:py:mod:`dissect.target.plugins.os.unix.log.auth`
=================================================

.. py:module:: dissect.target.plugins.os.unix.log.auth




Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.target.plugins.os.unix.log.auth.BaseService
   dissect.target.plugins.os.unix.log.auth.SudoService
   dissect.target.plugins.os.unix.log.auth.SshdService
   dissect.target.plugins.os.unix.log.auth.SystemdLogindService
   dissect.target.plugins.os.unix.log.auth.SuService
   dissect.target.plugins.os.unix.log.auth.PkexecService
   dissect.target.plugins.os.unix.log.auth.PamUnixService
   dissect.target.plugins.os.unix.log.auth.AuthLogRecordBuilder
   dissect.target.plugins.os.unix.log.auth.AuthPlugin




Attributes
~~~~~~~~~~

.. autoapisummary::

   dissect.target.plugins.os.unix.log.auth.RE_USER


.. py:data:: RE_USER

.. py:class:: BaseService

   Bases: :py:obj:`abc.ABC`


   Helper class that provides a standard way to create an ABC using
   inheritance.


   .. py:method:: parse(message: str) -> dict[str, any]
      :classmethod:

      :abstractmethod:



.. py:class:: SudoService

   Bases: :py:obj:`BaseService`


   Parsing of sudo service messages in the auth log.


   .. py:attribute:: RE_SUDO_COMMAND


   .. py:method:: parse(message: str) -> dict[str, str]
      :classmethod:


      Parse auth log message from sudo.



.. py:class:: SshdService

   Bases: :py:obj:`BaseService`


   Class for parsing sshd messages in the auth log.


   .. py:attribute:: RE_SSHD_PORTREGEX


   .. py:attribute:: RE_USER


   .. py:method:: parse(message: str) -> dict[str, str | int]
      :classmethod:


      Parse message from sshd.



.. py:class:: SystemdLogindService

   Bases: :py:obj:`BaseService`


   Class for parsing systemd-logind messages in the auth log.

   .. rubric:: References

   - https://github.com/systemd/systemd/blob/main/src/login/logind-session.c
   - https://github.com/systemd/systemd/blob/main/src/login/logind-session.h
   - https://github.com/systemd/systemd/blob/main/src/login/logind-seat.c


   .. py:attribute:: RE_MSG_WATCHING


   .. py:attribute:: RE_MSG_SESSION_NEW


   .. py:attribute:: RE_MSG_SESSION_NEW_VARIANT


   .. py:attribute:: RE_MSG_SESSION_LOGGED_OUT


   .. py:attribute:: RE_MSG_SESSION_REMOVED


   .. py:attribute:: RE_MSG_SEAT


   .. py:method:: parse(message: str) -> dict[str, str]
      :classmethod:


      Parse auth log message from systemd-logind.



.. py:class:: SuService

   Bases: :py:obj:`BaseService`


   Class for parsing su messages in the auth log.


   .. py:attribute:: RE_SU_BY


   .. py:attribute:: RE_SU_ON


   .. py:attribute:: RE_SU_COMMAND


   .. py:method:: parse(message: str) -> dict[str, str]
      :classmethod:



.. py:class:: PkexecService

   Bases: :py:obj:`BaseService`


   Class for parsing pkexec messages in the auth log.


   .. py:attribute:: RE_PKEXEC_COMMAND


   .. py:method:: parse(message: str) -> dict[str, str]
      :classmethod:


      Parse auth log message from pkexec.



.. py:class:: PamUnixService

   Bases: :py:obj:`BaseService`


   Helper class that provides a standard way to create an ABC using
   inheritance.


   .. py:attribute:: RE_PAM_UNIX


   .. py:method:: parse(message: str) -> dict[str, str | int]
      :classmethod:


      Parse auth log message from pluggable authentication modules (PAM).



.. py:class:: AuthLogRecordBuilder(target: dissect.target.target.Target)

   Class for dynamically creating auth log records.


   .. py:attribute:: RECORD_NAME
      :value: 'linux/log/auth'



   .. py:attribute:: SERVICES
      :type:  Final[dict[str, BaseService]]


   .. py:attribute:: target


   .. py:method:: build_record(ts: datetime.datetime, source: pathlib.Path, line: str) -> dissect.target.helpers.record.TargetRecordDescriptor

      Builds an ``AuthLog`` event record.



.. py:class:: AuthPlugin(target: dissect.target.target.Target)

   Bases: :py:obj:`dissect.target.plugin.Plugin`


   Unix authentication log plugin.


   .. py:method:: check_compatible() -> None

      Perform a compatibility check with the target.

      This function should return ``None`` if the plugin is compatible with the current target (``self.target``).
      For example, check if a certain file exists. Otherwise it should raise an
      :class:`UnsupportedPluginError`.

      :raises UnsupportedPluginError: If the plugin could not be loaded.



   .. py:method:: authlog() -> collections.abc.Iterator[Any]

      Yield contents of ``/var/log/auth.log*`` and ``/var/log/secure*`` files.

      Order of returned events is not guaranteed to be chronological because of year
      rollover detection efforts for log files without a year in the timestamp.

      The following timestamp formats are recognised automatically. This plugin
      assumes that no custom ``date_format`` template is set in ``syslog-ng`` or ``systemd``
      configuration (defaults to ``M d H:M:S``).

      ISO formatted authlog entries are parsed as can be found in Ubuntu 24.04 and later.

      .. code-block:: text

          CentOS format: Jan 12 13:37:00 hostname daemon: message
          Debian format: Jan 12 13:37:00 hostname daemon[pid]: pam_unix(daemon:session): message
          Ubuntu  24.04: 2024-01-12T13:37:00.000000+02:00 hostname daemon[pid]: pam_unix(daemon:session): message

      .. rubric:: References

      - https://help.ubuntu.com/community/LinuxLogFiles