Log cluster-admin successful login

[DavidePrincipi]

When the Admin authenticates successfully in cluster-admin, a log entry should be written into /var/log/secure and sent to Cloud Log Manager.

By now, only these Syslog facilities are sent to CLM:

journalctl --facility=4,10,13,14

• Discussion https://mattermost.nethesis.it/nethesis/pl/h8fh8boszpgd8n9u3u4dzodiyh

Thanks to @Sempronto

[DavidePrincipi]

Implementation

• The api-server should write a log record with successful login information: username, if 2FA was used. See https://github.com/NethServer/ns8-core/blob/cc29010d4199ae8ce24b5b0d72f5de32d08f4ae0/core/api-server/middleware/middleware.go#L132
• The log record must be sent to the auth (4) syslog facility, by prefixing string <34> to the message. stderr

For example:

[auth] login-ok user=alice source=10.0.0.5 2fa=false

[gsanchietti]

I propose also to add failed authentication attempts:

• this will ease the troubleshooting for the support team
• new entry can be used to improve crowdsec filter

[DavidePrincipi]

In Testing, core 3.12.1-dev.1 3.12.1-dev.2

Test case

Cluster-admin login attempts are recorded with Loki label category="security" . Check them with:

logcli query -q --no-labels '{category="security"} | json | line_format "{{.MESSAGE}}" |= "[AUTH]" '

If the system has Cloud Log Manager enabled, events are sent to CLM.

[Sempronto]

Test QA: with core 3.12.1-dev.2 cluster-admin login (ok and failed) are regularly recorded and sent to CLM (if enabled).