Send authentication log to the syslog #29

j1pe · 2020-04-24T14:46:23Z

if you want, I've added a method to send logs (Public IP and username) during authentication to a syslog with udp socket.

if you want, I've added a method to send logs (Public IP and username) during authentication.

yanncam · 2020-04-25T11:37:34Z

Hello @j1pe,

Thank you for the PR, it's a good idea !
I think you can improve the Syslog integration by defining parameter in the config.php file, like this kind of new constants :

[...]
define("SYSLOG_AUTHD_ENABLE", true);
define("SYSLOG_AUTHD_HOST", "127.0.0.1");
define("SYSLOG_AUTHD_PORT", "514");
[...]

Plus, in your code added, I think you need to:

Sanitize the {$_SERVER['HTTP_X_FORWARDED_FOR']} and {$_POST['user']} variables to prevent vulnerability and attack as log injection, because these variables can be define client(attacker)-side ;
Add more control to prevent PHP-error if the Syslog server isn't reachable ;
Fix the second msg sent to Syslog if the authentication is successful, because you currently send kodi_authd Client authentication failure and it's not a failure :)
Plus, the code for sending a Syslog msg can be factorized in a new function I think.

Available to discuss it, I think it's a good feature.

If you can adjust your pull request, I would integrate and merge it with the project.

Thank you !

yanncam · 2020-04-25T11:38:29Z

index.php

 			exit;
 		} else {
 			echo "<span class='success'>" . AUTHENTICATION_SUCCESS_REDIRECT . "&nbsp;&nbsp;&nbsp;</span><img src='./images/loading-login.gif' />";
 			echo "<script type='text/javascript'>document.location='./';</script>";
+			#sending a log to the syslog when authentication is correct
+			$sock = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
+			$msg = "kodi_authd Client authentication failure: {$_SERVER['HTTP_X_FORWARDED_FOR']} ({$_POST['user']})";


I think this message isn't the right one. It's not a failure in this case, but a success, no ? :)

yanncam · 2020-04-25T11:39:21Z

index.php

+			$sock = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
+			$msg = "kodi_authd Client authentication failure: {$_SERVER['HTTP_X_FORWARDED_FOR']} ({$_POST['user']})";
+			$len = strlen($msg);
+			socket_sendto($sock, $msg, $len, 0, '127.0.0.1', 514);


If the Syslog server isn't reachable, PHP-error can be triggered. Several control need to be added I think.

yanncam · 2020-04-25T11:40:29Z

index.php

@@ -13,10 +13,23 @@
 		sleep(2);
 		if(!checkAuthentication(trim(strval($_POST['user'])), trim(strval($_POST['pass'])))){
 			echo "<span class='error'>" . AUTHENTICATION_ERROR_CREDENTIAL . "</span>";
+			#sending a log to the syslog when authentication is incorrect
+			$sock = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
+			$msg = "kodi_authd Client authentication failure: {$_SERVER['HTTP_X_FORWARDED_FOR']} ({$_POST['user']})";


The $_SERVER['HTTP_X_FORWARDED_FOR'] and $_POST['user'] are defined client(attacker)-side, so it's necessary to add more control / check / sanitization over these variables to prevent log injection attack.

yanncam · 2020-04-25T11:40:57Z

index.php

+			$sock = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
+			$msg = "kodi_authd Client authentication failure: {$_SERVER['HTTP_X_FORWARDED_FOR']} ({$_POST['user']})";
+			$len = strlen($msg);
+			socket_sendto($sock, $msg, $len, 0, '127.0.0.1', 514);


Syslog server and port can be defined in the config.php file as constant.

yanncam · 2020-04-25T11:41:38Z

index.php

@@ -13,10 +13,23 @@
 		sleep(2);
 		if(!checkAuthentication(trim(strval($_POST['user'])), trim(strval($_POST['pass'])))){
 			echo "<span class='error'>" . AUTHENTICATION_ERROR_CREDENTIAL . "</span>";
+			#sending a log to the syslog when authentication is incorrect


A dedicated function to factorize code can be defined I think.

j1pe · 2020-04-25T14:23:20Z

Hello,
I'll try to see what I can do within my limited skills.

j1pe · 2020-04-28T16:15:12Z

Hi,
so I updated the files:
functions.php
index.php
config.php

So, I created a function allowing to send log to the Syslog server with verification of the values to have no injection.
If the server is down, there is no error.

I updated the index.php by only using the function
I updated config.php so that the user can enable or disable the sending of logs by setting the IP address and the UDP port of the server.

Send authentication log to the syslog

3874210

if you want, I've added a method to send logs (Public IP and username) during authentication.

yanncam reviewed Apr 25, 2020

View reviewed changes

j1pe added 2 commits April 28, 2020 17:54

Add files via upload

a4d7470

Add files via upload

38d8365

Update config.php

f2eee5b

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Send authentication log to the syslog #29

Send authentication log to the syslog #29

j1pe commented Apr 24, 2020

yanncam commented Apr 25, 2020

yanncam Apr 25, 2020

yanncam Apr 25, 2020

yanncam Apr 25, 2020

yanncam Apr 25, 2020

yanncam Apr 25, 2020

j1pe commented Apr 25, 2020 •

edited

Loading

j1pe commented Apr 28, 2020 •

edited

Loading

Send authentication log to the syslog #29

Are you sure you want to change the base?

Send authentication log to the syslog #29

Conversation

j1pe commented Apr 24, 2020

yanncam commented Apr 25, 2020

yanncam Apr 25, 2020

Choose a reason for hiding this comment

yanncam Apr 25, 2020

Choose a reason for hiding this comment

yanncam Apr 25, 2020

Choose a reason for hiding this comment

yanncam Apr 25, 2020

Choose a reason for hiding this comment

yanncam Apr 25, 2020

Choose a reason for hiding this comment

j1pe commented Apr 25, 2020 • edited Loading

j1pe commented Apr 28, 2020 • edited Loading

j1pe commented Apr 25, 2020 •

edited

Loading

j1pe commented Apr 28, 2020 •

edited

Loading