diff options
author | wsalamon <wsalamon@FreeBSD.org> | 2006-02-04 20:20:02 +0000 |
---|---|---|
committer | wsalamon <wsalamon@FreeBSD.org> | 2006-02-04 20:20:02 +0000 |
commit | 3d601f5c0b2ed98326587270c5638a8315a2c25d (patch) | |
tree | 6e04a1e8c50be266102f73f0a516960314a4c645 /usr.bin/login/login.c | |
parent | 6861e36921baf8f75582b54208ee7f1e93f010cf (diff) | |
download | FreeBSD-src-3d601f5c0b2ed98326587270c5638a8315a2c25d.zip FreeBSD-src-3d601f5c0b2ed98326587270c5638a8315a2c25d.tar.gz |
Make login audit-enabled, submitting audit records for the login and logout
events. The specifics of submitting the records is contained within
login_audit.c.
Document the auditing behavior in the man page.
Obtained from: TrustedBSD Project, Apple Computer, Inc.
Approved by: rwatson (mentor)
Diffstat (limited to 'usr.bin/login/login.c')
-rw-r--r-- | usr.bin/login/login.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/usr.bin/login/login.c b/usr.bin/login/login.c index 68693f8..f23467d 100644 --- a/usr.bin/login/login.c +++ b/usr.bin/login/login.c @@ -173,6 +173,7 @@ main(int argc, char *argv[]) login_cap_t *lc = NULL; login_cap_t *lc_user = NULL; pid_t pid; + char auditsuccess = 1; (void)signal(SIGQUIT, SIG_IGN); (void)signal(SIGINT, SIG_IGN); @@ -291,16 +292,19 @@ main(int argc, char *argv[]) pam_err = pam_start("login", username, &pamc, &pamh); if (pam_err != PAM_SUCCESS) { pam_syslog("pam_start()"); + au_login_fail("PAM Error", 1); bail(NO_SLEEP_EXIT, 1); } pam_err = pam_set_item(pamh, PAM_TTY, tty); if (pam_err != PAM_SUCCESS) { pam_syslog("pam_set_item(PAM_TTY)"); + au_login_fail("PAM Error", 1); bail(NO_SLEEP_EXIT, 1); } pam_err = pam_set_item(pamh, PAM_RHOST, hostname); if (pam_err != PAM_SUCCESS) { pam_syslog("pam_set_item(PAM_RHOST)"); + au_login_fail("PAM Error", 1); bail(NO_SLEEP_EXIT, 1); } @@ -317,6 +321,7 @@ main(int argc, char *argv[]) (uid == (uid_t)0 || uid == (uid_t)pwd->pw_uid)) { /* already authenticated */ rval = 0; + auditsuccess = 0; /* opened a terminal window only */ } else { fflag = 0; (void)setpriority(PRIO_PROCESS, 0, -4); @@ -329,6 +334,12 @@ main(int argc, char *argv[]) pam_cleanup(); + /* + * We are not exiting here, but this corresponds to a failed + * login event, so set exitstatus to 1. + */ + au_login_fail("Login incorrect", 1); + (void)printf("Login incorrect\n"); failures++; @@ -351,6 +362,10 @@ main(int argc, char *argv[]) endpwent(); + /* Audit successful login. */ + if (auditsuccess) + au_login_success(); + /* * Establish the login class. */ @@ -936,6 +951,7 @@ bail(int sec, int eval) { pam_cleanup(); + audit_logout(); (void)sleep(sec); exit(eval); } |