{"action":"closed","issue":{"url":"https://api.github.com/repos/johnnykv/heralding/issues/75","repository_url":"https://api.github.com/repos/johnnykv/heralding","labels_url":"https://api.github.com/repos/johnnykv/heralding/issues/75/labels{/name}","comments_url":"https://api.github.com/repos/johnnykv/heralding/issues/75/comments","events_url":"https://api.github.com/repos/johnnykv/heralding/issues/75/events","html_url":"https://github.com/johnnykv/heralding/issues/75","id":300758334,"number":75,"title":"Logging issue - auth_type","user":{"login":"dwasss","id":20582676,"avatar_url":"https://avatars0.githubusercontent.com/u/20582676?v=4","gravatar_id":"","url":"https://api.github.com/users/dwasss","html_url":"https://github.com/dwasss","followers_url":"https://api.github.com/users/dwasss/followers","following_url":"https://api.github.com/users/dwasss/following{/other_user}","gists_url":"https://api.github.com/users/dwasss/gists{/gist_id}","starred_url":"https://api.github.com/users/dwasss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dwasss/subscriptions","organizations_url":"https://api.github.com/users/dwasss/orgs","repos_url":"https://api.github.com/users/dwasss/repos","events_url":"https://api.github.com/users/dwasss/events{/privacy}","received_events_url":"https://api.github.com/users/dwasss/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-02-27T19:17:49Z","updated_at":"2018-02-28T15:16:57Z","closed_at":"2018-02-28T15:16:57Z","author_association":"CONTRIBUTOR","body":"The `auth_type` field as documented in the readme is actually not implemented. It is supposed to be logged in log_auth.csv according to the readme, but that only has the following fields: `timestamp,auth_id,session_id,source_ip,source_port,destination_ip,destination_port,protocol,username,password`.\r\n\r\n> log_auth.csv\r\n>\r\n>This log file contains information for all authentication attempts where it was possible to log a username and plaintext password. Log entries will appear in this file as soon as the password has been transmitted.\r\n>\r\n>$ tail log_auth.csv >timestamp,auth_id,auth_type,session_id,source_ip,source_port,destination_port,protocol,username,password 2016-03-12 20:35:02.258198,192.168.2.129,51551,23,telnet,bond,james 2016-03-12 "}}
{"actor":{"display_login":"johnnykv"}}