服務(wù)器記錄命令

實(shí)現(xiàn)該功能要求如下:
1.接受審計(jì)的登錄用戶(hù)默認(rèn)shell必須為bash
2.bash版本至少3.00或以上

需要該要求的原因是實(shí)現(xiàn)功能的方法需要用到history命令的HISTTIMEFORMAT變量和PROMPT_COMMAND變量.
對(duì)于其他的shell我并未測(cè)試.如果其他shell可以實(shí)現(xiàn)這兩個(gè)變量的功能那么理論上也可以使用.

實(shí)現(xiàn)方法如下:
使用root用戶(hù) 操作

1.創(chuàng)建一個(gè)審計(jì)日志文件 
mkdir /var/log/shell_audit
touch /var/log/shell_audit/audit.log
2.將日志文件所有者賦予一個(gè)最低權(quán)限的用戶(hù)  
chown nobody:nobody /var/log/shell_audit/audit.log
3.給該日志文件賦予所有人的寫(xiě)權(quán)限  
chmod 002 /var/log/shell_audit/audit.log
4.設(shè)置文件權(quán)限,使所有用戶(hù)對(duì)該文件只有追加權(quán)限  
chattr +a /var/log/shell_audit/audit.log

5.編輯/etc/profile
在末尾添加下面內(nèi)容
HISTSIZE=2048
HISTTIMEFORMAT="%Y/%m/%d %T   ";export HISTTIMEFORMAT
export HISTORY_FILE=/var/log/shell_audit/audit.log
export PROMPT_COMMAND='{ code=$?;thisHistID=`history 1|awk "{print \\$1}"`;lastCommand=`history 1| awk "{\\$1=\"\" ;print}"`;user=`id -un`;whoStr=(`who -u am i`);realUser=${whoStr[0]};logDay=${whoStr[2]};logTime=${whoStr[3]};pid=${whoStr[5]};ip=${whoStr[6]};if [ ${thisHistID}x != ${lastHistID}x ];then echo -E `date "+%Y/%m/%d %H:%M:%S"` $user\($realUser\)@$ip[PID:$pid][LOGIN:$logDay $logTime] --- [$PWD]$lastCommand [$code];lastHistID=$thisHistID;fi; } >> $HISTORY_FILE' 
 

重新登錄后,即可看到/var/log/shell_audit/audit.log刷新的實(shí)時(shí)日志
2017/07/08 16:12:00 root(root)@(192.168.77.1)[PID:127876][LOGIN:2017-07-08 15:55] --- [/root] 2017/07/08 16:12:00 whoami [0]
2017/07/08 16:17:41 root(root)@(192.168.77.1)[PID:127876][LOGIN:2017-07-08 15:55] --- [/root] 2017/07/08 16:17:41 logrotate -vf /etc/logrotate.d/shell_audit [0]
2017/07/08 16:19:18 root(root)@(192.168.77.1)[PID:127876][LOGIN:2017-07-08 15:55] --- [/root] 2017/07/08 16:19:17 last [0]
2017/07/08 16:19:19 root(root)@(192.168.77.1)[PID:127876][LOGIN:2017-07-08 15:55] --- [/root] 2017/07/08 16:19:19 list [127]
2017/07/08 16:19:21 root(root)@(192.168.77.1)[PID:127876][LOGIN:2017-07-08 15:55] --- [/root] 2017/07/08 16:19:21 what [127]
2017/07/08 16:19:32 root(root)@(192.168.77.1)[PID:127876][LOGIN:2017-07-08 15:55] --- [/root] 2017/07/08 16:19:29 top [0]
2017/07/08 16:19:35 root(root)@(192.168.77.1)[PID:127876][LOGIN:2017-07-08 15:55] --- [/root] 2017/07/08 16:19:35 ps aux [0]


2017/07/08 16:12:00 記錄時(shí)間/命令執(zhí)行完成時(shí)間
root(root)  執(zhí)行命令的用戶(hù)(最初登錄的用戶(hù)) 
@(192.168.77.1) 登錄的IP
[PID:127876]    最初登錄時(shí)的LOGIN產(chǎn)生的PID
[LOGIN:2017-07-08 15:55]    命令執(zhí)行開(kāi)始的時(shí)間
[/root] 命令執(zhí)行的當(dāng)前目錄
2017/07/08 16:12:00 命令執(zhí)行開(kāi)始的時(shí)間
whoami  執(zhí)行的命令
[0] 命令返回的狀態(tài)碼

6. 設(shè)置audit.log的日志輪換
~]# cat /etc/logrotate.d/shell_audit 
/var/log/shell_audit/audit.log { 
    weekly  
    missingok 
    dateext 
    rotate 100
    sharedscripts 
    prerotate 
    /usr/bin/chattr -a /var/log/shell_audit/audit.log 
    endscript 
    sharedscripts 
    postrotate 
      /bin/touch /var/log/shell_audit/audit.log
      /bin/chmod 002 /var/log/shell_audit/audit.log
      /bin/chown nobody:nobody /var/log/shell_audit/audit.log
      /usr/bin/chattr +a /var/log/shell_audit/audit.log
    endscript 
}

可以測(cè)試一下缔恳！剛跑過(guò)了一次。
~]# logrotate -vf /etc/logrotate.d/shell_audit 
reading config file /etc/logrotate.d/shell_audit
reading config info for /var/log/shell_audit/audit.log 

Handling 1 logs

rotating pattern: /var/log/shell_audit/audit.log  forced from command line (100 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/shell_audit/audit.log
  log needs rotating
rotating log /var/log/shell_audit/audit.log, log->rotateCount is 100
dateext suffix '-20170708'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
glob finding old rotated logs failed
running prerotate script
renaming /var/log/shell_audit/audit.log to /var/log/shell_audit/audit.log-20170708
running postrotate script

客戶(hù)端記錄日志

我們?cè)谑褂脁shell的時(shí)候，可以設(shè)置日志記錄比勉。

image.png

重新連接琐馆，在xshell窗口輸入命令逃顶，該該窗口的所有信息都會(huì)記錄到日志文件中搞挣。

image.png