emit an audit event with file transfer statistics when an SFTP session is completed #48051
Conversation
capnspacehook
added
sftp
github-actions
bot
added
audit-log
|
This pull request is automatically being deployed by Amplify Hosting (learn more). |
|
Why not restore the original SFTP write event? |
|
The original SFTP write and other events were removed because they were too noisy, reading/writing to a file typically happens in multiple small requests instead of one large one even for small files. This consolidates all info on an SFTP session into one event. The potential downside is if someone keeps an SFTP connection open for a really long time the amount of data transferred would be emitted for a long time. Given the nature of the request for this event though I don't think that's a big concern though. |
| @@ -1892,6 +1892,54 @@ message SFTP { | |||
| string Error = 12 [(gogoproto.jsontag) = "error,omitempty"]; | |||
| } | |||
|
|
|||
| // SFTPSummary is emitted at the end of an SFTP transfer | |||
| message SFTPSummary { | |||
There was a problem hiding this comment.
How can I tell if this was a upload or download? Looks at bytes read vs written?
There was a problem hiding this comment.
Yep, technically you can write and read to the same file handle so classifying isn't as straightforward as SCP. But for 99% of cases the program that is issuing SFTP requests will likely only be reading or writing to files, so I can label this if needed
capnspacehook
force-pushed
the
capnspacehook/sftp-summary
branch
from
7f05bcc to
0f3cb7b
Compare
capnspacehook
force-pushed
the
capnspacehook/sftp-summary
branch
from
4f0b98d to
3bfd292
Compare
|
@capnspacehook See the table below for backport results.
|
|
Screenshot of the new audit event
|
When an SFTP session ends a new event will now be emitted listing all the files that were read/written to and the amount of bytes that were transferred per file. More fine grained info on SFTP requests during a session will be continued to be emitted as well.
This also removes some unused SFTP event codes. They were removed here in v13 so it should be completely fine to backport this all the way to v14, since we haven't been using these event codes in awhile.
Closes https://github.com/gravitational/customer-sensitive-requests/issues/336.
changelog: emit an audit event with file transfer information when an SFTP session is completed