-
Notifications
You must be signed in to change notification settings - Fork 8
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SSH audit events and contexts #28
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
would love to have also example of the session to see how the contexts are enclosed (probably in the comment here would be enough if we do not want it in the code).
docs/logging-format.md
Outdated
|
||
- `ssh::handshake_client` | ||
- `ssh::ident_string` = `SSH-2.0-OpenSSH_8.8` | ||
- `ssh::client key` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
underscore instead of space
- `ssh::client key` | |
- `ssh::client_key` |
I assume the events should come in order they happen during the ssh session so the client key operation should happen only after the key_exchange is finished.
The hostkey verification happens as part of the key exchange though so it is a question whether it should be part of that context or somehow separately.
In any case, this is a context so it should have again some events attached for example:
- `ssh::client key` | |
- `ssh::client_key` | |
- `ssh::key_algorithm` = `rsa-sha2-256` | |
- `ssh::rsa_bits` = `2048` |
Updated description and full context example is pushed |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think I do not have any more concerns.
Thank you both, it seems the document is in a really good shape now. |
Fixes: #23