Log security related events like password reset, 2FA method added, etc.

src/EventSubscriber/SecurityEventLoggerSubscriber.php

@@ -0,0 +1,126 @@
+<?php
+/**
+ * This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
+ *
+ * Copyright (C) 2019 - 2020 Jan Böhmer (https://github.com/jbtronics)
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+namespace App\EventSubscriber;
+
+
+use App\Entity\LogSystem\SecurityEventLogEntry;
+use App\Events\SecurityEvent;
+use App\Events\SecurityEvents;
+use App\Services\LogSystem\EventLogger;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\RequestStack;
+
+final class SecurityEventLoggerSubscriber implements EventSubscriberInterface
+{
+
+    private $requestStack;
+    private $gpdr_compliant;
+    private $eventLogger;
+
+    public function __construct(RequestStack $requestStack, EventLogger $eventLogger, bool $gpdr_compliance)
+    {
+        $this->requestStack = $requestStack;
+        $this->gpdr_compliant = $gpdr_compliance;
+        $this->eventLogger = $eventLogger;
+    }
+
+    protected function addLog(string $type, SecurityEvent $event): void
+    {
+        $anonymize = $this->gpdr_compliant;
+
+        $request = $this->requestStack->getCurrentRequest();
+        if ($request !== null) {
+            $ip = $request->getClientIp() ?? 'unknown';
+        } else {
+            $ip = "Console";
+            //Dont try to apply IP filter rules to non numeric string
+            $anonymize = false;
+        }
+
+        $log = new SecurityEventLogEntry($type, $ip, $anonymize);
+        $log->setTargetElement($event->getTargetUser());
+        $this->eventLogger->logAndFlush($log);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public static function getSubscribedEvents()
+    {
+        return [
+            SecurityEvents::U2F_ADDED => 'u2f_added',
+            SecurityEvents::PASSWORD_CHANGED => 'password_changed',
+            SecurityEvents::TRUSTED_DEVICE_RESET => 'trusted_device_reset',
+            SecurityEvents::U2F_REMOVED => 'u2f_removed',
+            SecurityEvents::BACKUP_KEYS_RESET => 'backup_keys_reset',
+            SecurityEvents::PASSWORD_RESET => 'password_reset',
+            SecurityEvents::GOOGLE_DISABLED => 'google_disabled',
+            SecurityEvents::GOOGLE_ENABLED => 'google_enabled',
+            SecurityEvents::TFA_ADMIN_RESET => 'tfa_admin_reset',
+        ];
+    }
+
+    public function tfa_admin_reset(SecurityEvent $event): void
+    {
+        $this->addLog(SecurityEvents::TFA_ADMIN_RESET, $event);
+    }
+
+    public function google_enabled(SecurityEvent $event): void
+    {
+        $this->addLog(SecurityEvents::GOOGLE_ENABLED, $event);
+    }
+
+    public function google_disabled(SecurityEvent $event): void
+    {
+        $this->addLog(SecurityEvents::GOOGLE_DISABLED, $event);
+    }
+
+    public function password_reset(SecurityEvent $event): void
+    {
+        $this->addLog(SecurityEvents::PASSWORD_RESET, $event);
+    }
+
+    public function backup_keys_reset(SecurityEvent $event): void
+    {
+        $this->addLog(SecurityEvents::BACKUP_KEYS_RESET, $event);
+    }
+
+    public function u2f_removed(SecurityEvent $event): void
+    {
+        $this->addLog(SecurityEvents::U2F_REMOVED, $event);
+    }
+
+    public function u2f_added(SecurityEvent $event): void
+    {
+        $this->addLog(SecurityEvents::U2F_ADDED, $event);
+    }
+
+    public function password_changed(SecurityEvent $event): void
+    {
+        $this->addLog(SecurityEvents::PASSWORD_CHANGED, $event);
+    }
+
+    public function trusted_device_reset(SecurityEvent $event): void
+    {
+        $this->addLog(SecurityEvents::TRUSTED_DEVICE_RESET, $event);
+    }
+}

src/EventSubscriber/U2FRegistrationSubscriber.php

@@ -44,12 +44,16 @@ namespace App\EventSubscriber;
 
 use App\Entity\UserSystem\U2FKey;
 use App\Entity\UserSystem\User;
+use App\Events\SecurityEvent;
+use App\Events\SecurityEvents;
 use Doctrine\ORM\EntityManagerInterface;
 use R\U2FTwoFactorBundle\Event\RegisterEvent;
+use Symfony\Component\EventDispatcher\EventDispatcher;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Session\Flash\FlashBagInterface;
 use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
 
 final class U2FRegistrationSubscriber implements EventSubscriberInterface
 {
@@ -62,12 +66,16 @@ final class U2FRegistrationSubscriber implements EventSubscriberInterface
      */
     private $router;
 
-    public function __construct(UrlGeneratorInterface $router, EntityManagerInterface $entityManager, FlashBagInterface $flashBag, bool $demo_mode)
+    /** @var EventDispatcher */
+    private $eventDispatcher;
+
+    public function __construct(UrlGeneratorInterface $router, EntityManagerInterface $entityManager, FlashBagInterface $flashBag, EventDispatcherInterface $eventDispatcher, bool $demo_mode)
     {
         $this->router = $router;
         $this->em = $entityManager;
         $this->demo_mode = $demo_mode;
         $this->flashBag = $flashBag;
+        $this->eventDispatcher = $eventDispatcher;
     }
 
     public static function getSubscribedEvents(): array
@@ -96,6 +104,9 @@ final class U2FRegistrationSubscriber implements EventSubscriberInterface
             $this->em->persist($newKey);
             $this->em->flush();
             $this->flashBag->add('success', 'tfa_u2f.key_added_successful');
+
+            $security_event = new SecurityEvent($user);
+            $this->eventDispatcher->dispatch($security_event, SecurityEvents::U2F_ADDED);
         }
 
         // generate new response, here we redirect the user to the fos user