linux安全之歷史命令追蹤
阿新 • • 發佈：2018-12-14
修改配置檔案檢視任何登入主機的使用者在任何時間執行的任何命令
一 為history 命令新增日期時間顯示
[[email protected] ~]# vim /etc/bashrc
HISTTIMEFORMAT="%Y-%m-%d:%H-%M-%S:`whoami`: "
export HISTTIMEFORMAT
//加入這兩行
二 腳步記錄所有使用者登陸伺服器上的所有操作命令
[[email protected] ~]# vim /etc/profile //配置檔案最下方加入以下程式碼 history USER=`whoami` USER_IP=`who -u am i 2>/dev/null| awk '{print $NF}'|sed -e 's/[()]//g'` if [ "$USER_IP" = "" ]; then USER_IP=`hostname` fi if [ ! -d /var/log/history ]; then mkdir /var/log/history chmod 777 /var/log/history fi if [ ! -d /var/log/history/${LOGNAME} ]; then mkdir /var/log/history/${LOGNAME} chmod 300 /var/log/history/${LOGNAME} fi export HISTSIZE=4096 DT=`date +"%Y%m%d_%H:%M:%S"` export HISTFILE="/var/log/history/${LOGNAME}/${USER}@${USER_IP}_$DT" chmod 600 /var/log/history/${LOGNAME}/*history* 2>/dev/null
三 過載使配置檔案立刻生效
[[email protected] ~]# source /etc/bashrc
[[email protected] ~]# source /etc/profile
四 檢視歷史命令記錄
[[email protected] ~]# history 1 2018-12-08:10-34-15:root: systemctl set-default multi-user.target 2 2018-12-08:10-34-15:root: systemctl stop firewalld.service 3 2018-12-08:10-34-15:root: systemctl disable firewalld.service 4 2018-12-08:10-34-15:root: vim /etc/selinux/config 5 2018-12-08:10-34-15:root: grubby --update-kernel=ALL --args="console=ttyS0" 6 2018-12-08:10-34-15:root: reboot 7 2018-12-08:10-34-15:root: nmcli connection modify eth0 ipv4.method manual ipv4.addresses 192.168.4.44/24 connection.autoconnect yes 8 2018-12-08:10-34-15:root: nmcli connection up eth0 9 2018-12-08:10-34-15:root: hostnamectl set-hostname web44 10 2018-12-08:10-34-15:root: exit