diff -up openssh-5.8p1/audit-linux.c.audit1a openssh-5.8p1/audit-linux.c

--- openssh-5.8p1/audit-linux.c.audit1a	2011-02-21 18:14:37.000000000 +0100

+++ openssh-5.8p1/audit-linux.c	2011-02-21 18:17:33.000000000 +0100

@@ -35,13 +35,20 @@

 #include "log.h"

 #include "audit.h"

+#include "key.h"

+#include "hostfile.h"

+#include "auth.h"

+#include "servconf.h"

 #include "canohost.h"

+extern ServerOptions options;

+extern Authctxt *the_authctxt;

+extern u_int utmp_len;

 const char* audit_username(void);

 static void

-linux_audit_user_login(int uid, const char *username,

-    const char *hostname, const char *ip, const char *ttyn, int success)

+linux_audit_user_logxxx(int uid, const char *username,

+    const char *hostname, const char *ip, const char *ttyn, int success, int event)

 {

 	int audit_fd, rc, saved_errno;

@@ -53,7 +60,7 @@ linux_audit_user_login(int uid, const ch

 		else

 			goto fatal_report; /* Must prevent login */

 	}

-	rc = audit_log_acct_message(audit_fd, AUDIT_USER_LOGIN,

+	rc = audit_log_acct_message(audit_fd, event,

 	    NULL, "login", username ? username : "(unknown)",

 	    username == NULL ? uid : -1, hostname, ip, ttyn, success);

 	saved_errno = errno;

@@ -77,19 +84,19 @@ linux_audit_user_auth(int uid, const cha

 {

 	int audit_fd, rc, saved_errno;

 	static const char *event_name[] = {

-		"exceed maxtries",

+		"maxtries exceeded",

 		"root denied",

 		"success",

 		"none",

-		"pasword",

-		"chalenge-response",

+		"password",

+		"challenge-response",

 		"pubkey",

 		"hostbased",

 		"gssapi",

 		"invalid user",

 		"nologin",

-		"connection close",

-		"connection abandon",

+		"connection closed",

+		"connection abandoned",

 		"unknown"

 	};

@@ -123,6 +130,8 @@ fatal_report:

 	}

 }

+static int user_login_count = 0;

+

 /* Below is the sshd audit API code */

 void

@@ -134,20 +143,31 @@ audit_connection_from(const char *host, 

 void

 audit_run_command(const char *command)

 {

-	/* not implemented */

+	linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

+	    NULL, "ssh", 1, AUDIT_USER_START);

+	if (!user_login_count++) 

+		linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),

+		    NULL, "ssh", 1, AUDIT_USER_LOGIN);

 }

 void

 audit_session_open(struct logininfo *li)

 {

-	linux_audit_user_login(li->uid, NULL, li->hostname,

-	    NULL, li->line, 1);

+	linux_audit_user_logxxx(li->uid, NULL, li->hostname,

+	    NULL, li->line, 1, AUDIT_USER_START);

+	if (!user_login_count++) 

+		linux_audit_user_logxxx(li->uid, NULL, li->hostname,

+		    NULL, li->line, 1, AUDIT_USER_LOGIN);

 }

 void

 audit_session_close(struct logininfo *li)

 {

-	/* not implemented */

+	linux_audit_user_logxxx(li->uid, NULL, li->hostname,

+	    NULL, li->line, 1, AUDIT_USER_END);

+	if (!--user_login_count) 

+		linux_audit_user_logxxx(li->uid, NULL, li->hostname,

+		    NULL, li->line, 1, AUDIT_USER_LOGOUT);

 }

 void

@@ -163,8 +183,8 @@ audit_event(ssh_audit_event_t event)

 	case SSH_LOGIN_ROOT_DENIED:

 		linux_audit_user_auth(-1, audit_username(), NULL,

 			get_remote_ipaddr(), "sshd", 0, event);

-		linux_audit_user_login(-1, audit_username(), NULL,

-			get_remote_ipaddr(), "sshd", 0);

+		linux_audit_user_logxxx(-1, audit_username(), NULL,

+			get_remote_ipaddr(), "sshd", 0, AUDIT_USER_LOGIN);

 		break;

 	case SSH_LOGIN_EXCEED_MAXTRIES:

@@ -181,8 +201,8 @@ audit_event(ssh_audit_event_t event)

 	case SSH_CONNECTION_CLOSE:

 	case SSH_CONNECTION_ABANDON:

 	case SSH_INVALID_USER:

-		linux_audit_user_login(-1, audit_username(), NULL,

-			get_remote_ipaddr(), "sshd", 0);

+		linux_audit_user_logxxx(-1, audit_username(), NULL,

+			get_remote_ipaddr(), "sshd", 0, AUDIT_USER_LOGIN);

 		break;

 	default: