Skip to content
Snippets Groups Projects
  • Russell Bryant's avatar
    4cf8a968
    Add an API for reporting security events, and a security event logging module. · 4cf8a968
    Russell Bryant authored
    This commit introduces the security events API.  This API is to be used by
    Asterisk components to report events that have security implications.
    A simple example is when a connection is made but fails authentication.  These
    events can be used by external tools manipulate firewall rules or something
    similar after detecting unusual activity based on security events.
    
    Inside of Asterisk, the events go through the ast_event API.  This means that
    they have a binary encoding, and it is easy to write code to subscribe to these
    events and do something with them.
    
    One module is provided that is a subscriber to these events - res_security_log.
    This module turns security events into a parseable text format and sends them
    to the "security" logger level.  Using logger.conf, these log entries may be
    sent to a file, or to syslog.
    
    One service, AMI, has been fully updated for reporting security events.
    AMI was chosen as it was a fairly straight forward service to convert.
    The next target will be chan_sip.  That will be more complicated and will
    be done as its own project as the next phase of security events work.
    
    For more information on the security events framework, see the documentation
    generated from doc/tex/.  "make asterisk.pdf"
    
    Review: https://reviewboard.asterisk.org/r/273/
    
    
    git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@206021 65c4cc65-6c06-0410-ace0-fbb531ad65f3
    4cf8a968
    History
    Add an API for reporting security events, and a security event logging module.
    Russell Bryant authored
    This commit introduces the security events API.  This API is to be used by
    Asterisk components to report events that have security implications.
    A simple example is when a connection is made but fails authentication.  These
    events can be used by external tools manipulate firewall rules or something
    similar after detecting unusual activity based on security events.
    
    Inside of Asterisk, the events go through the ast_event API.  This means that
    they have a binary encoding, and it is easy to write code to subscribe to these
    events and do something with them.
    
    One module is provided that is a subscriber to these events - res_security_log.
    This module turns security events into a parseable text format and sends them
    to the "security" logger level.  Using logger.conf, these log entries may be
    sent to a file, or to syslog.
    
    One service, AMI, has been fully updated for reporting security events.
    AMI was chosen as it was a fairly straight forward service to convert.
    The next target will be chan_sip.  That will be more complicated and will
    be done as its own project as the next phase of security events work.
    
    For more information on the security events framework, see the documentation
    generated from doc/tex/.  "make asterisk.pdf"
    
    Review: https://reviewboard.asterisk.org/r/273/
    
    
    git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@206021 65c4cc65-6c06-0410-ace0-fbb531ad65f3