#1064 pyscg ensure 06_logging has an rfc compliant audit log example

[BartKaras1128]

Added 2 new code examples for auditing a failed authentication attempt, and I added a section to the README explaining it for pyscg-0020

[myteron]

suggested an alternative compliant02.py cod example

[myteron]

@BartKaras1128
rule still has the old title, see new one pyscg-0020: Implement Informative Event Logging

looks like you started out from an outdated branch?

[myteron]

Here a code example that is a little closer to the rfc with timestamps and such but still missing some stuff added as TODO.

Suggested change

	import logging
	logging.basicConfig(
	format="%(asctime)s %(levelname)s event=%(message)s",
	datefmt="%Y-%m-%dT%H:%M:%S",
	level=logging.INFO,
	)
	_audit = logging.getLogger("audit")
	def login(username: str, password: str) -> bool:
	"""Authenticate user with audit logging"""
	# TODO: use a proper credential store
	if username == "admin" and password == "s3cr3t":
	_audit.info("login_success user=%s", username)
	return True
	_audit.warning("login_failed user=%s", username)
	# TODO: forward logs to a remote logging service in production
	return False
	# SPDX-FileCopyrightText: OpenSSF project contributors
	# SPDX-License-Identifier: MIT
	"""Compliant Code Example"""
	import json
	import logging
	from datetime import datetime, timezone
	logging.basicConfig(format="%(message)s", level=logging.INFO)
	def audit_log(event: str, user: str, outcome: str) -> None:
	"""Write a simple audit log entry in JSON format"""
	# TODO: add hostname, app_name, proc_id per RFC 5424
	# TODO: forward logs to a remote logging service
	# TODO: sanitize user input to prevent log injection, see pyscg-0022
	entry = {
	"timestamp": datetime.now(timezone.utc).isoformat(timespec="milliseconds"),
	"event": event,
	"user": user,
	"outcome": outcome,
	}
	logging.info("%s", json.dumps(entry))
	def login(username: str, password: str) -> bool:
	"""Authenticate user with audit logging"""
	# TODO: use a proper credential store, see pyscg-0041
	if username == "admin" and password == "s3cr3t":
	audit_log("login", username, "success")
	return True
	audit_log("login", username, "failure")
	return False
	#####################
	# Trying to exploit above code example
	#####################
	login("admin", "wrong_password")
	login("admin", "password123!")
	login("admin", "s3cr3t")

[myteron]

In case you do adapt the code then we will have to explain why we use json instead of strictly following the rfc. Here a draft for that explanation:

RFC 5424 defines the standard transport for system logs without JSON. This guide recommends using structured JSON payloads to ensure logs are machine-readable for automated security analysis instead plain-text as defined in RFC 5424 as supported by:

• OWASP Logging Vocabulary
• Python.org Logging Cookbook
• Google Structured Logging