Changeset 770 for server/fedora/config

Timestamp:

Jun 18, 2008, 6:42:57 PM (16 years ago)

Author:

quentin

Message:

Stop more spew; parse ssh keys and identify the used key when publickey auth happens

File:

• server/fedora/config/etc/syslog-ng/d_zroot.pl (modified) (4 diffs)

server/fedora/config/etc/syslog-ng/d_zroot.pl

@@ -5 +5 @@
 use Sys::Hostname;
 use Time::HiRes qw(ualarm);
+use File::Temp;
 
 our $ZCLASS = "scripts-auto";
@@ -22 +23 @@
 
 my %toclass;
+
+my %sshkeys;
+
+sub buildKeyMap($) {
+    my ($file) = @_;
+    open (KEYS, $file) or warn "Couldn't open $file: $!";
+    while (<KEYS>) {
+        chomp;
+        my ($fingerprint, $comment) = parseKey($_);
+        $sshkeys{$fingerprint} = $comment;
+    }
+    close(KEYS);
+}
+
+sub parseKey($) {
+    my ($key) = @_;
+    my $tmp = new File::Temp;
+    print $tmp $key;
+    close $tmp;
+    open (KEYGEN, "-|", qw(/usr/bin/ssh-keygen -l -f), $tmp) or die "Couldn't call ssh-keygen: $!";
+    my ($line) = <KEYGEN>;
+    close(KEYGEN);
+    my (undef, $fingerprint, undef) = split(' ', $line, 3);
+    my (undef, undef, $comment) = split(' ', $key, 3);
+    print "$fingerprint $comment";
+    return ($fingerprint, $comment);
+}
+
+buildKeyMap("/root/.ssh/authorized_keys2");
 
 while (1) {
@@ -47 +77 @@
         } elsif ($message =~ m|session \S+ for user (\S+)|) {
             sendmsg($message) if exists $USERS{$1};
+        } elsif ($message =~ m|^Found matching (\w+) key: (\S+)|) {
+            if ($sshkeys{$2}) {
+                sendmsg($message." (".$sshkeys{$2}.")");
+            } else {
+                sendmsg($message." (UNKNOWN KEY)");
+            }
         } elsif ($message =~ m|^Connection closed|) {
             # Do nothing
+        } elsif ($message =~ m|^Closing connection to |) {
+        } elsif ($message =~ m|^Connection from (\S+) port (\S+)|) {
         } elsif ($message =~ m|^Invalid user|) {
         } elsif ($message =~ m|^input_userauth_request: invalid user|) {
@@ -59 +97 @@
         } elsif ($message =~ m|^Postponed keyboard-interactive for invalid user |) {
         } elsif ($message =~ m|^Failed keyboard-interactive/pam for invalid user |) {
+        } elsif ($message =~ m|^Postponed gssapi-with-mic for |) {
         } elsif ($message =~ m|^Address \S+ maps to \S+, but this does not map back to the address|) {
         } else {
-#           sendmsg($message, "scripts-spew");
+            sendmsg($message, "scripts-spew");
         }
     }