diff options
| author | Damien Miller <djm@cvs.openbsd.org> | 2018-09-12 01:19:13 +0000 |
|---|---|---|
| committer | Damien Miller <djm@cvs.openbsd.org> | 2018-09-12 01:19:13 +0000 |
| commit | 68d4116ce65fa3ac9335e3caedb2cec4adfaf57d (patch) | |
| tree | d37e6169d0eaccb621f1a32c9c18169401275a67 /usr.bin/ssh/auth.c | |
| parent | b72e1cdd6460ab7d60edd6de43dd61f2a3e314e0 (diff) | |
log certificate fingerprint in authentication success/failure message
(previously we logged only key ID and CA key fingerprint).
ok markus@
Diffstat (limited to 'usr.bin/ssh/auth.c')
| -rw-r--r-- | usr.bin/ssh/auth.c | 22 |
1 files changed, 13 insertions, 9 deletions
diff --git a/usr.bin/ssh/auth.c b/usr.bin/ssh/auth.c index a6b294cff98..e73ecef7545 100644 --- a/usr.bin/ssh/auth.c +++ b/usr.bin/ssh/auth.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth.c,v 1.132 2018/07/11 08:19:35 martijn Exp $ */ +/* $OpenBSD: auth.c,v 1.133 2018/09/12 01:19:12 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * @@ -205,22 +205,26 @@ format_method_key(Authctxt *authctxt) { const struct sshkey *key = authctxt->auth_method_key; const char *methinfo = authctxt->auth_method_info; - char *fp, *ret = NULL; + char *fp, *cafp, *ret = NULL; if (key == NULL) return NULL; if (sshkey_is_cert(key)) { - fp = sshkey_fingerprint(key->cert->signature_key, + fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_DEFAULT); - xasprintf(&ret, "%s ID %s (serial %llu) CA %s %s%s%s", - sshkey_type(key), key->cert->key_id, + cafp = sshkey_fingerprint(key->cert->signature_key, + options.fingerprint_hash, SSH_FP_DEFAULT); + xasprintf(&ret, "%s %s ID %s (serial %llu) CA %s %s%s%s", + sshkey_type(key), fp == NULL ? "(null)" : fp, + key->cert->key_id, (unsigned long long)key->cert->serial, sshkey_type(key->cert->signature_key), - fp == NULL ? "(null)" : fp, + cafp == NULL ? "(null)" : cafp, methinfo == NULL ? "" : ", ", methinfo == NULL ? "" : methinfo); free(fp); + free(cafp); } else { fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_DEFAULT); @@ -238,7 +242,7 @@ auth_log(Authctxt *authctxt, int authenticated, int partial, const char *method, const char *submethod) { struct ssh *ssh = active_state; /* XXX */ - void (*authlog) (const char *fmt,...) = verbose; + int level = SYSLOG_LEVEL_VERBOSE; const char *authmsg; char *extra = NULL; @@ -250,7 +254,7 @@ auth_log(Authctxt *authctxt, int authenticated, int partial, !authctxt->valid || authctxt->failures >= options.max_authtries / 2 || strcmp(method, "password") == 0) - authlog = logit; + level = SYSLOG_LEVEL_INFO; if (authctxt->postponed) authmsg = "Postponed"; @@ -264,7 +268,7 @@ auth_log(Authctxt *authctxt, int authenticated, int partial, extra = xstrdup(authctxt->auth_method_info); } - authlog("%s %s%s%s for %s%.100s from %.200s port %d ssh2%s%s", + do_log2(level, "%s %s%s%s for %s%.100s from %.200s port %d ssh2%s%s", authmsg, method, submethod != NULL ? "/" : "", submethod == NULL ? "" : submethod, |