openssh unix dev - Nov 2001 - logging of root logins

On Thu, Nov 08, 2001 at 01:59:25PM +0100, Arthur de Jong
wrote:
> root and warthur both have user id 0. Sorry, I should have made that
> clearer. They both have different passwords and rsa keys and I would like
> to be able to make the distinction in the logs. Currently ssh only logs
> that a ROOT user has logged in, not which one.
hm, i don't think uid sharing is a standard unix feature.

however, i think that we should drop this:

	authlog("%s %s for %s%.100s from %.200s port %d%s",
	    authmsg,
	    method,
	    authctxt->valid ? "" : "illegal user ",
	    authctxt->valid && authctxt->pw->pw_uid == 0 ?
"ROOT" : authctxt->user,
	    get_remote_ipaddr(), 
	    get_remote_port(),
	    info);

and not print ROOT in caps:

	authlog("%s %s for %s%.100s from %.200s port %d%s",
	    authmsg,
	    method,
	    authctxt->valid ? "" : "illegal user ",
	    authctxt->user,
	    get_remote_ipaddr(), 
	    get_remote_port(),
	    info);

do we really need backward compatibility for printing ROOT
in upper case?

-m

On Thu, 8 Nov 2001, Markus Friedl wrote:
> hm, i don't think uid sharing is a standard unix feature.
I agree that it's not a very nice thing to do but I know several
organisations that use several ROOT accounts. It's nice to have several
passwords to access ROOT priviliges. (I know sudo or similar is better but
not as convenient).
> however, i think that we should drop this:
>
> 	authlog("%s %s for %s%.100s from %.200s port %d%s",
> 	    authmsg,
> 	    method,
> 	    authctxt->valid ? "" : "illegal user ",
> 	    authctxt->valid && authctxt->pw->pw_uid == 0 ?
"ROOT" : authctxt->user,
> 	    get_remote_ipaddr(),
> 	    get_remote_port(),
> 	    info);
>
> and not print ROOT in caps:
>
> 	authlog("%s %s for %s%.100s from %.200s port %d%s",
> 	    authmsg,
> 	    method,
> 	    authctxt->valid ? "" : "illegal user ",
> 	    authctxt->user,
> 	    get_remote_ipaddr(),
> 	    get_remote_port(),
> 	    info);
>
> do we really need backward compatibility for printing ROOT
> in upper case?
I personally like capatalized ROOT because it makes root logins stick out
in the logs. Maybe something like:

 authlog("%s %s for %s%s%.100s from %.200s port %d%s",
         authmsg,
         method,
         authctxt->valid ? "" : "illegal user ",
         authctxt->valid && authctxt->pw->pw_uid == 0 ?
"ROOT user " : "",
         authctxt->user,
         get_remote_ipaddr(),
         get_remote_port(),
         info);

This would make it stand out and maybe keep it partially compatible with
logfile checkers. Or even:

 authlog("%s %s for %s%.100s from %.200s port %d%s",
        ...
        authctxt->valid ? ( authctxt->pw->pw_uid == 0 ? "ROOT user
" : "" ) : "illegal user ",
        ...

-- arthur de jong - arthur at west.nl - west consulting b.v. --

On Thu, Nov 08, 2001 at 04:02:05PM +0100, Arthur de Jong
wrote:
>          authctxt->valid && authctxt->pw->pw_uid == 0 ?
"ROOT user " : "",
well this will print
	ROOT user root
in 99.99999% of all cases.

-m