +
(*kau_as_req_fn)(kau_ctx au_ctx, const char *tkt_id, const char *cname, const char *sname, const int from_port,
  +
krb5_enctype sesskey_etype, krb5_flags tkt_flags, const char *tkt_cname,
  +
krb5_deltat tkt_start_time, krb5_deltat tkt_end_time, krb5_deltat tkt_renew_till,
  +
const char *kdc_status, int status);
  +
typedef krb5_error_code
  +
(*kau_tgs_fn)(kau_ctx au_ctx, const char *tkt_id, krb5_timestamp authtime, const char *cname, const char *sname,
  +
const int from_port, krb5_enctype session_key_etype, const int is_referral, const int tkt_renewed,
  +
krb5_flags tkt_flags, krb5_deltat tkt_start_time, krb5_deltat tkt_end_time, krb5_deltat tkt_renew_till,
  +
const char *kdc_status, int status);
  +
   
 
 
Line 70: Line 146:
 
Design-2 is based on JSON serialization of the KDC auditable events. (See http://cee.mitre.org/language/1.0-beta1/cls.html#cls-encodings )
  
Design-2 is based on JSON serialization of the KDC auditable events. (See http://cee.mitre.org/language/1.0-beta1/cls.html#cls-encodings )
   
−
This approach is extremely flexible as auditable events and attributes can be added and modified without changing API. The drawback here is that some performance overhead due to the encoding operations will occur (of course, only if audit plugin is loaded/enabled).
 +
This approach is simple and extremely flexible as auditable events and attributes can be added and modified without changing API. The drawback here is that some performance overhead due to the encoding operations will occur (of course, only if audit plugin is loaded/enabled).
   
 
Note: The encoding operations can be performed using the MIT Kerberos libkrb5support.so library. For the decoding and further processing of the audit output one can use the variety of tools (Sky is the limit!) including native MIT Kerberos json decoders. See subsection "Output" for the details.
  
Note: The encoding operations can be performed using the MIT Kerberos libkrb5support.so library. For the decoding and further processing of the audit output one can use the variety of tools (Sky is the limit!) including native MIT Kerberos json decoders. See subsection "Output" for the details.
Line 82: Line 158:
 
unload_audit_plugin(krb5_context context);
  
unload_audit_plugin(krb5_context context);
 
 
−
/* Record KDC event.
 +
/* Record KDC event. */
−
* Here 'event_id' is an assigned ID of the auditable event and
  
−
* 'status' indicates whether the event succeeded or failed.
 
−
*/
  
 
krb5_error_code
 
krb5_error_code
 
kau_kdc_event(krb5_context context, const int event_id, const int status, const char *audit_str);
  
kau_kdc_event(krb5_context context, const int event_id, const int status, const char *audit_str);
Line 105: Line 181:
 
krb5_error_code
  
krb5_error_code
 
kau_jenc_tgsreq(krb5_context context, int event_id, int status,
  
kau_jenc_tgsreq(krb5_context context, int event_id, int status,
−
struct tgs_reg_state *state, char **out);
 +
struct tgs_req_state *state, char **out);
   
 
==== Pluggable interface ====
  
==== Pluggable interface ====
Line 148: Line 224:
 
==== Output ====
  
==== Output ====
   
−
To process the audit output, the plugin implementor can use the wide variety of tools to process the linearized json-like key-value pairs.
+
The plugin implementor can use wide variety of tools to process JSON event record.
   
−
The following is an example of the audit output:
 +
The following is an example of the KDC audit record:
−
 
   
 
{
  
{
Line 187: Line 263:
   
 
The possible basic field names are:
  
The possible basic field names are:
−  
  +
* "event_id" for audit event ID
  ⚫
* "event_status" to indicate if the event is reported on success or failure.
 
* "tkt_id" for ticket ID;
  
* "tkt_id" for ticket ID;
−
* "client" and "server" for client and server principal names;
 +
* "client" and "server" for client and service principal names;
 
* "full_address" for address and portport
 
* "full_address" for address and portport
 
* "pa_error" for pre-authentication error;
  
* "pa_error" for pre-authentication error;
Line 199: Line 276:
 
* "plugins" and "plugins_base_dir" for available plugins (reported on KDC startup);
  
* "plugins" and "plugins_base_dir" for available plugins (reported on KDC startup);
 
* etc.
  
* etc.
−  
⚫
Also, "event_id" and "event_status" for audit event ID and to indicate if the event is reported on success or failure. (Most likely these two already have some standard names)
  
 
 
   
−
=== Design 1 (one-API-per-event) ===
 +
=== Design 3 (variadic) ===
−  
−
This design exercises the idea of one-API-per-KDC-event. The benefit of this approach is it's very low cost to KDC. However, any modification in the list of the auditable events will cause the API to be changed.
  
   
  +
Use C variadic function to pass key-value pairs, if desired. Alternatively, pass the event specific C structure (such as as_req_state, perhaps trimmed of the security sensitive information) to a plugable interface.
   
 
==== KDC facing API ====
  
==== KDC facing API ====
Line 213: Line 289:
 
krb5_error_code
 
krb5_error_code
 
unload_audit_plugin(krb5_context context);
  
unload_audit_plugin(krb5_context context);
−
/* status=1 means that the reported event was successful ; otherwise - 0 */
  
  +
/* event specific functions */
⚫
/* KDC started /stopped */
  
 
krb5_error_code
 
krb5_error_code
 
kau_kdc_start(krb5_context context, int status);
  
kau_kdc_start(krb5_context context, int status);
Line 224: Line 299:
 
kau_tgs(krb5_context context, struct tgs_req_audit_state *state, int status);
  
kau_tgs(krb5_context context, struct tgs_req_audit_state *state, int status);
   
⚫
struct as_req_state {
  
  +
⚫
loop_respond_fn respond;
  
⚫
void *arg;
  
⚫
...
  
⚫
char *tkt_id;
  
⚫
};
  
⚫
struct tgs_req_audit_state {
  
⚫
krb5_kdc_req *request;
  
⚫
krb5_timestamp authtime;
  
⚫
char *sname, *cname, *s4u_name, *u2ucname;
  
⚫
krb5_principal altprinc;
  
⚫
char *xrealm;
  
⚫
const krb5_fulladdr *from;
  
⚫
unsigned int c_flags;
  
⚫
const char *status; /* KDC status message */
  
⚫
krb5_enctype useenctype;
  
⚫
krb5_boolean tkt_renewed;
  
⚫
krb5_boolean is_referral;
  
−
char *tkt_id;
  
−
};
  
−  
 
==== Pluggable interface ====
  
==== Pluggable interface ====
   
Line 250: Line 305:
 
typedef struct krb5_audit_vtable_st {
  
typedef struct krb5_audit_vtable_st {
 
/* Mandatory: name of module. */
  
/* Mandatory: name of module. */
−
char *name;
 +
char *name;
−
kau_open_fn open;
 +
kau_open_fn open;
−
kau_close_fn close;
 +
kau_close_fn close;
  +
kau_record_fn record;
 
kau_kdc_start_fn kdc_start;
  
kau_kdc_start_fn kdc_start;
 
kau_kdc_stop_fn kdc_stop;
  
kau_kdc_stop_fn kdc_stop;
Line 261: Line 316:
 
typedef krb5_error_code
  
typedef krb5_error_code
 
(*kau_open_fn)(kau_ctx *au_ctx);
  
(*kau_open_fn)(kau_ctx *au_ctx);
  +
 
typedef krb5_error_code
  
typedef krb5_error_code
 
(*kau_close_fn)(kau_ctx au_ctx);
  
(*kau_close_fn)(kau_ctx au_ctx);
  +
  +
/* general purpose interface to pass unspecified number of
  +
* key-type-value triplets to a plugable interface.
  +
*/
 
typedef krb5_error_code
  
typedef krb5_error_code
−
(*kau_kdc_start_fn)(kau_ctx au_ctx, krb5_deltat clockskew, const char *realm_port,
 +
(*kau_record_fn)(kau_ctx au_ctx, const int event_id, const int status, ... );
−
krb5_boolean allow_weak_crypto, const char *plugins, const char *plugin_dir, int status);
 +
  +
/* one-API-per-event surrogate */
 
typedef krb5_error_code
  
typedef krb5_error_code
−
(*kau_kdc_stop_fn)(kau_ctx au_ctx, krb5_error_code status);
 +
(*kau_kdc_start_fn)(kau_ctx au_ctx, const int event_id, const int status,
  +
struct server_handle shdl);
 
typedef krb5_error_code
  
typedef krb5_error_code
−
(*kau_as_req_fn)(kau_ctx au_ctx, const char *tkt_id, const char *cname, const char *sname, const int from_port,
 +
(*kau_kdc_stop_fn)(kau_ctx au_ctx, const int event_id, const int status);
−
krb5_enctype sesskey_etype, krb5_flags tkt_flags, const char *tkt_cname,
 
−
krb5_deltat tkt_start_time, krb5_deltat tkt_end_time, krb5_deltat tkt_renew_till,
  
−
const char *kdc_status, int status);
  
 
typedef krb5_error_code
  
typedef krb5_error_code
−
(*kau_tgs_fn)(kau_ctx au_ctx, const char *tkt_id, krb5_timestamp authtime, const char *cname, const char *sname,
 +
(*kau_as_req_fn)(kau_ctx au_ctx, const int event_id, const int status,
−
const int from_port, krb5_enctype session_key_etype, const int is_referral, const int tkt_renewed,
 +
struct as_req_state *state);
−
krb5_flags tkt_flags, krb5_deltat tkt_start_time, krb5_deltat tkt_end_time, krb5_deltat tkt_renew_till,
 +
typedef krb5_error_code
−
const char *kdc_status, int status);
 +
(*kau_tgs_fn)(kau_ctx au_ctx, const int event_id, const int status,
  +
struct tgs_req_state *state);
  +
   
 
== Configuration ==
  
== Configuration ==

Revision as of 10:51, 15 March 2013

This is an early stage project for MIT Kerberos. It is being fleshed out by its proponents. Feel free to help flesh out the details of this project. After the project is ready, it will be presented for review and approval.


Purpose

Create an Audit infrastructure within MIT Kerberos to monitor security related events on the KDC. In future expand Kerberos Audit facility to the application servers, kadmin if it remains desirable.


Requirements

The new audit system should be:

  • build-time enabled;
  • run-time pluggable;
  • simple, so it could be easily replaced with the OS specific implementations;


Events

This section details the categories of the auditable events and the associated information.

Audit module loaded/unloaded
Startup and shutdown of the audit system must be recorded by audit system;
KDC started/stopped
KDC start-up - list of KDC realms and corresponding ports on which the Kerberos server should listen for UDP and TCP requests; location and names of the plugins;
KDC stopped - no additional information;
Authentication (Common Criteria Class FIA)
AS exchange:
ticket ID (if available);
KDC status message;
kdc request: client and server principals, kdc options, start/end/renew_till times, available enctypes, 2nd ticket (see below ticket details), auth data type, pre-auth data type, addresses, message type,
kdc reply: client principal, ticket (see below ticket details), message type;
remote port;
pre-auth error;
chosen by KDC enctype (Common Criteria FCS_CKM.1, FCS_CKM.4);
session key cleared (Common Criteria FCS_CKM.1, FCS_CKM.4);
TGS exchange:
ticket ID (if available);
KDC status message;
kdc request: client and server principals, kdc options, start/end/renew_till times, available enctypes, 2nd ticket (see below ticket details), auth data type, pre-auth data type, addresses, message type,
kdc reply: client principal, ticket (see below ticket details), message type;
principals: (if applicable) alternate client and server principals, 2nd ticket server name;
full address;
is_referral;
xrealm name;
chosen by KDC enctype, u2u enctype (Common Criteria FCS_CKM.1, FCS_CKM.4);
session key cleared (Common Criteria FCS_CKM.1, FCS_CKM.4);
Policy: Policies violation when processing requests - TBD;
AS request; TGS request; S4U2PROXY request. Can be separate reports or part of AS/TGS request processing
Ticket details:
client and server principals, flags, ticket start/end/renew_till times, authtime, transited encoding type and contents, session key type, addresses;


Design details

Ticket ID

Ticket ID is recorded as part of audit messages. This allows to link tickets to their initial TGT at any stage of the Kerberos exchange.

TODO: Consider a new authorization data element AD_TKT_ID per http://tools.ietf.org/html/draft-ietf-krb-wg-cammac-04 draft to securely communicate ticket id between all Kerberos exchange participants.


Design 1 (one-API-per-event)

This design exercises the idea of one-API-per-KDC-event. The benefit of this approach is it's very low cost to KDC. However, any modification in the list of the auditable events will cause the API to be changed.


NOTE: 'event_id' is an assigned ID of the auditable event and 'status' indicates whether the event succeeded (status = 1) or failed (status = 0).

KDC facing API

/* Audit plugin loaded/unloaded */
krb5_error_code 
load_audit_plugin(krb5_context context);
krb5_error_code 
unload_audit_plugin(krb5_context context);
/* KDC started /stopped */
krb5_error_code 
kau_kdc_start(krb5_context context, int status);
krb5_error_code 
kau_kdc_stop(krb5_context context, krb5_error_code status);
krb5_error_code 
kau_as_req(krb5_context context, struct as_req_state *state, int status);
krb5_error_code 
kau_tgs(krb5_context context, struct tgs_req_audit_state *state, int status);

struct as_req_state {
   loop_respond_fn respond;
   void *arg;
   ...
   char *tkt_id;
};
struct tgs_req_audit_state {
   krb5_kdc_req *request;
   krb5_timestamp authtime;
   char *sname, *cname, *s4u_name, *u2ucname;
   krb5_principal altprinc;
   char *xrealm;
   const krb5_fulladdr *from;
   unsigned int c_flags;
   const char *status; /* KDC status message */
   krb5_enctype useenctype;
   krb5_boolean tkt_renewed;
   krb5_boolean is_referral;
   char *tkt_id;
};

Pluggable interface

/* Audit plugin vtable */
typedef struct krb5_audit_vtable_st {
   /* Mandatory: name of module. */
   char *name;
   kau_open_fn  open;
   kau_close_fn close;
   kau_kdc_start_fn  kdc_start;
   kau_kdc_stop_fn   kdc_stop;
   kau_as_req_fn     as_req;
   kau_tgs_fn        tgs;
} *krb5_audit_vtable;

typedef krb5_error_code
(*kau_open_fn)(kau_ctx *au_ctx);
typedef krb5_error_code
(*kau_close_fn)(kau_ctx au_ctx);
typedef krb5_error_code
(*kau_kdc_start_fn)(kau_ctx au_ctx, krb5_deltat clockskew, const char *realm_port,
                    krb5_boolean allow_weak_crypto, const char *plugins, const char *plugin_dir, int status);
typedef krb5_error_code
(*kau_kdc_stop_fn)(kau_ctx au_ctx, krb5_error_code  status);
typedef krb5_error_code
(*kau_as_req_fn)(kau_ctx au_ctx, const char *tkt_id, const char *cname, const char *sname, const int from_port,
                 krb5_enctype sesskey_etype, krb5_flags tkt_flags, const char *tkt_cname, 
                 krb5_deltat tkt_start_time, krb5_deltat tkt_end_time, krb5_deltat tkt_renew_till,
                 const char *kdc_status, int status);
typedef krb5_error_code
(*kau_tgs_fn)(kau_ctx au_ctx, const char *tkt_id, krb5_timestamp authtime,  const char *cname, const char *sname,
              const int from_port,  krb5_enctype session_key_etype,  const int is_referral, const int tkt_renewed,
              krb5_flags tkt_flags, krb5_deltat tkt_start_time, krb5_deltat tkt_end_time, krb5_deltat tkt_renew_till,
              const char *kdc_status, int status);


Design 2 (JSON-based)

Design-2 is based on JSON serialization of the KDC auditable events. (See http://cee.mitre.org/language/1.0-beta1/cls.html#cls-encodings )

This approach is simple and extremely flexible as auditable events and attributes can be added and modified without changing API. The drawback here is that some performance overhead due to the encoding operations will occur (of course, only if audit plugin is loaded/enabled).

Note: The encoding operations can be performed using the MIT Kerberos libkrb5support.so library. For the decoding and further processing of the audit output one can use the variety of tools (Sky is the limit!) including native MIT Kerberos json decoders. See subsection "Output" for the details.

KDC facing API

/* Load/unload Audit plugin */
krb5_error_code 
load_audit_plugin(krb5_context context);
krb5_error_code 
unload_audit_plugin(krb5_context context);

/* Record KDC event. */
krb5_error_code 
kau_kdc_event(krb5_context context, const int event_id, const int status, const char *audit_str);

/* Helpers */

/* Check if Audit plugin is loaded */
krb5_boolean
kau_isloaded(krb5_context context);

/* Create a ticket ID */
krb5_error_code
kau_make_tkt_id(const krb5_keyblock sk, char **out);

/* Basic serialization functions. */
krb5_error_code
kau_jenc_shandle(krb5_context context, int event_id, int status,
                 struct server_handle shdl, char **out);
krb5_error_code
kau_jenc_asreq(krb5_context context, int event_id, int status,
               struct as_req_state *state, char **out);
krb5_error_code
kau_jenc_tgsreq(krb5_context context, int event_id, int status,
                struct tgs_req_state *state, char **out);

Pluggable interface

/* Audit plugin vtable */
typedef struct krb5_audit_vtable_st {
   /* Mandatory: name of module. */
   char             *name;
   kau_open_fn       open;
   kau_close_fn      close;
   kau_record_fn     record;
} *krb5_audit_vtable;

typedef krb5_error_code
(*kau_open_fn)(kau_ctx *au_ctx);

typedef krb5_error_code
(*kau_close_fn)(kau_ctx au_ctx);

typedef krb5_error_code
(*kau_record_fn)(kau_ctx au_ctx, const int event_id, const int status, const char *audit_string);

Example

The typical call on KDC side (TGS-REQ): 

#include "k5-json.h"

krb5_error_code rc = 0;
char *aud_str = NULL;
struct tgs_req_audit_state *state;
...
if (kau_isloaded(kdc_context) == TRUE) {
   /* JSON encode tgs_req_audit_state */
   rc = kau_jenc_asreq(kdc_context, TGS_REQ, 0, state, &aud_str);   
   if (!rc && aud_str != NULL) {
      rc = kau_kdc_event(kdc_context, TS_REQ, 0, aud_str)
      free(aud_str);
   }
}

Output

The plugin implementor can use wide variety of tools to process JSON event record.

The following is an example of the KDC audit record: 

{
"event_id":5,
"event_status":1,
"tkt_id":"C8A7D0C7A86E373E",
"kdc_status":"ISSUE",
"kdcreq":{
  "server":{"components":["host","xxx.mit.edu"],"realm":"KRBTEST.COM","length":2,"type":1},
  "kdc_options":65536,
  "end":1362867131,
  "avail_etypes":[18,17,16,23,25,26,1,3,2]
},
"kdcrep":{
  "msg_type":13,
  "client":{"components":["user"],"realm":"KRBTEST.COM","length":1,"type":1},
  "ticket":{
     "server":{"components":["host","xxx.mit.edu"],"realm":"KRBTEST.COM","length":2,"type":1},
     "flags":589824,
     "client":{"components":["user"],"realm":"KRBTEST.COM","length":1,"type":1},
     "start":0,"end":1362867131,"renew_till":0,
     "authtime":1362780731,
     "tr_type":1,"skey_etype":18
  }
},
"full_address":{"port":37652,"address":{"addrtype":2,"length":4,"addr":[18,18,44,333]}},
"rep_flags":176,
"skey_etype":18,
"sesskey_cleared":true
}


Dictionary of the field names

One needs to define a dictionary of the field names to be used to describe the events in some unified way.

The possible basic field names are:

  • "event_id" for audit event ID
  • "event_status" to indicate if the event is reported on success or failure.
  • "tkt_id" for ticket ID;
  • "client" and "server" for client and service principal names;
  • "full_address" for address and portport
  • "pa_error" for pre-authentication error;
  • "skey_etype" and "avail_etypes" for available key types and chosen enc type;
  • "sesskey_cleared" to indicate that session key was cleared;
  • "start", "end" and "renew_till" for the ticket's start/end/renew-until times;
  • "rep_flags" for reply flags;
  • "kdc_status" for KDC status message;
  • "plugins" and "plugins_base_dir" for available plugins (reported on KDC startup);
  • etc.


Design 3 (variadic)

Use C variadic function to pass key-value pairs, if desired. Alternatively, pass the event specific C structure (such as as_req_state, perhaps trimmed of the security sensitive information) to a plugable interface.

KDC facing API

/* Audit plugin loaded/unloaded */
krb5_error_code 
load_audit_plugin(krb5_context context);
krb5_error_code 
unload_audit_plugin(krb5_context context);
/* event specific functions */
krb5_error_code 
kau_kdc_start(krb5_context context, int status);
krb5_error_code 
kau_kdc_stop(krb5_context context, krb5_error_code status);
krb5_error_code 
kau_as_req(krb5_context context, struct as_req_state *state, int status);
krb5_error_code 
kau_tgs(krb5_context context, struct tgs_req_audit_state *state, int status);


Pluggable interface

/* Audit plugin vtable */
typedef struct krb5_audit_vtable_st {
   /* Mandatory: name of module. */
   char             *name;
   kau_open_fn       open;
   kau_close_fn      close;
   kau_record_fn     record;
   kau_kdc_start_fn  kdc_start;
   kau_kdc_stop_fn   kdc_stop;
   kau_as_req_fn     as_req;
   kau_tgs_fn        tgs;
} *krb5_audit_vtable;

typedef krb5_error_code
(*kau_open_fn)(kau_ctx *au_ctx);

typedef krb5_error_code
(*kau_close_fn)(kau_ctx au_ctx);

/* general purpose interface to pass unspecified number of 
 *  key-type-value triplets to a plugable interface.
 */
typedef krb5_error_code
(*kau_record_fn)(kau_ctx au_ctx, const int event_id, const int status, ... );

/* one-API-per-event surrogate */
typedef krb5_error_code
(*kau_kdc_start_fn)(kau_ctx au_ctx, const int event_id, const int status,
                    struct server_handle shdl);
typedef krb5_error_code
(*kau_kdc_stop_fn)(kau_ctx au_ctx, const int event_id, const int status);
typedef krb5_error_code
(*kau_as_req_fn)(kau_ctx au_ctx, const int event_id, const int status,
                 struct as_req_state *state);
typedef krb5_error_code
(*kau_tgs_fn)(kau_ctx au_ctx, const int event_id, const int status,
              struct tgs_req_state *state);


Configuration

The following ./configure option to be added:

--with-audit-plugin=simple
(For demo and testing purposes) Build the audit plugin "simple" and enable audit plugin.


Test implementation

We will use libaudit module available on Fedora, Debian, Suse for the first round.

Some "simple" audit plugin will be implemented and Python test system will become aware of its existence. New ./configure --with-audit-plugin option will be introduced to build "simple" audit plugin for testing purpose. If audit is enabled and audit plugin is available, "make check" will store audit messages into audit log file.

References

  1. Common Criteria for Information Technology Security Evaluation http://www.commoncriteriaportal.org/files/ccfiles/CCPART2V3.1R4.pdf
  2. Oracle Solaris Auditing http://docs.oracle.com/cd/E19963-01/html/821-1456/auditov-1.html
  3. Understanding Linux Audit http://doc.opensuse.org/products/draft/SLES/SLES-security_sd_draft/cha.audit.comp.html
  4. Advanced Security Audit Policy Settings http://technet.microsoft.com/en-us/library/dd772712(v=ws.10).aspx
  5. Events Classification in Log Audit http://airccse.org/journal/nsa/0410ijnsa5.pdf
  6. http://cee.mitre.org/language/1.0-beta1/cls.html
Retrieved from "https://k5wiki.kerberos.org/wiki?title=Projects/Audit&oldid=5101"