Matching Certificate-Based-Login Messages

PrivX users logging in with certificate-based authentication generate log messages both on the PrivX server and on the target host. These messages can be matched by the certificate serial.

For example, an SSH connection to a Unix host may generate the following messages:

• On the PrivX server (in /var/log/messages):

Dec 5 15:57:27 privx.example.com SSH-PRIVX-AUDIT[6825]:
[event="Authorization-certificate-granted" eventID="401"
keyID="alice@127.0.0.1:45910-serial-2571351803943628705"
message="certificate-created" target="127.0.0.1:45910"
username="alice"]

• And on the target host (typically in /var/log/secure or /var/log/auth.log):

Dec  5 15:57:28 ld-jizhouya sshd[22799]: Accepted publickey for alice
from 192.0.2.102 port 38126 ssh2: RSA-CERT ID alice@127.0.0.1:45910
serial 2571351803943628705 (serial 2571351803943628705)
CA RSA SHA256:aVOPjQAB2b+y64OJ8UozVe5EKegsrCClE9UQN/MEq4c

As another example, an RDP connection to a Windows host may generate:

• On the PrivX server (in /var/log/messages):

Dec 5 08:24:41 dhcp-10-1-54-160.hel.fi.ssh.com SSH-PRIVX-AUDIT[14189]:
[event="Authorization-certificate-granted" eventID="401"
SSH-PrivX-service="AUTHORIZER" message="RDP-certificate-created"
serial="1A654E1CD607153C"
sha1-fingerprint="..." sha256-fingerprint="..."
target="127.0.0.1:47390" upn="alice@example.com" username="alice"]

• And on the target host (in Windows Event Viewer→Windows Logs→Security→Event details):

Audit Success 5.12.2018 15.25.09 Microsoft-Windows-Security-Auditing
4768 Kerberos Authentication Service "A Kerberos authentication
ticket (TGT) was requested.

Account Information:
Account Name: alice
Supplied Realm Name: EXAMPLE.COM
User ID: EXAMPLE\alice

Service Information:
Service Name: krbtgt
Service ID: EXAMPLE\krbtgt

Network Information:
Client Address: ::1
Client Port: 0

Additional Information:
Ticket Options: 0x40810010
Result Code: 0x0
Ticket Encryption Type: 0x12
Pre-Authentication Type: 15

Certificate Information:
Certificate Issuer Name: 10.1.54.160
Certificate Serial Number: 1A654E1CD607153C
Certificate Thumbprint: 1580AB1E1428B94B5DCF2EB13145B524B864D65F