Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

when using pam authentication all logon failures marked as success #23

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

when using pam authentication all logon failures marked as success #23

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b6ed5cf
fix pam auth always being logged as success
Jul 22, 2021
394d572
opps remove artifact from another branch / commit
amalek215 Jul 22, 2021
612f4f8
Merge pull request #2 from pgaudit/master
amalek215 Jun 22, 2023
5be98cb
generalize to catch multiple auth related error messages, add additio…
Jun 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 14 additions & 2 deletions bin/pgaudit_analyze
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,16 @@ use constant
STATE_ERROR => 'error'
};

####################################################################################################################################
# Authentication errors that appear as type "LOG" before the type "FATAL" msg is recorded
####################################################################################################################################
my @AUTH_ERRORS = (
'pam_authenticate failed:',
'error from underlying PAM layer:',
'could not connect to Ident server at address'
);


use constant
{
true => 1,
Expand Down Expand Up @@ -318,6 +328,7 @@ sub sessionGet
my $strConnectionFrom = shift;
my $strCommandTag = shift;
my $strErrorSeverity = shift;
my $strMessage = shift;

# Set connection from to a default if not defined yet
if (!defined($strApplicationName))
Expand All @@ -336,7 +347,8 @@ sub sessionGet

# Set state to ERROR on authentication failure
if (defined($strCommandTag) && lc($strCommandTag) eq COMMAND_TAG_AUTHENTICATION &&
defined($strErrorSeverity) && lc($strErrorSeverity) eq ERROR_SEVERITY_FATAL)
( (defined($strErrorSeverity) && lc($strErrorSeverity) eq ERROR_SEVERITY_FATAL) ||
(defined($strMessage) && grep {$strMessage =~ /^$_/} @AUTH_ERRORS )))
{
$strState = STATE_ERROR;
}
Expand Down Expand Up @@ -710,7 +722,7 @@ while(!$bDone)
{
sessionGet($strSessionId, $lSessionLineNum, $$stryRow[LOG_FIELD_PROCESS_ID], $$stryRow[LOG_FIELD_SESSION_START_TIME],
$strUserName, $strDatabaseName, $$stryRow[LOG_FIELD_APPLICATION_NAME], $$stryRow[LOG_FIELD_CONNECTION_FROM],
$$stryRow[LOG_FIELD_COMMAND_TAG], $$stryRow[LOG_FIELD_ERROR_SEVERITY]);
$$stryRow[LOG_FIELD_COMMAND_TAG], $$stryRow[LOG_FIELD_ERROR_SEVERITY], $$stryRow[LOG_FIELD_MESSAGE]);

logWrite($strSessionId, $strDatabaseName, $$stryRow[LOG_FIELD_LOG_TIME], $lSessionLineNum,
defined($$stryRow[LOG_FIELD_COMMAND_TAG]) ? lc($$stryRow[LOG_FIELD_COMMAND_TAG]) : undef,
Expand Down
2 changes: 1 addition & 1 deletion test/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,5 +6,5 @@ docker build --build-arg UID=$(id -u) --build-arg GID=$(id -g) -f test/Dockerfil
```
Then run the test. The path for the PostgreSQL version to be tested must be supplied:
```
docker run --rm -v $(pwd):/pgaudit-analyze pgaudit-analyze-test /pgaudit-analyze/test/test.pl --pgsql-bin=/usr/lib/postgresql/13/bin
docker run -v $(pwd):/pgaudit-analyze pgaudit-analyze-test /pgaudit-analyze/test/test.pl --pgsql-bin=/usr/lib/postgresql/13/bin
```