Created attachment 1858764 [details]
patch implementing enhancement request

Description of problem:

I'd like to have additional information audited about the SSH key used to log in.  Specifically, when using SSH certificates from trusted CAs, I'd like to know the id of the key and the principal that is logging in.  This is particularly useful information to have when multiple principals have been granted access to an account.  Sshd is logging some of that to syslog already, but it's not in the audit stream where it can be correlated with user activity.

I've attached a patch with the code to generate these audit messages.  If you'd prefer a pull request, let me know and I'll create one.  I wasn't sure if you'd want the audit patch updated to include this change, or take it as a separate patch.

Note, I'm submitting this change request to Fedora instead of upstream OpenSSH, because the audit functionality this builds on is in an existing Fedora patch, and not upstream.


How reproducible:
100%

Steps to Reproduce:
1. Generate a CA key.
2. Setup a host to trust the CA key.
3. Create a test user.
4. Grant a test principal access to the test user account.
5. Generate a test ssh key.
6. Sign the ssh key with the ca key, including the test principal in the certificate.
7. Check the audit logs.

I can provide more explicit commands to test with if necessary.


Expected results:

Example audit records of a certificate with two principals logging into the testuser account.

type=USER_AUTH msg=audit(1643837305.329:4859): pid=194677 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=cert key_id="testident" cert_serial=1 cert_issuer_alg="RSA" cert_issuer_fp="SHA256:rxlBPzSwfzBwGoqMBXquRhC+xDUO76Zui0JnKV+Jd4U" acct="testuser" exe="/usr/sbin/sshd" hostname=? addr=::1 terminal=? res=success'^]UID="root" AUID="unset"
type=USER_AUTH msg=audit(1643837305.329:4860): pid=194677 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=principal cert_principal="test_principal" acct="testuser" exe="/usr/sbin/sshd" hostname=? addr=::1 terminal=? res=success'^]UID="root" AUID="unset"


Additional info: