sudo+syslog日志审计+登陆用户操作统计
内容导读
互联网集市收集整理的这篇技术教程文章主要介绍了sudo+syslog日志审计+登陆用户操作统计，小编现在分享给大家，供广大互联网技能从业者学习和参考。文章包含4705字，纯文字阅读大概需要7分钟。
内容图文
１、查询系统是否已安装sudo、syslog程序
[root@shangke ~]# rpm -qa|egrep "sudo|syslog" rsyslog-5.8.10-10.el6_6.x86_64 sudo-1.8.6p3-19.el6.x86_64 如果没有安装，则用yum安装，yum install -y sudo syslog
2、配置/etc/sudoers
增加配置“Defaults logfile=/var/log/sudo.log”到/etc/sudoers中
[root@shangke ~]# echo "Defaults logfile=/var/log/sudo.log" >>/etc/sudoers [root@shangke ~]# tail -1 /etc/sudoers ##检查操作是否成功 Defaults logfile=/var/log/sudo.log [root@shangke ~]# visudo -c ##检查sudoers文件语法 /etc/sudoers: parsed OK
3、配置系统日志
增加配置local2.debug到/etc/syslog.conf中（Centos5.8中）
增加配置local2.debug到/etc/rsyslog.conf中（Centos6.4中）
[root@shangke ~]# echo "local2.debug /var/log/sudo.log" >>/etc/rsyslog.conf [root@shangke ~]# tail -1 /etc/rsyslog.conf ##检查配置 local2.debug /var/log/sudo.log
4、重启syslog或rsyslog内核日志记录器
[root@shangke ~]# /etc/init.d/rsyslog restart Shutting down system logger: [ OK ] Starting system logger: [ OK ]
5、查看日志目录的权限
[root@shangke ~]# ll /var/log/sudo.log -rw------- 1 root root 1148 Jan 31 16:05 /var/log/sudo.log
6、测试sudo日志审计配置结果
[root@shangke ~]# whoami root [root@shangke ~]# pwd /root [root@shangke ~]# useradd mzq [root@shangke ~]# su - mzq [mzq@shangke ~]$ sudo -l Matching Defaults entries for mzq on this host: requiretty, !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin, logfile=/var/log/sudo.log User mzq may run the following commands on this host: (ALL) NOPASSWD: /bin/su, (ALL) /usr/bin/sudo, (ALL) ALL [mzq@shangke ~]$ su - Password: [root@shangke ~]# cat /var/log/sudo.log Jan 31 16:05:27 : mzq : TTY=pts/0 ; PWD=/home/mzq ; USER=root ; COMMAND=/bin/cat /var/log/sudo.log Jan 31 16:24:11 : mzq : TTY=pts/0 ; PWD=/home/mzq ; USER=root ; COMMAND=list Jan 31 16:25:09 : mzq : TTY=pts/0 ; PWD=/home/mzq ; USER=root ; COMMAND=/bin/cat /var/log/sudo.log
7
、记录登录用户的数据
/var/log/useraudit.log文件记录登录用户的时间，来源IP，以及在系统中运行了什么命令。
[root@shangke ~]# vim /etc/profile
在最后添加下面内容：export HISTORY_FILE=/var/log/useraudit.logexport PROMPT_COMMAND=‘{ h=`history 1`;w=`who am i`;echo -e $(date "+%Y-%m-%d %H:%M:%S") --- $w ---$h;} >> $HISTORY_FILE‘然后执行命令：
[root@shangke ~]# touch /var/log/useraudit.log
[root@shangke ~]# chmod 777 /var/log/useraudit.log
[root@shangke ~]# chattr +a /var/log/useraudit.log
[root@shangke ~]# cat /var/log/useraudit.log
2016-01-31 16:30:16 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 15 su -
2016-01-31 16:30:18 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 16 ls
2016-01-31 16:30:22 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 17 sudo ls
2016-01-31 16:30:34 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 18 cat /var/log/sudo.log
2016-01-31 16:30:46 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 19 sudo cat /var/log/so
2016-01-31 16:30:50 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 20 sudo cat /var/log/sudo.log
2016-01-31 16:31:09 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 21 rm -f oldboy1
2016-01-31 16:31:12 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 22 sudo cat /var/log/sudo.log
2016-01-31 16:32:04 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 23 sodu cat /var/log/useraudit.log
2016-01-31 16:32:41 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 24 cd /var/log/
2016-01-31 16:32:43 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 25 ls
2016-01-31 16:33:05 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 25 ls
2016-01-31 16:33:08 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 26 cd
2016-01-31 16:33:10 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 27 ls
2016-01-31 16:33:18 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 28 rm -f oldboy2
2016-01-31 16:33:23 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 141 su - mzq
2016-01-31 16:33:40 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 142 cat /var/log/sudo.log
2016-01-31 16:33:54 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 143 cat /var/log/sudo.log|grep rm
2016-01-31 16:34:01 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 144 cat /var/log/sudo.log|grep rm -f
2016-01-31 16:34:10 --- root pts/0 2016-01-31 16:21 (10.0.0.1) --- 145 cat /var/log/sudo.log|grep "rm -f"
8、日志集中管理
1）rsync+inotify或定时任务+rsync,推到日志管理服务器上，IP_date.sudo.log
2)syslog服务来处理
[root@shangke ~]#echo "IP logserver">>/etc/hosts #日志服务器地址 [root@shangke ~]#echo "*.info @logserver">>/etc/syslog.conf<<====适合所有日志推走
3）日志收集解决方案scribe、Flume、logstash、stom
本文出自 “yunwei” 博客，转载请与作者联系！
原文：http://tiantianlele.blog.51cto.com/10811177/1740195
内容总结
以上是互联网集市为您收集整理的sudo+syslog日志审计+登陆用户操作统计全部内容，希望文章能够帮你解决sudo+syslog日志审计+登陆用户操作统计所遇到的程序开发问题。 如果觉得互联网集市技术教程内容还不错，欢迎将互联网集市网站推荐给程序员好友。
内容备注
版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 gblab@vip.qq.com 举报，一经查实，本站将立刻删除。
内容手机端
扫描二维码推送至手机访问。