diff -up openssh-5.8p1/audit-bsm.c.audit3a openssh-5.8p1/audit-bsm.c

--- openssh-5.8p1/audit-bsm.c.audit3a	2011-02-21 18:29:45.000000000 +0100

+++ openssh-5.8p1/audit-bsm.c	2011-02-21 18:29:45.000000000 +0100

@@ -391,7 +391,7 @@ audit_unsupported_body(int what)

 }

 void

-audit_kex_body(int ctos, char *enc, char *mac, char *compress)

+audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid, uid_t uid)

 {

 	/* not implemented */

 }

diff -up openssh-5.8p1/audit.c.audit3a openssh-5.8p1/audit.c

--- openssh-5.8p1/audit.c.audit3a	2011-02-21 18:29:45.000000000 +0100

+++ openssh-5.8p1/audit.c	2011-02-21 18:29:45.000000000 +0100

@@ -28,6 +28,7 @@

 #include <stdarg.h>

 #include <string.h>

+#include <unistd.h>

 #ifdef SSH_AUDIT_EVENTS

@@ -139,7 +140,7 @@ audit_unsupported(int what)

 void

 audit_kex(int ctos, char *enc, char *mac, char *comp)

 {

-	PRIVSEP(audit_kex_body(ctos, enc, mac, comp));

+	PRIVSEP(audit_kex_body(ctos, enc, mac, comp, getpid(), getuid()));

 }

 # ifndef CUSTOM_SSH_AUDIT_EVENTS

@@ -239,10 +240,12 @@ audit_unsupported_body(int what)

  * This will be called on succesfull protocol negotiation.

  */

 void

-audit_kex_body(int ctos, char *enc, char *mac, char *compress)

+audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,

+	       uid_t uid)

 {

-	debug("audit procol negotiation euid %d direction %d cipher %s mac %s compresion %s",

-		geteuid(), ctos, enc, mac, compress);

+	debug("audit protocol negotiation euid %d direction %d cipher %s mac %s compresion %s from pid %ld uid %u",

+		(unsigned)geteuid(), ctos, enc, mac, compress, (long)pid,

+	        (unsigned)uid);

 }

 # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */

 #endif /* SSH_AUDIT_EVENTS */

diff -up openssh-5.8p1/audit.h.audit3a openssh-5.8p1/audit.h

--- openssh-5.8p1/audit.h.audit3a	2011-02-21 18:29:45.000000000 +0100

+++ openssh-5.8p1/audit.h	2011-02-21 18:29:45.000000000 +0100

@@ -59,6 +59,6 @@ void	audit_key(int, int *, const Key *);

 void	audit_unsupported(int);

 void	audit_kex(int, char *, char *, char *);

 void	audit_unsupported_body(int);

-void	audit_kex_body(int, char *, char *, char *);

+void	audit_kex_body(int, char *, char *, char *, pid_t, uid_t);

 #endif /* _SSH_AUDIT_H */

diff -up openssh-5.8p1/audit-linux.c.audit3a openssh-5.8p1/audit-linux.c

--- openssh-5.8p1/audit-linux.c.audit3a	2011-02-21 18:29:45.000000000 +0100

+++ openssh-5.8p1/audit-linux.c	2011-02-21 18:29:45.000000000 +0100

@@ -267,7 +267,8 @@ audit_unsupported_body(int what)

 }

 void

-audit_kex_body(int ctos, char *enc, char *mac, char *compress)

+audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,

+	       uid_t uid)

 {

 #ifdef AUDIT_CRYPTO_SESSION

 	char buf[AUDIT_LOG_SIZE];

@@ -275,8 +276,9 @@ audit_kex_body(int ctos, char *enc, char

 	const static char *direction[] = { "from-server", "from-client", "both" };

 	Cipher *cipher = cipher_by_name(enc);

-	snprintf(buf, sizeof(buf), "op=start direction=%s cipher=%s ksize=%d rport=%d laddr=%s lport=%d",

+	snprintf(buf, sizeof(buf), "op=start direction=%s cipher=%s ksize=%d spid=%jd suid=%jd rport=%d laddr=%s lport=%d",

 		direction[ctos], enc, cipher ? 8 * cipher->key_len : 0,

+		(intmax_t)pid, (intmax_t)uid,

 		get_remote_port(), get_local_ipaddr(packet_get_connection_in()), get_local_port());

 	audit_fd = audit_open();

 	if (audit_fd < 0) {

diff -up openssh-5.8p1/monitor.c.audit3a openssh-5.8p1/monitor.c

--- openssh-5.8p1/monitor.c.audit3a	2011-02-21 18:29:45.000000000 +0100

+++ openssh-5.8p1/monitor.c	2011-02-21 18:29:45.000000000 +0100

@@ -2239,13 +2239,17 @@ mm_answer_audit_kex_body(int sock, Buffe

 {

 	int ctos, len;

 	char *cipher, *mac, *compress;

+	pid_t pid;

+	uid_t uid;

 	ctos = buffer_get_int(m);

 	cipher = buffer_get_string(m, &len;;

 	mac = buffer_get_string(m, &len;;

 	compress = buffer_get_string(m, &len;;

+	pid = buffer_get_int64(m);

+	uid = buffer_get_int64(m);

-	audit_kex_body(ctos, cipher, mac, compress);

+	audit_kex_body(ctos, cipher, mac, compress, pid, uid);

 	buffer_clear(m);

diff -up openssh-5.8p1/monitor_wrap.c.audit3a openssh-5.8p1/monitor_wrap.c

--- openssh-5.8p1/monitor_wrap.c.audit3a	2011-02-21 18:29:45.000000000 +0100

+++ openssh-5.8p1/monitor_wrap.c	2011-02-21 18:29:45.000000000 +0100

@@ -1430,7 +1430,8 @@ mm_audit_unsupported_body(int what)

 }

 void

-mm_audit_kex_body(int ctos, char *cipher, char *mac, char *compress)

+mm_audit_kex_body(int ctos, char *cipher, char *mac, char *compress, pid_t pid,

+		  uid_t uid)

 {

 	Buffer m;

@@ -1439,6 +1440,8 @@ mm_audit_kex_body(int ctos, char *cipher

 	buffer_put_cstring(&m, cipher);

 	buffer_put_cstring(&m, mac);

 	buffer_put_cstring(&m, compress);

+	buffer_put_int64(&m, pid);

+	buffer_put_int64(&m, uid);

 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_KEX, &m);

 	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_KEX,

diff -up openssh-5.8p1/monitor_wrap.h.audit3a openssh-5.8p1/monitor_wrap.h

--- openssh-5.8p1/monitor_wrap.h.audit3a	2011-02-21 18:33:57.000000000 +0100

+++ openssh-5.8p1/monitor_wrap.h	2011-02-21 18:34:18.000000000 +0100

@@ -75,7 +75,7 @@ void mm_sshpam_free_ctx(void *);

 void mm_audit_event(ssh_audit_event_t);

 void mm_audit_run_command(const char *);

 void mm_audit_unsupported_body(int);

-void mm_audit_kex_body(int, char *, char *, char *);

+void mm_audit_kex_body(int, char *, char *, char *, pid_t, uid_t);

 #endif

 struct Session;