[PATCH] pki-cfu-0060-Ticket-1160-audit-needed-for-getKeyInfo-audit-missin.patch
This is the 2nd part of the patch for https://fedorahosted.org/pki/ticket/1160 audit logging needed: REST API auth/authz; kra for getKeyInfo which addresses the missing audit for kra getKeyInfo. note: this patch has no dependency on the first patch that I submitted earlier, which addresses the missing auth/authz audit for REST interface. This is for preliminary review, as I don't have first hand info on how to run most of the services offered here to properly test everything. For efficiency purpose, I'm hoping to enlist some help from edewata/alee. thanks, Christina
This patch (pki-cfu-0062) is to replace pki-cfu-0060 after receiving help from Endi on how to test these key options (thanks Endi!), I have made some code changes for the tests I ran. Just to show some of the test results: ...key-mod 0x2 --status active yields the following audit messages: 0.http-bio-28443-exec-13 - [13/May/2015:19:04:01 EDT] [14] [6] [AuditEvent=KEY_STATUS_CHANGE][SubjectID=kraadmin][Outcome=Success][KeyID=3][OldStatus=active][NewStatus=active][Info=KeyService.modifyKeyStatus] Key Status Change 0.http-bio-28443-exec-14 - [13/May/2015:19:04:02 EDT] [14] [6] [AuditEvent=SECURITY_DATA_RETRIEVE_KEY][SubjectID=kraadmin][Outcome=Success][RecoveryID=null][KeyID=3][Info=KeyService.getKeyInfo] security data retrieval request key-generate test3 --key-algorithm RSA --key-size 1024 yields the following audit message: 0.http-bio-28443-exec-19 - [13/May/2015:19:10:24 EDT] [14] [6] [AuditEvent=ASYMKEY_GENERATION_REQUEST][SubjectID=kraadmin][Outcome=Success][GenerationRequestID=6][ClientKeyID=test3] Asymkey generation request made [AuditEvent=ASYMKEY_GENERATION_REQUEST_PROCESSED][SubjectID=kraadmin][Outcome=Success][GenerationRequestID=6][ClientKeyID=test3][KeyID=4][FailureReason=None] Asymkey generation request processed key-archive --clientKeyID test4 --passphrase "cfu secret" yields the following audit messages: 0.http-bio-28443-exec-24 - [13/May/2015:19:21:37 EDT] [14] [6] [AuditEvent=SECURITY_DATA_ARCHIVAL_REQUEST_PROCESSED][SubjectID=kraadmin][Outcome=Success][ArchivalRequestID=7][ClientKeyID=test4][KeyID=5][FailureReason=None] security data archival request processed 0.http-bio-28443-exec-24 - [13/May/2015:19:21:37 EDT] [14] [6] [AuditEvent=SECURITY_DATA_ARCHIVAL_REQUEST][SubjectID=kraadmin][Outcome=Success][ArchivalRequestID=7][ClientKeyID=test4] security data archival request made thanks, Christina On 05/11/2015 06:09 PM, Christina Fu wrote:
This is the 2nd part of the patch for https://fedorahosted.org/pki/ticket/1160 audit logging needed: REST API auth/authz; kra for getKeyInfo which addresses the missing audit for kra getKeyInfo.
note: this patch has no dependency on the first patch that I submitted earlier, which addresses the missing auth/authz audit for REST interface.
This is for preliminary review, as I don't have first hand info on how to run most of the services offered here to properly test everything. For efficiency purpose, I'm hoping to enlist some help from edewata/alee.
thanks, Christina
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
On 5/13/2015 7:27 PM, Christina Fu wrote:
This patch (pki-cfu-0062) is to replace pki-cfu-0060 after receiving help from Endi on how to test these key options (thanks Endi!), I have made some code changes for the tests I ran.
Just to show some of the test results:
...key-mod 0x2 --status active yields the following audit messages: 0.http-bio-28443-exec-13 - [13/May/2015:19:04:01 EDT] [14] [6] [AuditEvent=KEY_STATUS_CHANGE][SubjectID=kraadmin][Outcome=Success][KeyID=3][OldStatus=active][NewStatus=active][Info=KeyService.modifyKeyStatus] Key Status Change 0.http-bio-28443-exec-14 - [13/May/2015:19:04:02 EDT] [14] [6] [AuditEvent=SECURITY_DATA_RETRIEVE_KEY][SubjectID=kraadmin][Outcome=Success][RecoveryID=null][KeyID=3][Info=KeyService.getKeyInfo] security data retrieval request
key-generate test3 --key-algorithm RSA --key-size 1024 yields the following audit message: 0.http-bio-28443-exec-19 - [13/May/2015:19:10:24 EDT] [14] [6] [AuditEvent=ASYMKEY_GENERATION_REQUEST][SubjectID=kraadmin][Outcome=Success][GenerationRequestID=6][ClientKeyID=test3] Asymkey generation request made [AuditEvent=ASYMKEY_GENERATION_REQUEST_PROCESSED][SubjectID=kraadmin][Outcome=Success][GenerationRequestID=6][ClientKeyID=test3][KeyID=4][FailureReason=None] Asymkey generation request processed
key-archive --clientKeyID test4 --passphrase "cfu secret" yields the following audit messages: 0.http-bio-28443-exec-24 - [13/May/2015:19:21:37 EDT] [14] [6] [AuditEvent=SECURITY_DATA_ARCHIVAL_REQUEST_PROCESSED][SubjectID=kraadmin][Outcome=Success][ArchivalRequestID=7][ClientKeyID=test4][KeyID=5][FailureReason=None] security data archival request processed 0.http-bio-28443-exec-24 - [13/May/2015:19:21:37 EDT] [14] [6] [AuditEvent=SECURITY_DATA_ARCHIVAL_REQUEST][SubjectID=kraadmin][Outcome=Success][ArchivalRequestID=7][ClientKeyID=test4] security data archival request made
thanks, Christina
Some comments: 1. There should be an upgrade script to update the CS.cfg in existing KRA instances. 2. In KeyService.java:416 the method may return without audit logging. Everything else looks good. -- Endi S. Dewata
Thanks Endi, nice catch on one missing audit. Per our discussion on irc, added the missing audit and pushed to master: c0d14140aca982ac637d5fd34f1c3ddb23836867 <https://fedorahosted.org/pki/changeset/c0d14140aca982ac637d5fd34f1c3ddb23836867/> And a new ticket created to cover the desirable upgrade script: https://fedorahosted.org/pki/ticket/1382 KRA: upgrade script maybe needed for CS.cfg to add new audit events added in ticket 1160 Christina On 05/14/2015 01:04 PM, Endi Sukma Dewata wrote:
On 5/13/2015 7:27 PM, Christina Fu wrote:
This patch (pki-cfu-0062) is to replace pki-cfu-0060 after receiving help from Endi on how to test these key options (thanks Endi!), I have made some code changes for the tests I ran.
Just to show some of the test results:
...key-mod 0x2 --status active yields the following audit messages: 0.http-bio-28443-exec-13 - [13/May/2015:19:04:01 EDT] [14] [6] [AuditEvent=KEY_STATUS_CHANGE][SubjectID=kraadmin][Outcome=Success][KeyID=3][OldStatus=active][NewStatus=active][Info=KeyService.modifyKeyStatus]
Key Status Change 0.http-bio-28443-exec-14 - [13/May/2015:19:04:02 EDT] [14] [6] [AuditEvent=SECURITY_DATA_RETRIEVE_KEY][SubjectID=kraadmin][Outcome=Success][RecoveryID=null][KeyID=3][Info=KeyService.getKeyInfo]
security data retrieval request
key-generate test3 --key-algorithm RSA --key-size 1024 yields the following audit message: 0.http-bio-28443-exec-19 - [13/May/2015:19:10:24 EDT] [14] [6] [AuditEvent=ASYMKEY_GENERATION_REQUEST][SubjectID=kraadmin][Outcome=Success][GenerationRequestID=6][ClientKeyID=test3]
Asymkey generation request made [AuditEvent=ASYMKEY_GENERATION_REQUEST_PROCESSED][SubjectID=kraadmin][Outcome=Success][GenerationRequestID=6][ClientKeyID=test3][KeyID=4][FailureReason=None]
Asymkey generation request processed
key-archive --clientKeyID test4 --passphrase "cfu secret" yields the following audit messages: 0.http-bio-28443-exec-24 - [13/May/2015:19:21:37 EDT] [14] [6] [AuditEvent=SECURITY_DATA_ARCHIVAL_REQUEST_PROCESSED][SubjectID=kraadmin][Outcome=Success][ArchivalRequestID=7][ClientKeyID=test4][KeyID=5][FailureReason=None]
security data archival request processed 0.http-bio-28443-exec-24 - [13/May/2015:19:21:37 EDT] [14] [6] [AuditEvent=SECURITY_DATA_ARCHIVAL_REQUEST][SubjectID=kraadmin][Outcome=Success][ArchivalRequestID=7][ClientKeyID=test4]
security data archival request made
thanks, Christina
Some comments:
1. There should be an upgrade script to update the CS.cfg in existing KRA instances.
2. In KeyService.java:416 the method may return without audit logging.
Everything else looks good.
participants (2)
-
Christina Fu -
Endi Sukma Dewata