Lines Matching +full:phosphor +full:- +full:ipmi +full:- +full:net
1 # phosphor-audit
7 - Alexander Amelkin [a.amelkin@yadro.com](mailto:a.amelkin@yadro.com)
8 - Alexander Filippov [a.filippov@yadro.com](mailto:a.filippov@yadro.com)
10 Created: 2019-07-23
16 provided by OpenBMC. That includes RedFish, IPMI, ssh or serial console shell,
41 controlled interfaces served by other Phosphor OpenBMC components interacting
42 via D-Bus.
46 - Provide a unified method of logging user actions independent of the user
48 - Redfish/REST PUT/POST/DELETE/PATCH
49 - IPMI
50 - PAM
51 - PLDM
52 - Any other suitable service
53 - Provide a way to configure system response actions taken upon certain user
55 - Log an event
56 - Notify an administrator or an arbitrary notification receiver
57 - Run an arbitrary command
58 - Provide a way to configure notification receivers:
59 - E-mail
60 - SNMP
61 - Instant messengers
62 - D-Bus
66 The main idea is to catch D-Bus requests sent by user interfaces, then handle
71 The phosphor-audit service represents a service that provides user activity
74 The key benefit of using phosphor-audit is that all action handling will be kept
82 +----------------+ audit event +-----------------+
83 | IPMI NET +-----------+ | action |
84 +----------------+ | | +-------------+ |
86 +----------------+ | | +-------------+ |
87 | IPMI HOST +-----------+ +--------------+ | |
88 +----------------+ | | audit | | +-------------+ |
89 +----->+ service +----->| | command | |
90 +----------------+ | | | | +-------------+ |
91 | RedFish/REST +-----------+ +--------------+ | |
92 +----------------+ | | +-------------+ |
94 +----------------+ | | +-------------+ |
95 | any service +-----------+ | |
96 +----------------+ | +-------------+ |
98 | +-------------+ |
99 +-----------------+
103 The application sends 'signal' to audit service via D-Bus. What is happening
113 check, the audit event call sends the data through D-Bus to the audit service
121 > - type - type of event source : IPMI, REST, PAM, etc.
122 > - rc - return code of the handler event (status, rc, etc.)
123 > - request - a generalized identifier of the event, e.g. ipmi command
125 > - user - the user account on behalf of which the event was processed. depends
127 > - source - identifier of the host that the event has originated from. This can
129 > connected IPMI), or an IP address or a hostname of a remote host.
130 > - data - any supplementary data that can help better identify the event (e.g.,
131 > some first bytes of the IPMI command data).
138 audit_event(NET_IPMI, "access denied"(rc=-1), "ipmi cmd", "qwerty223",
160 When the call reaches the server destination via D-Bus, the server already knows
166 - client's layer
170 3. send the data to the audit service via D-Bus
171 - server's layer
172 1. accept D-Bus request
188 [IPMI]
210 Options can be updated via D-Bus properties. The audit service listens changes
213 - The whitelisting and blacklisting
219 - Enable/disable the event processing for directed services, where the directed
223 > file or D-Bus property.
225 - Notification setup via SNMP/E-mail/Instant messengers/D-Bus
229 - Logging
231 > phosphor-logging, journald or anything else suitable for.
233 - User actions
242 +----------------+
243 | NET IPMI |
245 +----------------+
247 +--------------------------------------------------------------------------+
248 | +-------v--------+ IPMI |
249 | | NET IPMI | |
250 | +----------------+ |
252 | +-------v--------+ +---------------------------+ |
253 | | rc = handle() +------->| audit_event<NET_IPMI>() | |
254 | +----------------+ +---------------------------+ |
257 | +-------v--------+ | |
260 | +----------------+ | |
261 +--------------------------------------------------------------------------+
264 +--------------------------------------------------------------------------+
265 | +-----------------------------+ |
270 | +-----v------+ |
272 | +------+ enabled +--------------------+ |
274 | | +------------+ +-------v-----+ |
276 | | +--------+ type +--------+ |
278 | | | +-------------+ | |
280 | | +-------v-------+ | |
283 | | +---------------+ | |
285 | | +-------v-------+ | |
287 | | +---------------+ | |
289 | | +-------v-------+ | |
292 | | +---------------+ | |
294 | | +-------v-------+ | |
295 | +-------------->| End |<----------------------+ |
296 | +---------------+ |
298 +--------------------------------------------------------------------------+
306 - E-mail
311 - SNMP
316 - Instant messengers
321 - D-Bus
331 - Exec application via 'system' call.
332 - The code for directed handling type inside handler itself. As example for 'net
333 ipmi' in case of unsuccessful user login inside handler:
334 - Sends a notification to administrator.
335 - echo heartbeat > /sys/class/leds/alarm_red/trigger
341 error-prone and rigid approach.
347 Impacts when phosphor-audit is not enabled:
349 - Many services will have slightly larger code size and longer CPU path length
351 - Increased D-Bus traffic.
353 Impacts when phosphor-audit is enabled: All of the above, plus:
355 - Additional BMC processor time needed to handle audit events.
356 - Additional BMC flash storage needed to store logged events.
357 - Additional outbound network traffic to notify users.
358 - Additional space for notification libraries.
362 `dbus-send` as command-line tool for generating audit events.
366 - For each supported service (such as Redfish, net IPMI, host IPMI, PLDM),
368 - Ensure message-type and request-type filtering works as expected.
369 - Ensure basic notification actions work as expected (log, command, notify).
370 - When continuously generating audit-events, change the phosphor-audit service's