HLD - Audit Logging daemon for command tracking and RADIUS accounting#2448
Open
rsh2prasad wants to merge 3 commits into
Open
HLD - Audit Logging daemon for command tracking and RADIUS accounting#2448rsh2prasad wants to merge 3 commits into
rsh2prasad wants to merge 3 commits into
Conversation
Collaborator
|
/azp run |
|
No pipelines are associated with this pull request. |
rsh2prasad
changed the title
Collaborator
|
/azp run |
|
No pipelines are associated with this pull request. |
Collaborator
|
/azp run |
|
No pipelines are associated with this pull request. |
|
|
||
| ## 2. Scope | ||
|
|
||
| This document describes the high-level design of `auditlogd`, a new host-level daemon in `sonic-host-services` that streams every command executed on a SONiC switch to configured RADIUS servers as an RFC 2866 **Accounting-Request**, providing operators with a central, tamper-resistant audit trail of privileged actions. |
There was a problem hiding this comment.
Why introduce a standalone auditlogd instead of leveraging the existing Linux auditd plugin framework?
| 1. Must consume kernel audit events promptly to avoid `ENOBUFS` from the kernel. | ||
| 2. A slow or unresponsive RADIUS server must not block delivery to other servers or audit-event consumption. | ||
| 3. The daemon must run as root (required for netlink audit and audit-rule management). | ||
| 4. Restart must be capped by systemd to prevent crash-loops. |
There was a problem hiding this comment.
How are audit events handled when auditlogd crashes, restarts, or the Netlink receive queue overflows?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
auditlogd, a newsonic-host-servicesdaemon that streams every command executed on the switch to configured RADIUS servers as RFC 2866 Accounting-Requests, providing a central, tamper-resistant audit trail of privileged actions.RADIUS_SERVER/MGMT_INTERFACE/DEVICE_METADATAtables (including per-servertimeoutandretransmit), RFC 2865 / 2866 retransmit behavior (same packet reused across retries so servers can dedupe),NETLINK_AUDITconsumption with multi-record event reassembly, per-server health tracking with a global back-pressure loop that pauses consumption when no RADIUS server is reachable, feedback-loop prevention (kernel-level PID exclusion plus user-space filtering of audit tooling), and systemd integration.Motivation
SONiC currently has no built-in way to produce a centralized, RADIUS-based audit trail of privileged commands executed on a switch.
auditlogdfills that gap by consuming kernel audit events overNETLINK_AUDITand emitting one RFC 2866 Accounting-Request per command to the RADIUS servers already configured inCONFIG_DB. The daemon is a pure consumer: it does not authenticate users, does not change how SONiC does RADIUS auth today, has no dependency on 802.1x/PAC, and introduces no new CONFIG_DB tables or fields. Accounting is best-effort by design — during sustained RADIUS outages the daemon pauses cleanly rather than growing memory or blocking user commands.Test plan
tests/auditlogd/sonic-host-servicesper this HLDRelated work