Audit logging

Jan Safranek jsafrane at redhat.com
Tue Nov 12 11:44:11 UTC 2013


Hi,

on last IRC meeting we discussed how auditing of a system management
based on CIM should look like.

Pegasus CIMOM already implements audit logs, it must be explicitly
enabled during build (already done so in RHEL and Fedora) and then it
must be enabled in Pegasus configuration.

Pegasus logs to syslog:
- authentication attempts
- any Create/Delete/Modify operations
- any InvokeMethod operations

Pegasus _does not_ log any read-only (Enumerate*, GetInstance, ...)
operations.

Some examples of the audit messages:
cimserver audit[1484]: Basic authentication attempt: successful = TRUE,
from IP address = ::ffff:192.168.100.1, user = root.

cimserver audit[1484]: A CIM DeleteInstance operation on instance
"LMI_Account.CreationClassName="LMI_Account",Name="account_test_user",SystemCreationClassName="Linux_ComputerSystem",SystemName="rawhide""
in namespace "root/cimv2" by user "root" connected from system
"::ffff:192.168.100.1" resulted in status "CIM_ERR_SUCCESS".  The
provider for this operation is "LMI_Account" in module "cmpiLMI_Account".

cimserver audit[1484]: A CIM InvokeMethod operation on method
"CreateAccount" of object
"LMI_AccountManagementService.CreationClassName="LMI_AccountManagementService",Name="OpenLMI
Linux Users Account Management
Service",SystemCreationClassName="Linux_ComputerSystem",SystemName="rawhide""
in namespace "root/cimv2" by user "root" connected from system "::1"
resulted in status "CIM_ERR_FAILED".

cimserver audit[1484]: A CIM ModifyInstance operation on instance
"LMI_Account.CreationClassName="LMI_Account",Name="account_test_user",SystemCreationClassName="Linux_ComputerSystem",SystemName="rawhide""
in namespace "root/cimv2" by user "root" connected from system "::1"
resulted in status "CIM_ERR_SUCCESS".  The provider for this operation
is "LMI_Account" in module "cmpiLMI_Account".


As for authorization, Pegasus implements simple ACLs, where each user
can have read and/or write privilege for a given namespace.
This could be overridden by Pegasus native provider (using Pegasus C++
interface, that's not CMPI!)

Jan


More information about the openlmi-devel mailing list