Issue #1007: Additional TPS audit events - dogtagpki

dogtagpki

#1007 Additional TPS audit events

Closed: Fixed Opened May 20, 2014 by edewata.

Currently there's no specific audit events for update operations against profile mappings, connectors, and authenticators, so according to ticket #884 they will fall under CONFIG_TOKEN_GENERAL. Since the log message will contain all property names and values affected by the operation, the log message could become very long.

If the log message length becomes a problem, one option is to disable the event for these operations, but disabling CONFIG_TOKEN_GENERAL will also disable audit on many other things. So, additional audit events are needed to provide more granular controls, specifically for profile mappings, connectors, and authenticators.

Proposed milestone: 10.2 backlog

mharmsen commented Sep 18, 2014

Proposed Milestone: 10.2.2 (per CS Meeting of 09/17/2014)

audit

mharmsen commented Jan 15, 2015

Per Dogtag 10.2.X meeting of 01/14/2015:

cfu to verify whether this ticket remains in milestone 10.2.2

mharmsen commented Feb 25, 2015

Per 10.2.2 Triage meeting of 02/24/2015: 10.2.3

edewata commented Apr 21, 2015

Moving to 10.2.4 per CS team meeting.

mharmsen commented Apr 29, 2015

Per Dogtag 10.2.x TRIAGE meeting of 04/28/2015: (Tech Preview Feature)

mharmsen commented Jun 9, 2015

Per CS/DS meeting of 06/08/2015: 10.2.6

mharmsen commented Jul 1, 2015

Per Dogtag 10.2.6 TRIAGE meeting of 06/30/2015: 10.3

cfu commented Jan 21, 2016

initial preparation work.

commit 7aa1cdd52eca390dee6d8ec4d1e7a956114383c5
Author: Christina Fu cfu@redhat.com
Date: Tue Jan 19 18:59:18 2016 -0800

Ticket #1007 preparation work - replace auditMsg with logMsg
For ticket #1007 TPS Audit Events, we need to add audit messages.
The existing parameter name "auditMsg" has been used broadly for
TPS logging, which could be confused for the actual audit messages.
This patch is to replace all the existing "auditMsg" parameters with
"logMsg" instead.

cfu commented Feb 16, 2016

pushed to master

commit 4e948d6ab69f19f5ee705ca168e7813c14d36f10
Author: Christina Fu cfu@redhat.com
Date: Thu Jan 21 11:58:03 2016 -0800

Ticket #1007 TPS audit events
This patch implements the TPS operation auditing: TOKEN_APPLET_UPGRADE_SUCCESS,TOKEN_APPLET_UPGRADE_FAILURE,TOKEN_CERT_ENROLLMENT,TOKEN_CERT_RENEWAL,TOKEN_CERT_RETRIEVAL,TOKEN_KEY_RECOVERY,TOKEN_CERT_STATUS_CHANGE_REQUEST,TOKEN_OP_REQUEST,TOKEN_FORMAT_SUCCESS,TOKEN_FORMAT_FAILURE,TOKEN_KEY_CHANGEOVER,TOKEN_KEY_CHANGEOVER_FAILURE,TOKEN_PIN_RESET_SUCCESS,TOKEN_PIN_RESET_FAILURE,TOKEN_STATE_CHANGE,TOKEN_AUTH_SUCCESS,TOKEN_AUTH_FAILURE
Administrative auditing (via REST interface) will be covered in a separate ticket

cfu commented Feb 16, 2016

Example audit logs messages for a format operation:
0.http-bio-8080-exec-1 - [15/Feb/2016:15:49:28 PST] [14] [6] [AuditEvent=TOKEN_OP_REQUEST][IP=10.3.229.7][CUID=A10192030405028001C0][MSN=01%02%03%04%][Outcome=success][OP=format][AppletVersion=0.0.6fbbc105] token op request made
0.http-bio-8080-exec-1 - [15/Feb/2016:15:49:29 PST] [14] [6] [AuditEvent=TOKEN_AUTH_SUCCESS][IP=10.3.229.7][SubjectID=user2a][CUID=A10192030405028001C0][MSN=01%02%03%04%][Outcome=success][OP=format][tokenType=null][AppletVersion=0.0.6fbbc105][AuthMgr=ldap1] token authentication success
0.http-bio-8080-exec-1 - [15/Feb/2016:15:49:29 PST] [14] [6] [AuditEvent=AUDIT_LOG_SIGNING][SubjectID=$System$][Outcome=Success] signature of audit buffer just flushed: sig: wA+dlEVyM05IhKbtPn+MdRFdo1eXg7jSYhUAfsHr8OUbN/Z32tXsBxr0QdQ6bj0+jYiXX9MyJbXO/tU7qNwpmMA/ew55UZ9EBUm/PHTo+NAGsA43GOxi5Xeg/t4i/9JvBG0bLkJ+PXiN9bj+R99L+SSCdrN1GVvEYj8wh7d/q9lm442EJ0NHowz8CHgxJ/WVEp3nm/qKdeoQP0JXFWJWPmh1XBonJWEVnjgDlBvDLkPCtfNP1dL7qaee1Far5NvoPch3uLU08mAH1miJ0fzYqUo3qkTqJZwMa9R/aD9TpTnJjvMrdgWH6SVJCgvDUctNY4ev5TFKy1LteGwxdYFFkw==
0.http-bio-8080-exec-1 - [15/Feb/2016:15:49:30 PST] [14] [6] [AuditEvent=TOKEN_APPLET_UPGRADE_SUCCESS][IP=10.3.229.7][SubjectID=user2a][CUID=A10192030405028001C0][MSN=01%02%03%04%][Outcome=success][KeyVersion=0101][oldAppletVersion=0.0.6fbbc105][newAppletVersion=1.4.54de790f][Info=null] token applet upgrade success
0.http-bio-8080-exec-1 - [15/Feb/2016:15:49:30 PST] [14] [6] [AuditEvent=TOKEN_FORMAT_SUCCESS][IP=10.3.229.7][SubjectID=user2a][CUID=A10192030405028001C0][MSN=01%02%03%04%][Outcome=success][tokenType=delegateISEtoken][AppletVersion=0.0.6fbbc105][KeyVersion=0101][Info=null] token op format success

Example audit messages for an externalReg enrollment request with user entries
tokenType: delegateISEtoken
certstoadd: 63,ca1,9,kra1
(That's two cert enrollments and one "recovery"):
0.http-bio-8080-exec-2 - [15/Feb/2016:16:03:33 PST] [14] [6] [AuditEvent=TOKEN_OP_REQUEST][IP=10.3.229.7][CUID=A10192030405028001C0][MSN=01%02%03%04%][Outcome=success][OP=enroll][AppletVersion=0.0.6fbbc105] token op request made
0.http-bio-8080-exec-2 - [15/Feb/2016:16:03:34 PST] [14] [6] [AuditEvent=TOKEN_AUTH_SUCCESS][IP=10.3.229.7][SubjectID=user2a][CUID=A10192030405028001C0][MSN=01%02%03%04%][Outcome=success][OP=enroll][tokenType=null][AppletVersion=0.0.6fbbc105][AuthMgr=ldap1] token authentication success
0.http-bio-8080-exec-2 - [15/Feb/2016:16:03:34 PST] [14] [6] [AuditEvent=AUDIT_LOG_SIGNING][SubjectID=$System$][Outcome=Success] signature of audit buffer just flushed: sig: ZOngJzepqQodsr3IX00PHPyKDk/spiLCK5A80zMh2SqrpzZ89Vrm9+9GllTpVxHLjO8axD0oCo7T5s6izD8vKMr+M0lQVbCIGaApwdTzF8AVrGFBdd9qSI4G4YZoQyHOhGz+YzSKAPukcZpFOYM0XfZmUXBXdIniqN5gna3ovP4vp+PYEbU8MHyTd5xuBEomVElwVdQkvpv462PTh5vi45bH1CbWboHAq3Q7ecZmDHwQX7mCmmvajtHNdaLbb+jq4kyxqOMgkWJVgzteIFpRb5yDSDeUA3mmsHSWwz8orke14lsmHfAtRSxTBe1Js9bNaYP967CHohz6YAMTgGZOLw==
0.http-bio-8080-exec-2 - [15/Feb/2016:16:03:34 PST] [14] [6] [AuditEvent=TOKEN_APPLET_UPGRADE_SUCCESS][IP=10.3.229.7][SubjectID=user2a][CUID=A10192030405028001C0][MSN=01%02%03%04%][Outcome=success][KeyVersion=0101][oldAppletVersion=0.0.6fbbc105][newAppletVersion=1.4.54de790f][Info=null] token applet upgrade success
0./var/lib/pki/pki-tomcat/logs/tps/signedAudit/tps_cert-tps_audit.flush-19 - [15/Feb/2016:16:03:35 PST] [14] [6] [AuditEvent=AUDIT_LOG_SIGNING][SubjectID=$System$][Outcome=Success] signature of audit buffer just flushed: sig: HPhkuUsaDiq/9QZfJcQbrTyBJuGoG3zbgoRQ4xioTlYahcPrS/x/iHbkRkIUUXURgoG2DEJyvnQdZfzjIwwQfxFTB913DCNQ9OISSdi3x9lkMHPYzPSvUVTwO7YK69RBQUsMqZVnxsiDarNY0o4LsD1H74XGt6vHW3mSIz0uY7YNbUau5UheCZBIkaR21kjPpzzC0Mqq4CRLoEjeqgV6G5OkrBBAqa+B5hlfA6YE2pCiIFPZpyFE8weryHObuD58DLzvQzxHJUwrZorxcjBYmdA2ZUlgXLaBYQfJrkGHZDSZWy+kZCJJI/FyaL2bUGiS0kBtJTY4XEIGNVrMfhVsSA==
0.http-bio-8080-exec-2 - [15/Feb/2016:16:03:36 PST] [14] [6] [[AuditEvent=TOKEN_CERT_ENROLLMENT][IP=10.3.229.7][SubjectID=user2a][CUID=A10192030405028001C0][Outcome=success][tokenType=delegateISEtoken][KeyVersion=0101][Serial=128][CA_ID=ca1][Info=null] token certificate enrollment request made
0.http-bio-8080-exec-2 - [15/Feb/2016:16:03:37 PST] [14] [6] [[AuditEvent=TOKEN_CERT_ENROLLMENT][IP=10.3.229.7][SubjectID=user2a][CUID=A10192030405028001C0][Outcome=success][tokenType=delegateISEtoken][KeyVersion=0101][Serial=129][CA_ID=ca1][Info=null] token certificate enrollment request made
0.http-bio-8080-exec-2 - [15/Feb/2016:16:03:37 PST] [14] [6] [AuditEvent=AUDIT_LOG_SIGNING][SubjectID=$System$][Outcome=Success] signature of audit buffer just flushed: sig: oWD9ljQKaHkNndbU5nrU7yshD5YnZXQ+pJbcPkFwWAYbM4Whq1+t0Cghido0sjZo88bPWbVicQ0I0oM8vfb259obJNKcmJ7irOUXQh6WVFhnolxokuxGtRUJJeSPkZPT0/Y7TsPk6lpqU5GWdOWWPvXm4LB5KQW8kGBm9vCa7QV00nDtFPbtz/nlTYBRnJTTK+NWqqb117dsMDVbftOQanxvZp3nAZ3Dql/7QkvKvDWNrDeo/2J3hCmwjFAI5bxoJza7Er3TdJQZ0E2/3Tz9fRTIPIPFopy9i4PQvXeiO6XXUmkuErweDegHGHHZu8q98Imylh3XpY0b8HI1CELH/w==
0.http-bio-8080-exec-2 - [15/Feb/2016:16:03:39 PST] [14] [6] [[AuditEvent=TOKEN_KEY_RECOVERY][IP=10.3.229.7][SubjectID=user2a][CUID=A10192030405028001C0][Outcome=success][tokenType=delegateISEtoken][KeyVersion=0101][Serial=63][CA_ID=ca1][KRA_ID=kra1][Info=null] token certificate/key recovery request made
0.http-bio-8080-exec-2 - [15/Feb/2016:16:03:39 PST] [14] [6] [[AuditEvent=TOKEN_CERT_RETRIEVAL][IP=10.3.229.7][SubjectID=user2a][CUID=A10192030405028001C0][Outcome=success][tokenType=delegateISEtoken][KeyVersion=0101][Serial=63][CA_ID=ca1][Info=null] token certificate retrieval request made
0.http-bio-8080-exec-2 - [15/Feb/2016:16:03:39 PST] [14] [6] [AuditEvent=AUDIT_LOG_SIGNING][SubjectID=$System$][Outcome=Success] signature of audit buffer just flushed: sig: EyAWhWjuTaS2lkO0d5jcc95R0NLbMN66fr67hRMSPCvmYzdvZi0X2u5O78A0crACCgkwLaqA1PzeO4XYrhwmhveEf5oV3JrauUj5TBwdZRmylidAfr8uBEi3gmURBRN2pt37tSGeLQJV1W6oB3GiyRtgNGXfuvOrnIWHq7xNq/7WEGjULgkSY7WoHpkg9s2/uWxl128cRPCBW/eQkwqObcDxDYlmDSGswaIZ7jHlXCzryvddtBXD9cQTDxwUqdcax5EslHF6bDk5d9LNEq6gdGgxSm9EPU8kUfHgGPw0M/ZwrfLgOgsPc+54zJLUf5Mxr+AMIyH0JL6AUAXgD3hB2Q==

Metadata Update from @edewata:
- Issue assigned to cfu
- Issue set to the milestone: 10.3.0

Feb 27, 2017

dmoluguw commented Oct 4, 2020

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/1573

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.

Metadata

Assignee

cfu

Tags

None

Blocking

None

Depending on

None

Priority

Normal

type

defect

component

TPS

origin

Community

dogtagpki

#1007 Additional TPS audit events Closed: Fixed Opened May 20, 2014 by edewata.

Metadata

#1007 Additional TPS audit events

Closed: Fixed Opened May 20, 2014 by edewata.