Add/enhance audit support on AIX by ajaykini · Pull Request #636 · openssh/openssh-portable

ajaykini · 2026-02-17T20:11:19Z

1. Core Audit Implementation Changes

File: [audit.c]

Added AIX-Specific Audit Support:

AIX Headers: Added <sys/audit.h> and <usersec.h> for AIX audit subsystem
Enhanced [audit_username()]: Improved logic to handle NULL authctxt cases
AIX Event Names: Added AIX-compliant event names in [audit_event_lookup()]:
SSH_exceedmtrix, SSH_rootdned, SSH_authsuccess, etc.
Standard names for non-AIX: LOGIN_EXCEED_MAXTRIES, AUTH_SUCCESS, etc.
Enhanced [audit_event()] Function:

UID Tracking: Added auth_uid to track authenticating user's UID
AIX UID Retrieval: Uses getuserattr() on AIX, getpwnam() on other systems
Remote IP Handling: Safely handles NULL ssh pointer
Detailed Logging: Logs auth_uid, username, event type, and remote IP
AIX Audit Writing: Calls auditwrite() with proper result codes (0=success, 1=failure)
Error Handling: Proper buffer truncation checks and error logging
Enhanced [audit_session_open()] Function:

AIX-Specific Implementation: Complete audit trail for session opens
Detailed Context: Logs username, tty, hostname, PID, and UID
AIX Audit Integration: Writes to AIX audit subsystem with auditwrite()
Fallback for Non-AIX: Maintains simple debug logging for other platforms

2. Audit Header Changes

File: [audit.h]
Added New Event Types:

SSH_BAD_PCKT, // bad/invalid packet received
SSH_CIPHER_NO_MATCH, // cipher negotiation failed
SSH_SESSION_OPEN, // session opened

These events enable tracking
of security-relevant protocol events.

3. Client/Server Separation Solution

File: [audit-aix.c] (NEW FILE)

Purpose:
Provides AIX specific implementations of all audit functions for Server binaries.

Key Design:
Conditional Compilation: Uses USE_AIX_AUDIT

4. Testing:

Check if the audit records are getting captured post starting the audit system on AIX as different user and different use case:

> tail -f stream.out
event      login  status   time           command             wpar name         
--------------- -------- ----------- ------------------------ ------------------------------- ------------------------- 
S_PASSWD_READ  root   OK     Tue Feb 03 11:44:53 2026 db2fm              Global           
    audit object read event detected /etc/security/passwd
S_PASSWD_READ  root   OK     Tue Feb 03 11:44:53 2026 db2fm              Global           
    audit object read event detected /etc/security/passwd
SSH_connabndn  root   OK     Tue Feb 03 11:44:57 2026 sshd-session          Global           
    audit event euid 0 user root event 12 (SSH_connabndn) remote ip XX.XX.XX.XX)     ---------------> here 
S_PASSWD_READ  root   OK     Tue Feb 03 11:45:00 2026 cron              Global           
    audit object read event detected /etc/security/passwd
S_PASSWD_READ  root   OK     Tue Feb 03 11:45:00 2026 cron              Global           
    audit object read event detected /etc/security/passwd
S_PASSWD_READ  root   OK     Tue Feb 03 11:45:04 2026 db2fm              Global           
    audit object read event detected /etc/security/passwd
S_PASSWD_READ  root   OK     Tue Feb 03 11:45:04 2026 db2fm              Global           
    audit object read event detected /etc/security/passwd
S_PASSWD_READ  root   OK     Tue Feb 03 11:45:05 2026 sshd-session          Global           
    audit object read event detected /etc/security/passwd
S_PASSWD_READ  root   OK     Tue Feb 03 11:45:05 2026 sshd-session          Global           
    audit object read event detected /etc/security/passwd
SSH_authsuccess root   OK     Tue Feb 03 11:45:05 2026 sshd-session          Global      -----------------> here      
    audit event euid 0 user root event 2 (SSH_authsuccess) remote ip (XX.XX.XX.XX)
S_PASSWD_READ  root   OK     Tue Feb 03 11:45:14 2026 db2fm              Global
..
..
SSH_sessionopn  root     OK          Thu Feb 05 03:59:36 2026 sshd-session                    Global
        audit session open auth_uid 0 user root tty /dev/pts/4 hostname XX.XX.XX.XX pid 16384454
..
..
SSH_badpckt     root     FAIL        Thu Feb 05 05:04:37 2026 sshd-auth                       Global
        audit event for user (unknown user) event 13 (SSH_badpckt) remote ip (XX.XX.XX.XX)

daztucker · 2026-02-18T02:12:17Z

audit.c

 #include <unistd.h>

-#ifdef SSH_AUDIT_EVENTS
+#if defined(SSH_AUDIT_EVENTS) || defined(USE_AIX_AUDIT)


conditionally define SSH_AUDIT_EVENTS in defines.h and don't sprinkle platform specific ifdefs everywhere. see USE_BSM_AUDIT and USE_LINUX_AUDIT in defines.h for examples.

daztucker · 2026-02-18T02:13:54Z

audit.c

 * audit_connection_from() is called and MAY NOT be initialized when
 * audit_event(CONNECTION_ABANDON) is called.  Test for NULL before using.
 */
+#ifdef DEBUG_AUDIT_EVENTS


this part is incorrect. see the description of how it's supposed to work elsewhere

daztucker · 2026-02-18T02:15:01Z

audit.c

 	return(event_lookup[i].name);
 }

-# ifndef CUSTOM_SSH_AUDIT_EVENTS


this is where the shims start. revert this part.

daztucker · 2026-02-18T02:15:26Z

defines.h

 /*
 * Definitions for IP type of service (ip_tos)
 */
+#include <netinet/in_systm.h>


why is this here?

daztucker · 2026-02-18T02:16:13Z

defines.h

 # endif /* gcc version */
 #endif /* __predict_true */

+#if defined(HAVE_GLOB_H) && defined(GLOB_HAS_ALTDIRFUNC) && \


what's this for? it looks like either an unrelated change or a bad merge.

daztucker · 2026-02-18T02:27:41Z

audit.c

 	static const char unknownuser[] = "(unknown user)";
 	static const char invaliduser[] = "(invalid user)";

+#ifdef DEBUG_AUDIT_EVENTS


why are you changing this?

daztucker · 2026-02-18T02:41:01Z

configure.ac

 		AUDIT_MODULE=debug
 		AC_MSG_RESULT([debug])
 		AC_DEFINE([SSH_AUDIT_EVENTS], [1], [Use audit debugging module])
+		AC_DEFINE([DEBUG_AUDIT_EVENTS], [1], [Use audit debugging module])


this part is also unnecessary. if SSH_AUDIT_EVENTS is enabled the hooks are enabled and so are the debug implementations. if SSH_AUDIT_EVENTS and CUSTOM_SSH_AUDIT_EVENTS is enabled your alternative implementations in audit-aix.c.

daztucker · 2026-02-18T02:43:20Z

audit-aix.c

+
+/* Maybe add the audit class to struct Authmethod? */
+ssh_audit_event_t
+audit_classify_auth(const char *method)


this already exists in audit.c and does not need to be duplicated here

daztucker · 2026-02-18T02:43:47Z

audit-aix.c

+
+/* helper to return supplied username */
+const char *
+audit_username(void)


daztucker · 2026-02-18T02:44:30Z

audit-aix.c

+		}
+	}
+
+	/* On other systems, use getpwnam or authctxt->pw */


all of this code is inside AIX specific ifdefs so you do not need to handle other systems here,

openbsd-compat/bsd-setres_id.c

…mpatibility

ajaykini · 2026-02-26T06:48:33Z

@daztucker , I have reworked on the the review comments and have incorporated it as a part of the 2nd commit. Please let me know if anything more needs to be addressed.

I also see that the CI checks w.r.t Ubuntu Kitchensink are failing , not sure why this is failing , any suggestions would be helpful.

Thank you,
Ajay Kini K

Add/enhance audit support on AIX

646886d

daztucker reviewed Feb 18, 2026

View reviewed changes

openbsd-compat/bsd-setres_id.c Show resolved Hide resolved

Add AIX audit support and refactor build system for cross-platform co…

bc6ab6c

…mpatibility

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add/enhance audit support on AIX#636

Add/enhance audit support on AIX#636
ajaykini wants to merge 2 commits intoopenssh:masterfrom
ajaykini:aix_audit_support

ajaykini commented Feb 17, 2026

Uh oh!

daztucker Feb 18, 2026

Uh oh!

daztucker Feb 18, 2026

Uh oh!

daztucker Feb 18, 2026

Uh oh!

daztucker Feb 18, 2026

Uh oh!

daztucker Feb 18, 2026

Uh oh!

daztucker Feb 18, 2026

Uh oh!

daztucker Feb 18, 2026

Uh oh!

daztucker Feb 18, 2026

Uh oh!

daztucker Feb 18, 2026

Uh oh!

daztucker Feb 18, 2026

Uh oh!

Uh oh!

ajaykini commented Feb 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ajaykini commented Feb 17, 2026

1. Core Audit Implementation Changes

2. Audit Header Changes

3. Client/Server Separation Solution

4. Testing:

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ajaykini commented Feb 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants