Add ip from which user is connecting to audit log

General
1

Hello,

we would like to add the IP address from which the user is connecting to the audit log generated by ConfD.

The current audit log that ConfD generates has the following pattern: audit user: <username>/<session_id>. We would like to change that to also include the IP so that it would look like: audit user: <username>/<IP>/<session_id> or audit user: <username>/<session_id>/<ip>.

Is there a way to do that via ConfD configuration? We have found `/confdConfig/logs/auditLog/external/enabled that enables us to call an external function upon log event, but it does not seem like we could manipulate logs via it. We also found that you could subscribe to the notification socket and make changes to logs from there, but this seems like it needs to be done in all daemons that do that. and won’t work for audit logs generated by ConfD automatically on user interaction.

We also found that it is possible to return accept_info from external authentication (we are using it), and add info that as it says, will be added to the audit log.

It is also possible for the program to return additional information on successful authentication, by using
“accept_info” instead of “accept”:
“accept_info $groups $uid $gid $supplementary_gids $HOME $info\n”
Where $info is some arbitrary text. ConfD will then just append this text to the generated audit log
message (CONFD_EXT_LOGIN).

we have tested that and this info text was just added to the audit log of extauth and then not anymore.

We are using ConfD version 7.7.10.

2

So after some additional testing, it turns out that by subscribing to a notification socket, you can get all audit logs. But we still haven’t figured out if it is possible to manipulate them this way.

Is there a way to do it @cohult?

3

There is no API to modify log entries before they are written to log files.
Two options:

  1. Turn off audit logging to a file in confd.conf and create your audit log file using the audit log notifications you subscribe to.
  2. Use the External Logging feature to get notified when an audit log entry has been written to the audit log file and check + modify the log entry in the log file. See ConfD UG under " External Logging" and the examples.confd//misc/extern_logging example.