You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:13 UTC
[I] SSH Authentication Success Not Logged (tooling-trusted-releases)
asf-tooling opened a new issue, #1114:
URL: https://github.com/apache/tooling-trusted-releases/issues/1114
**ASVS Level(s):** L1
**Description:**
### Summary
The SSH authentication handler (`SSHServer.validate_public_key` in `atr/ssh.py`) logs some failure cases but does not log successful authentications or missing workflow key lookups. The function properly logs invalid usernames (public_key_invalid) and expired keys (public_key_expired), and sets authentication context with `log.set_asf_uid()`, but when workflow key is not found in database or authentication succeeds, no log entry is created. This creates an incomplete audit trail for automated GitHub workflow authentication.
### Details
In `atr/ssh.py` at lines 97-122, the `validate_public_key()` method logs failures but not successes or missing key scenarios.
### Recommended Remediation
Add logging for both success and missing key scenarios. When workflow_key is None, add:
```python
log.failed_authentication('workflow_key_not_found', extra={'fingerprint': fingerprint})
```
Before return True at end of function, add:
```python
log.info('ssh_auth_success', extra={
'username': username,
'fingerprint': fingerprint,
'asf_uid': self._github_asf_uid
})
```
### Acceptance Criteria
- [ ] SSH authentication success logged
- [ ] Missing workflow key logged as failure
- [ ] Complete audit trail for SSH authentication
- [ ] Unit tests verify logging
### References
- Source reports: L1:7.2.2.md
- Related findings: FINDING-134
- ASVS sections: 7.2.2
### Priority
Low
---
---
**Triage notes:** very-low
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] SSH Authentication Success Not Logged (tooling-trusted-releases)
Posted by "alitheg (via GitHub)" <gi...@apache.org>.
alitheg closed issue #1114: SSH Authentication Success Not Logged
URL: https://github.com/apache/tooling-trusted-releases/issues/1114
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] SSH Authentication Success Not Logged (tooling-trusted-releases)
Posted by "alitheg (via GitHub)" <gi...@apache.org>.
alitheg commented on issue #1114:
URL: https://github.com/apache/tooling-trusted-releases/issues/1114#issuecomment-4199208667
Myabe with this, #1115, #1036, #957 etc we should just have an auth audit log as well?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org