Linux 系统添加操作记录审计
Linux 系统添加操作记录审计
老七Linux
发布于 2018-05-09 16:50:50
发布于 2018-05-09 16:50:50
有时候我们需要对线上用户操作记录进行历史记录待出现问题追究责任人，但Linux系统自带的history命令用户有自行删除权限，那怎么设置可以让用户的操作记录实时记录，并保证普通用户无权删除呢？
一般小型架构添加这个足够了，如果中大型的架构建议使用 jumpserver
- 创建记录目录
mkdir -p /usr/local/domob/records/
chmod 777 /usr/local/domob/records/
chmod +t /usr/local/domob/records/+t：防删除
- vi /etc/profile 在最后添加下面的代码
if [ ! -d /usr/local/domob/records/${LOGNAME} ]
then
mkdir -p /usr/local/domob/records/${LOGNAME}
chmod 300 /usr/local/domob/records/${LOGNAME}
fi
export HISTORY_FILE="/usr/local/domob/records/${LOGNAME}/bash_history"
export PROMPT_COMMAND='{ date "+%Y-%m-%d %T ##### $(who am i |awk "{print \$1\" \"\$2\" \"\$5}") #### $(history 1 | { read x cmd; echo "$cmd"; })"; } >>$HISTORY_FILE'只有root用户才可以查看所有用户的操作记录：
[[email protected]-1 ~]# cd /usr/local/domob/records/
[[email protected]-1 records]# ls
admin root
[[email protected]-1 records]# cd admin
[[email protected]-1 admin]# ls
bash_history
[[email protected]-1 admin]# cat bash_history
2017-09-23 21:15:11 ##### admin pts/1 (192.168.15.253) #### history
2017-09-24 14:42:43 ##### admin pts/0 (192.168.14.109) #### history
2017-09-24 14:42:46 ##### admin pts/0 (192.168.14.109) #### sudo sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
2017-09-24 14:42:47 ##### admin pts/0 (192.168.14.109) #### sudo setenforce 0
2017-09-24 14:48:33 ##### admin pts/0 (192.168.14.109) #### sudo setenforce 0
2017-09-25 14:25:59 ##### admin pts/0 (192.168.15.253) #### sudo systemctl stop firewalld
2017-09-25 14:26:16 ##### admin pts/0 (192.168.15.253) #### w
2017-09-25 14:27:27 ##### admin pts/0 (192.168.15.253) #### history
2017-09-25 14:27:46 ##### admin pts/0 (192.168.15.253) #### sudo systemctl disable firewalld
2017-09-25 14:27:56 ##### admin pts/0 (192.168.15.253) #### netstat -lntp
2017-09-25 14:35:15 ##### admin pts/0 (192.168.15.253) #### cd /usr/local/nginx/sbin
2017-09-25 14:35:17 ##### admin pts/0 (192.168.15.253) #### ls
2017-09-25 14:35:22 ##### admin pts/0 (192.168.15.253) #### cd nginx
2017-09-25 14:35:24 ##### admin pts/0 (192.168.15.253) #### cd
2017-09-25 14:35:49 ##### admin pts/0 (192.168.15.253) #### find / -name "*vhost"
2017-09-25 14:36:05 ##### admin pts/0 (192.168.15.253) #### sudo find / -name "vhost"
2017-09-25 14:36:15 ##### admin pts/0 (192.168.15.253) #### cd /usr/local/nginx/conf/vhost/本文参与 腾讯云自媒体分享计划，分享自作者个人站点/博客。
原始发表：2016/09/25，如有侵权请联系 cloudcommunity@tencent.com 删除
评论
登录后参与评论
推荐阅读