linux 用户行为审计
在/etc/profile文件下添加如下shell即可(注意文件的权限问题!!)if ! test -z"$BASH_EXECUTION_STRING" ; thenecho "===== $(date "+%F%T") $USER nologin cmd:$BASH_EXECUTION_STRING" >>/var/log/command.logel
·
在/etc/profile文件下添加如下shell即可(注意文件的权限问题!!)
if ! test -z "$BASH_EXECUTION_STRING" ; then
echo "===== $(date "+%F %T") $USER nologin cmd: $BASH_EXECUTION_STRING" >>/var/log/command.log
elif shopt -q login_shell ; then
printf "====== $(date "+%F %T") new login the last cmd: ">>/var/log/command.log
else
printf "====== $(date "+%F %T") su the last cmd: ">>/var/log/command.log
fi
export HISTTIMEFORMAT="%F %T $USER ${SSH_TTY:5} ${SSH_CLIENT%% *} "
export PROMPT_COMMAND="history 1|tail -1|sed 's/^[ ]\+[0-9]\+ //'>> /var/log/command.log"
所有命令会被记录在/var/log/command.log可以查看。
更多推荐
已为社区贡献1条内容
所有评论(0)