Re: Accounting changes

In message <4627DD51.9020003@xxxxxxx>, Diomidis Spinellis writes:
Poul-Henning Kamp wrote:
In message <20070419212253.L2913@xxxxxxxxxxxxxxxxx>, Robert Watson writes:

__dev_t ac_tty; /* controlling tty */

This field is useless, nobody uses hardwired RS-232 terminals
anymore.

What we should do is add a systemcall or sysctl, so session creators
like getty, sshd and similar can install a session indentifying string
on the session, and then dump that in the accounting.

sshd would log IP+port and possibly also credential used for auth.


Isn't this purpose mostly served by joining the accounting record with
wtmp on the ll_line field to obtain the IP address from the ll_host field?

The IP number alone is not a "session identifier", you want the ID
of the credential that gave access as well.


--
Poul-Henning Kamp | UNIX since Zilog Zeus 3.20
phk@xxxxxxxxxxx | TCP/IP since RFC 956
FreeBSD committer | BSD since 4.3-tahoe
Never attribute to malice what can adequately be explained by incompetence.
_______________________________________________
freebsd-arch@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-arch
To unsubscribe, send any mail to "freebsd-arch-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Accounting changes
    ... What we should do is add a systemcall or sysctl, so session creators ... sshd would log IP+port and possibly also credential used for auth. ...
    (freebsd-arch)
  • [Fwd: Re: FreeBSD Security Advisory FreeBSD-SA-03:12.openssh]
    ... >99% of even the most heavily loaded servers have more than enough ... by generating a different key for each session you get better ... >run sshd out of inetd. ...
    (FreeBSD-Security)
  • Re: Accounting changes
    ... What we should do is add a systemcall or sysctl, so session creators ... sshd and similar can install a session indentifying string ... sshd would log IP+port and possibly also credential used for auth. ... Isn't this purpose mostly served by joining the accounting record with wtmp on the ll_line field to obtain the IP address from the ll_host field? ...
    (freebsd-arch)
  • Re: login, telnetd not updating utmp etc on -CURRENT
    ... >>So it looks like that's how those updates are done. ... I think sshd has the ability to write directly to utmp/wtmp, ... Prev by Date: ...
    (freebsd-current)
  • Re: Accounting changes
    ... What we should do is add a systemcall or sysctl, so session creators ... sshd would log IP+port and possibly also credential used for auth. ... Isn't this purpose mostly served by joining the accounting record with wtmp on the ll_line field to obtain the IP address from the ll_host field? ...
    (freebsd-arch)