Linux日志取证

[root@master bash-5.0]$history
422  2019-08-02 17:03:43 192.168.1.88 root # history

[root@master bash-5.0]$w
16:01:52 up  1:11,  1 user,  load average: 0.00, 0.01, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    192.168.1.88    14:53    0.00s  0.31s  0.00s w


[root@master bash-5.0]$last
root     pts/0        192.168.1.88    Fri Aug  2 14:53   still logged in
reboot   system boot  3.10.0-957.12.2. Fri Aug  2 14:51 - 16:01  (01:10)
root     pts/1        192.168.1.88    Fri Aug  2 14:43 - down   (00:06)

#lsof方法
lsof -i:22 | grep EST
sshd    5923 root    3u  IPv4  32629      0t0  TCP master:ssh->192.168.1.88:53505 (ESTABLISHED)
sshd    5925 root    3u  IPv4  32692      0t0  TCP master:ssh->192.168.1.88:53506 (ESTABLISHED)

#ps方法
ps aux | grep "notty"
root      5925  0.0  0.3 161456  6296 ?        Ss   14:53   0:00 sshd: root@notty

#netstat方法
netstat -atlnp | grep "sshd"
tcp        0      0 10.10.107.222:22        192.168.1.88:53506     ESTABLISHED 5925/sshd: root@not
tcp        0     48 10.10.107.222:22        192.168.1.88:53505     ESTABLISHED 5923/sshd: root@pts

#通过分析/var/log/secure 日志有的系统是/var/log/auth.log
从 Accepted publickey for root from 192.168.12.54 一行可以得出ssh的登录时间 #Disconnect
从 Disconnected from 192.168.12.54 port 43000 一行可以得出ssh的退出时间

#通过openssh后门功能中会记录正常用户登录账号密码，因此猜测会用到open系统调用
strace –o ssh –ff–p pid  #用strace跟踪sshd打开的系统调用，然后过滤open，就应该能获取到记录密码的文件及路径。