Re: BSM, SSH, and Session ID

Solaris BSM makes more sense.  I didn't realize it was the praudit xml 
output.

Are you logging in as root through ssh or is that just the way it is 
logging it?

I can't recall how Sun SSH on Solaris 9 behaves but recent versions of 
Sun SSH/OpenSSH should fork off before the login because the sshd 
process that a user is connected to after authentication runs with their 
privileges, not root's.  It should always be a different session, even 
if the user login is root.

Are you just auditing the root user?

>> Crist J. Clark wrote:
>>> I am trying to write a script that does the following:
>>>
>>> 	1) Finds all root logins and su's to root.
>>> 	2) Tracks all commands run after that login.
>>> 	3) Associates each command with its login.
>>>
>>> Sounds easy, huh? Devil's in the details.
>>>
>>> Current method of attack is to find all of the su's and logins,
>>> and save the session ID. Then I can go through and pick out the
>>> 'exec' events with that session ID and run as root. My old
>>> method was to follow all of the forks from a login. It was not
>>> pretty, but seemed to work most of the time. I thought following
>>> session IDs would be more robust and less error prone.
>>>
>>> But I have a audit trail here that is confounding my best
>>> efforts. What we have is a "forced" SSH command. There are a
>>> few problems with the trail. First, it looks like it starts
>>> forking children before the login. Second, the login has a
>>> different session ID than its children. I'm a bit confused
>>> about what is going on here. Here's the audit trail. It's in
>>> XML format. I find that easier to read with the labels.
>>>
>>> What's killing me is that the login (the 'login - ssh' event)
>>> has a different session ID that its children (the 'exec(2)'
>>> of 'ksh -c /etc/security/sox_baseline'). Bug? Feature? Do I
>>> need to revert to my old method? This is Solaris 9 using
>>> the Sun SSH daemon.
>>>
>>>
>>> <?xml version='1.0' encoding='UTF-8' ?>
>>> <?xml-stylesheet type='text/xsl' 
>>> href='file:///usr/share/lib/xml/style/adt_record.xsl.1' ?>
>>>
>>> <!DOCTYPE audit PUBLIC '-//Sun Microsystems, Inc.//DTD Audit V1//EN' 
>>> 'file:///usr/share/lib/xml/dtd/adt_record.dtd.1'>
>>>
>>> <audit>
>>> <file time="Thu Jan 11 10:46:19 PST 2007" msec="0"></file>
>>> <record version="2" event="vfork(2)" time="Thu Jan 11 10:46:19 PST 2007" 
>>> msec="731">
>>> <argument arg-num="0" value="0x5e02" desc="child PID"/>
>>> <subject audit-uid="root" uid="root" gid="root" ruid="root" rgid="root" 
>>> pid="24065" sid="3539585011" tid="11953 196630 spa.example.com"/>
>>> <return errval="success" retval="0"/>
>>> </record>
>>> <record version="2" event="execve(2)" time="Thu Jan 11 10:46:19 PST 2007" 
>>> msec="732">
>>> <path>/usr/bin/sh</path>
>>> <attribute mode="100555" uid="root" gid="root" fsid="136" nodeid="8469" 
>>> device="0"/>
>>> <exec_args><arg>sh</arg><arg>-c</arg><arg>/usr/bin/locale -a
>>> </arg></exec_args>
>>> <subject audit-uid="root" uid="root" gid="root" ruid="root" rgid="root" 
>>> pid="24066" sid="3539585011" tid="11953 196630 spa.example.com"/>
>>> <return errval="success" retval="0"/>
>>> </record>
>>> <record version="2" event="fork(2)" time="Thu Jan 11 10:46:19 PST 2007" 
>>> msec="741">
>>> <argument arg-num="0" value="0x5e03" desc="child PID"/>
>>> <subject audit-uid="root" uid="root" gid="root" ruid="root" rgid="root" 
>>> pid="24066" sid="3539585011" tid="11953 196630 spa.example.com"/>
>>> <return errval="success" retval="0"/>
>>> </record>
>>> <record version="2" event="execve(2)" time="Thu Jan 11 10:46:19 PST 2007" 
>>> msec="764">
>>> <path>/usr/bin/locale</path>
>>> <attribute mode="100555" uid="root" gid="bin" fsid="136" nodeid="347411" 
>>> device="0"/>
>>> <exec_args><arg>/usr/bin/locale</arg><arg>-a
>>> </arg></exec_args>
>>> <subject audit-uid="root" uid="root" gid="root" ruid="root" rgid="root" 
>>> pid="24067" sid="3539585011" tid="11953 196630 spa.example.com"/>
>>> <return errval="success" retval="0"/>
>>> </record>
>>> <record version="2" event="exit(2)" time="Thu Jan 11 10:46:19 PST 2007" 
>>> msec="800">
>>> <subject audit-uid="root" uid="root" gid="root" ruid="root" rgid="root" 
>>> pid="24067" sid="3539585011" tid="11953 196630 spa.example.com"/>
>>> <return errval="success" retval="0"/>
>>> </record>
>>> <record version="2" event="exit(2)" time="Thu Jan 11 10:46:19 PST 2007" 
>>> msec="801">
>>> <subject audit-uid="root" uid="root" gid="root" ruid="root" rgid="root" 
>>> pid="24066" sid="3539585011" tid="11953 196630 spa.example.com"/>
>>> <return errval="success" retval="0"/>
>>> </record>
>>> <record version="2" event="fork(2)" time="Thu Jan 11 10:46:21 PST 2007" 
>>> msec="548">
>>> <argument arg-num="0" value="0x5e04" desc="child PID"/>
>>> <subject audit-uid="root" uid="root" gid="root" ruid="root" rgid="root" 
>>> pid="24065" sid="3539585011" tid="11953 196630 spa.example.com"/>
>>> <return errval="success" retval="0"/>
>>> </record>
>>> <record version="2" event="auditon(2) - get audit state" time="Thu Jan 11 
>>> 10:46:21 PST 2007" msec="557">
>>> <subject audit-uid="root" uid="root" gid="root" ruid="root" rgid="root" 
>>> pid="24065" sid="3539585011" tid="11953 196630 spa.example.com"/>
>>> <return errval="success" retval="0"/>
>>> </record>
>>> <record version="2" event="getaudit_addr(2)" time="Thu Jan 11 10:46:21 PST 
>>> 2007" msec="557">
>>> <subject audit-uid="root" uid="root" gid="root" ruid="root" rgid="root" 
>>> pid="24065" sid="3539585011" tid="11953 196630 spa.example.com"/>
>>> <return errval="success" retval="0"/>
>>> </record>
>>> <record version="2" event="auditon(2) - get audit policy flags" time="Thu 
>>> Jan 11 10:46:21 PST 2007" msec="557">
>>> <subject audit-uid="root" uid="root" gid="root" ruid="root" rgid="root" 
>>> pid="24065" sid="3539585011" tid="11953 196630 spa.example.com"/>
>>> <return errval="success" retval="0"/>
>>> </record>
>>> <record version="2" event="login - ssh" time="Thu Jan 11 10:46:21 PST 
>>> 2007" msec="568">
>>> <subject audit-uid="root" uid="root" gid="other" ruid="root" rgid="other" 
>>> pid="24065" sid="3603920788" tid="11953 196630 spa.example.com"/>
>>> <return errval="success" retval="0"/>
>>> </record>
>>> <record version="2" event="fork(2)" time="Thu Jan 11 10:46:21 PST 2007" 
>>> msec="583">
>>> <argument arg-num="0" value="0x5e05" desc="child PID"/>
>>> <subject audit-uid="root" uid="root" gid="other" ruid="root" rgid="other" 
>>> pid="24068" sid="3539585011" tid="11953 196630 spa.example.com"/>
>>> <return errval="success" retval="0"/>
>>> </record>
>>> <record version="2" event="execve(2)" time="Thu Jan 11 10:46:21 PST 2007" 
>>> msec="598">
>>> <path>/usr/bin/ksh</path>
>>> <attribute mode="100555" uid="root" gid="bin" fsid="136" nodeid="42497" 
>>> device="0"/>
>>> <exec_args><arg>ksh</arg><arg>-c</arg><arg>/etc/security/sox_baseline
>>> </arg></exec_args>
>>> <subject audit-uid="root" uid="root" gid="other" ruid="root" rgid="other" 
>>> pid="24069" sid="3539585011" tid="11953 196630 spa.example.com"/>
>>> <return errval="success" retval="0"/>
>>> </record>
>>> <record version="2" event="execve(2)" time="Thu Jan 11 10:46:21 PST 2007" 
>>> msec="614">
>>> <path>/etc/security/sox_baseline</path>
>>> <attribute mode="100755" uid="root" gid="other" fsid="136" nodeid="64371" 
>>> device="0"/>
>>> <exec_args><arg>/bin/sh</arg><arg>/etc/security/sox_baseline
>>> </arg></exec_args>
>>> <subject audit-uid="root" uid="root" gid="other" ruid="root" rgid="other" 
>>> pid="24069" sid="3539585011" tid="11953 196630 spa.example.com"/>
>>> <return errval="success" retval="0"/>
>>> </record>
>