Send authentication log to the syslog

[j1pe]

if you want, I've added a method to send logs (Public IP and username) during authentication to a syslog with udp socket.

[yanncam]

Hello @j1pe,

Thank you for the PR, it's a good idea !
I think you can improve the Syslog integration by defining parameter in the config.php file, like this kind of new constants :

[...]
define("SYSLOG_AUTHD_ENABLE", true);
define("SYSLOG_AUTHD_HOST", "127.0.0.1");
define("SYSLOG_AUTHD_PORT", "514");
[...]

Plus, in your code added, I think you need to:

• Sanitize the {$_SERVER['HTTP_X_FORWARDED_FOR']} and {$_POST['user']} variables to prevent vulnerability and attack as log injection, because these variables can be define client(attacker)-side ;
• Add more control to prevent PHP-error if the Syslog server isn't reachable ;
• Fix the second msg sent to Syslog if the authentication is successful, because you currently send kodi_authd Client authentication failure and it's not a failure :)
• Plus, the code for sending a Syslog msg can be factorized in a new function I think.

Available to discuss it, I think it's a good feature.

If you can adjust your pull request, I would integrate and merge it with the project.

Thank you !

[yanncam]

I think this message isn't the right one. It's not a failure in this case, but a success, no ? :)

[yanncam]

If the Syslog server isn't reachable, PHP-error can be triggered. Several control need to be added I think.

[yanncam]

The $_SERVER['HTTP_X_FORWARDED_FOR'] and $_POST['user'] are defined client(attacker)-side, so it's necessary to add more control / check / sanitization over these variables to prevent log injection attack.

[yanncam]

Syslog server and port can be defined in the config.php file as constant.

[yanncam]

A dedicated function to factorize code can be defined I think.

[j1pe]

Hello,
I'll try to see what I can do within my limited skills.

[j1pe]

Hi,
so I updated the files:
functions.php
index.php
config.php

So, I created a function allowing to send log to the Syslog server with verification of the values to have no injection.
If the server is down, there is no error.

I updated the index.php by only using the function
I updated config.php so that the user can enable or disable the sending of logs by setting the IP address and the UDP port of the server.