Generate audit logs on login #382

juggernot325 · 2024-02-02T16:22:36Z

Description

This PR updates the authenticator to generate audit logs on login attempts. It follows a similar system as database-level audit logs where an intent record is created when the login attempt starts and a second record is generated after completion to record the actual status. These records were added to the authenticator to ensure they would be logged anywhere a password is checked.

One item to note is that the username will be logged in the fields section for the intent record. This is because it is created prior to verification that the user is valid. If the user is found in the database by the principal name then it will be populated in the actor_ fields of the audit log.

Lastly, these logs are only created for login attempts using a password. Access via an API token will not create audit log entries and will need to be investigated in the application logs.

Motivation and Context

Create a reliable record of each user that accesses or attempts to access BloodHound

How Has This Been Tested?

Tested various successful and failure login cases

Screenshots (if appropriate):

Types of changes

Chore (a change that does not modify the application functionality)
Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

Documentation updates are needed, and have been made accordingly.
I have added and/or updated tests to cover my changes.
All new and existing tests passed.
My changes include a database migration.

…of a generic response

… on the presence of specific context This commit mostly contains the logic to make this method for audit logging work. The only audit log event that works in this commit is CreateUser

…ure cases.

* updated IP address parsing * added tests for IP parsing, changed IP delimiter to comma

…elds

* chore: clean up old approach to reduce noise * chore: cleanup audit logging interface for new usages * chore: fix existing tests (audit integration test needs new target) * chore: improve integration config defaults * feat: add audit logging to UpdateUser This adds a new `AuditableContext` method to the Database, which wraps the Gorm Transaction method with some auditing context and ensures the two phase commit of the audit log is run * feat: add audit logging to DeleteSAMLProvider fix: use actual AuditData instead of the direct model * feat: CreateAssetGroup and DeleteAssetGroup are now back to auditable fix: broken tests * feat: plumb commitID for real this time fix: incorrect formatting of audit log action names fix: additional test fixes * fix: additional test fixes * review comments --------- Co-authored-by: Irshad Ahmed <[email protected]>

* BED-3858 - Fix not ingesting tenant count during azure analysis (#328) Co-authored-by: Irshad Ahmed <[email protected]> * ESC9a Edge Composition (#354) * feat: esc9a post * test: add esc9 test * chore: add harness files * fix: regen schema after merge * chore: fix small nits * chore: cleanup cert template new function * chore: add missing props * wip: 9a composition * fix: treat failure to grab properties as true * wip: esc9a composition * wip: esc9a composition * feat+chore: add depth controls to dawgs patterns * wip: esc9a composition * fix: do not drop the current segment if the next pattern is optional * wip: esc9a composition * fix: update other continuations to respect depth correctly * wip: edge comp * fix: swap * chore: remove unnecessary logs * feat: esc9a post * test: add esc9 test * chore: fix small nits * wip: 9a composition * wip: esc9a composition * wip: esc9a composition * feat+chore: add depth controls to dawgs patterns * wip: esc9a composition * fix: do not drop the current segment if the next pattern is optional * wip: esc9a composition * fix: update other continuations to respect depth correctly * wip: edge comp * fix: swap * chore: remove unnecessary logs * test: add test covering esc9a edge comp * chore: revert random re-ordering * chore: handle negative min/max depth on continuations --------- Co-authored-by: John Hopper <[email protected]> * docs: Add to ESC3 abuse info (#350) * docs: add note in ESC6 abuse info (#356) * feat: Add ADCS pre-built queries (#342) Co-authored-by: Rohan Vazarkar <[email protected]> * feat: esc6a edge composition (#359) * feat: esc6a edge composition * chore: allow composition accordion to show for 6a * fix: add trustedby rel to path4 pattern, use outboundwithdepth for optional memberof traversal * chore: update dcfor pattern to use outboundwithdepth for optional group membership * ESC10a Post Processing (#360) * wip: initial ESC10a post * test: all the tests for esc10a * chore: add edges to post processed * chore: add harnessgen script * test: remove edges from harness * chore: don't exit loop if we hit an error, continue instead * chore: log and continue * feat: filter out ESC3 false positives (#351) * feat: filter out ESC3 false positives * fix: handle esc3 filtering without retraversal * fix: handle esc3 filtering without retraversal * fix: handle esc3 filtering without retraversal * chore: rename function for re-use * chore: log and continue --------- Co-authored-by: rvazarkar <[email protected]> Co-authored-by: Rohan Vazarkar <[email protected]> * chore: patch EULAAcceptance bypass to only run if the current user is set to false * fix: incorrect usage of RemoteAddr fix: unnecessary AuditData() calls fix: use pointers for AuditEntry.Model assignments so successful actions can record updated fields like ID --------- Co-authored-by: mistahj67 <[email protected]> Co-authored-by: Irshad Ahmed <[email protected]> Co-authored-by: Rohan Vazarkar <[email protected]> Co-authored-by: John Hopper <[email protected]> Co-authored-by: Jonas Bülow Knudsen <[email protected]> Co-authored-by: Ulises Rangel <[email protected]> Co-authored-by: rvazarkar <[email protected]>

* audit logs for auth tokens and secrets * fix bad copy

…elds

…ector, CreateSAMLIdentityProvider, and UpdateSAMLIdentityProvider have audit log support (#374) chore: remove unused RemoveAssetGroupSelector method chore: update tests and mocks to account for interface changes

* more auth handlers for audit log * minor optimization

…status

* feat: create an audit log record when unauthorized access is attempted * chore: Only log unauthorized write access * chore: add audit logging to remaining auth middleware * test: Fix middleware/auth_test to support new audit log changes

It was previously sized to only account for max 1 IPv6 address, but our design changes mean it could now be any length

…ogin

* Refactored unauthorized access audit logging: - moved audit logging responsibility to Authorizer interface - cleaned up injections of *db through several layers of code (no longer necessary) - minor cleanup and support work

superlinkx

Just some unexpected shifts caused by the upstream branch getting last minute changes and then merging before we could pull them in (each of these were in my PR too). Once fixed, this looks good to merge

cmd/api/src/api/middleware/middleware.go

cmd/api/src/api/middleware/middleware_internal_test.go

cmd/api/src/api/router/router.go

…e port

juggernot325 and others added 30 commits January 25, 2024 16:40

feat: Initial migration and model updates for AuditLog improvements

0e1d356

feat: populate actor_email for existing audit_logs

d0c6173

chore: Fix audit log docs to show the actual response object instead …

1d08960

…of a generic response

feat: Log Requester IP for source and actor email with audit logs

6019c99

wip: createUser audit logging via middleware

0f0d55a

chore: refactor audit logging to trigger from LoggingMiddleware based…

3d65a85

… on the presence of specific context This commit mostly contains the logic to make this method for audit logging work. The only audit log event that works in this commit is CreateUser

wip: Successfully creating audit logs from middleware. Capturing fail…

86b77a3

…ure cases.

feat: Capture DB errors in audit logs

22c3e8c

chore: remove debug logging

cf4b854

chore: Refactor setting of status to receiver function

985d580

wip: All "simple" audit context endpoints updated for middeware

29673a9

fix: Fix a few bugs found during testing

a05ba51

fix: Remove doc for non-existent POST /api/v2/saml endpoint

cd78c04

wip: Refactor to simplify setting of AuditCtx in endpoints

9cb8a3d

fix: registration issue after rebase

e1d81bd

tasks 6 and 7 for #345 (#357)

3ac13c1

* updated IP address parsing * added tests for IP parsing, changed IP delimiter to comma

Merge remote-tracking branch 'origin/main' into populate-audit-log-fi…

fd32507

…elds

redo IP parsing for changed requirements (#362)

2a14ff5

add eula_accepted to user audit data (#371)

6810bd3

audit logs for auth tokens and secrets (#372)

0482b61

* audit logs for auth tokens and secrets * fix bad copy

Merge branch 'main' into populate-audit-log-fields

af01314

Merge remote-tracking branch 'origin/main' into populate-audit-log-fi…

9ff9831

…elds

more auth handlers for audit log (#373)

d744c31

* more auth handlers for audit log * minor optimization

chore: update documentation for our new commit_id field and intent …

061dc91

…status

chore: change source column to TEXT

13f4160

It was previously sized to only account for max 1 IPv6 address, but our design changes mean it could now be any length

rename audit log source column, add indices

2a2c839

juggernot325 added 7 commits February 1, 2024 13:23

chore: add additional fields to user.AuditData

c36c609

feat: WIP - create audit log entries on login

61427c1

chore: properly set the audit log status if there was an error upon l…

d1b66da

…ogin

chore: remove debug logging

ac50e4f

chore: remove reference code

15b24c5

chore: capture error messages in audit logs on failure

11cbfce

chore: include RequestID in login audit logs

f37e282

juggernot325 marked this pull request as draft February 2, 2024 16:47

sircodemane and others added 8 commits February 2, 2024 11:16

Refactored unauthorized access audit logging: (#381)

eb5e741

* Refactored unauthorized access audit logging: - moved audit logging responsibility to Authorizer interface - cleaned up injections of *db through several layers of code (no longer necessary) - minor cleanup and support work

chore: WIP - Refactor audit loggin in authenticator

7bb94e7

chore: cleanup before review

0719913

Merge branch 'main' into populate-audit-log-fields

847c92c

Merge branch 'main' into audit-log-new-actions

a713b3f

Merge branch 'populate-audit-log-fields' into audit-log-new-actions

47735bd

chore: refactor login auditing to use 2-record method

8ae1344

chore: remove debug logging

0584311

Base automatically changed from populate-audit-log-fields to main February 5, 2024 18:31

juggernot325 added 3 commits February 5, 2024 13:31

chore: update mocks

c92a9c7

fix: move generate.go to separate package

c106534

Merge branch 'main' into audit-log-new-actions

910a342

juggernot325 marked this pull request as ready for review February 5, 2024 20:23

superlinkx requested changes Feb 5, 2024

View reviewed changes

cmd/api/src/api/middleware/middleware.go Outdated Show resolved Hide resolved

cmd/api/src/api/middleware/middleware_internal_test.go Outdated Show resolved Hide resolved

cmd/api/src/api/router/router.go Outdated Show resolved Hide resolved

juggernot325 added 4 commits February 5, 2024 16:58

Merge branch 'main' into audit-log-new-actions

dfd5b2c

chore: address PR comments. Small refactor on parseUserIp to strip th…

e8fb51c

…e port

Merge branch 'main' into audit-log-new-actions

be03293

fix: always populate actor fields if a user was found in the DB

047465c

superlinkx approved these changes Feb 6, 2024

View reviewed changes

juggernot325 merged commit c34819a into main Feb 6, 2024
3 checks passed

juggernot325 deleted the audit-log-new-actions branch February 6, 2024 17:44

github-actions bot locked and limited conversation to collaborators Feb 6, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Generate audit logs on login #382

Generate audit logs on login #382

juggernot325 commented Feb 2, 2024 •

edited

Loading

superlinkx left a comment

Generate audit logs on login #382

Generate audit logs on login #382

Conversation

juggernot325 commented Feb 2, 2024 • edited Loading

Description

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

Checklist:

superlinkx left a comment

Choose a reason for hiding this comment

juggernot325 commented Feb 2, 2024 •

edited

Loading