Re: Accounting changes

Poul-Henning Kamp wrote:
In message <4627DD51.9020003@xxxxxxx>, Diomidis Spinellis writes:
Poul-Henning Kamp wrote:
In message <20070419212253.L2913@xxxxxxxxxxxxxxxxx>, Robert Watson writes:

__dev_t ac_tty; /* controlling tty */
This field is useless, nobody uses hardwired RS-232 terminals
anymore.

What we should do is add a systemcall or sysctl, so session creators
like getty, sshd and similar can install a session indentifying string
on the session, and then dump that in the accounting.

sshd would log IP+port and possibly also credential used for auth.

Isn't this purpose mostly served by joining the accounting record with wtmp on the ll_line field to obtain the IP address from the ll_host field?

The IP number alone is not a "session identifier", you want the ID
of the credential that gave access as well.

Agreed. But, still, the credential identifier should be part of wtmp and not burden every accounting record. There is also the problem of processes running without a controlling terminal, like non-interactive ssh commands, crontab jobs, and so on. Let's try to solve this in a next version of the accounting record, which should be a lot easier to implement, once we get this one right.
_______________________________________________
freebsd-arch@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-arch
To unsubscribe, send any mail to "freebsd-arch-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Accounting changes
    ... What we should do is add a systemcall or sysctl, so session creators ... sshd would log IP+port and possibly also credential used for auth. ... Isn't this purpose mostly served by joining the accounting record with ...
    (freebsd-arch)
  • Re: Accounting changes
    ... What we should do is add a systemcall or sysctl, so session creators ... sshd and similar can install a session indentifying string ... sshd would log IP+port and possibly also credential used for auth. ... Isn't this purpose mostly served by joining the accounting record with wtmp on the ll_line field to obtain the IP address from the ll_host field? ...
    (freebsd-arch)
  • [Fwd: Re: FreeBSD Security Advisory FreeBSD-SA-03:12.openssh]
    ... >99% of even the most heavily loaded servers have more than enough ... by generating a different key for each session you get better ... >run sshd out of inetd. ...
    (FreeBSD-Security)
  • Re: login, telnetd not updating utmp etc on -CURRENT
    ... >>So it looks like that's how those updates are done. ... I think sshd has the ability to write directly to utmp/wtmp, ... Prev by Date: ...
    (freebsd-current)
  • Re: login, telnetd not updating utmp etc on -CURRENT
    ... This is happening on both my systems so I'm guessing it's not something weird that I'm doing I've only noticed this recently as prior to a few days back I'd only been using sshd on my FreeBSD systems, but the older one's telnetd is of 13-Oct-2005 vintage, if that's of any use. ...
    (freebsd-current)