Tracking your Github Security Events

Some examples of event names: user.login, user.lockout, user.failed_login, repo.create, repo.add_member, oauth_access.create, public_key.create. As you can see, it’s a lot of interesting stuff to keep an eye on! GitHub has an API but it does not seem to support the security logs. If you have many repositories and developers, it is interesting to control who did what (as usual) also to control suspicious activity with your account.

GitHub has an API but unfortunately, they don’t provide access to your logs like Amazon does with CloudTrail. To automatically download events created under my account, I created a small Python script called “getgithublog.py” which connects to the website and download the new events. By default, events are dumped to STDOUT in “name:value” pairs for easy parsing. It’s possible to generate Syslog events using the “-S” switch:

$ ./getgithublog.py -h
Usage: getgithublog.py [options]

Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit
  -u GITHUBUSER, --user=GITHUBUSER
                        github.com user name
  -p GITHUBPASS, --password=GITHUBPASS
                        github.com password
  -s STATUSFILE, --statusfile=STATUSFILE
                        status file for event history
  -S SYSLOGSERVER, --syslog=SYSLOGSERVER
                        send Syslog messages to specified server
  -d, --debug           increase verbosity

$ ./getgithublog.py -u 'xxx' -p 'xxx' -d -s .github.status -S localhost
+++ Debug mode
+++ Sending Syslog events to localhost
+++ Using status file: .github.status
+++ Connecting to github.com
+++ Authentication successful, collecing security logs
+++ Last event epoch: 1385450685

$ grep github /var/log/syslog
Nov 27 09:37:46 h0neyp0t ./getgithublog.py[12710]: "event":"user.login","actor":"xxx","actor_ip":"x.x.x.x","created_at":"2013-11-27 00:35:47","note":"From GitHub.com","user":"xxx"

Once the events stored locally, use your best log management tool to process them! Using the web interface to extract data has some caveats:

• I tried to extract the events based on safe elements in the returned HTML code. However, the script may become broken if GitHub decides to change the layout of the page.
• The scripts requires credentials. Use it carefully, take care of cron jobs or shell scripts
• The script starts a regular session with your account. This means that every time you execute the script, you create a new “user.login” event.
• Don’t run the script too often, GitHub has a protection against multiple repetitive logins and will lock you during a few minutes.
• Timestamps are returned based on the Pacific Time (UTC-8).

Happy logging! The script is available here.