Linux 系统 审计 脚本

 

       这个系统审计，就是在系统级别，记录什么用户，在什么时间，做了什么操作。 然后将查到的信息记录到一个文件里。

 

 

一. 审计配置

1. 在/etc/profile 文件的最后，添加如下2行代码：

export HISTORY_FILE=/var/log/audit.log

export PROMPT_COMMAND='{ z=$(history 1 | { read x y; echo -e "$x --- $y"; });a=`who am i | awk "{print //$1/" /"//$2/" /"//$6}"`;c=`echo $z | awk "{print $1}"`;if [[ `grep "$a /-/-/- $c" $HISTORY_FILE` = "" ]];then echo -e $(date "+%Y-%m-%d_%H:%M:%S") --- $a --- $z;fi;} >> $HISTORY_FILE'

 

 

说明：

        /etc/profile: 此文件为系统的每个用户设置环境信息,当用户第一次登录时,该文件被执行.并从/etc/profile.d目录的配置文件中搜集shell的设置.

 

具体参考：

       .bash_profile 和 .bashrc 区别

http://www.cndba.cn/dave/article/670

 

这个代码其实就是把一些显示的信息导入到audit.log 文件。

>> : 追加到文件的最后

> : 覆盖原文件

 

[root@ db2 ~]# date "+%Y-%m-%d_%H:%M:%S"

2011-03-04_14:16:12

[root@ db2 ~]# who am i                                   

root     pts/1        Mar  4 13:14 (192.168.3.115)

[root@ db2 ~]# who am i | awk "{print /$1/" /"/$2/" /"/$6}" 

root pts/1 (192.168.3.115)

 

 

2. 创建保存审计信息的文件并赋权

[root@ db2 ~]# touch /var/log/audit.log

[root@ db2 ~]# chmod 777 /var/log/audit.log

 

       audit.log 是所有用户都可以往里面写信息，所以所有用户都可以修改这个文件。 关于777 赋权这块如果有不清楚的，参考我的Blog：

       Linux chmod 命令 详解

http://www.cndba.cn/Dave/article/647

  

 

二.  验证

[root@db2 ~]# cat /var/log/audit.log

2011-03-04_13:59:20 --- root pts/2 (192.168.3.115) --- 430 --- exit

[root@db2 ~]# cat /var/log/audit.log

2011-03-04_13:59:20 --- root pts/2 (192.168.3.115) --- 430 --- exit

2011-03-04_13:59:27 --- root pts/2 (192.168.3.115) --- 431 --- cat /var/log/audit.log

[root@db2 ~]# su - oracle

[oracle@db2 ~]$ cat /var/log/audit.log

2011-03-04_13:59:20 --- root pts/2 (192.168.3.115) --- 430 --- exit

2011-03-04_13:59:27 --- root pts/2 (192.168.3.115) --- 431 --- cat /var/log/audit.log

2011-03-04_13:59:30 --- root pts/2 (192.168.3.115) --- 432 --- cat /var/log/audit.log

2011-03-04_13:59:35 --- root pts/2 (192.168.3.115) --- 200 --- exit

[oracle@db2 ~]$ cat /var/log/audit.log

2011-03-04_13:59:20 --- root pts/2 (192.168.3.115) --- 430 --- exit

2011-03-04_13:59:27 --- root pts/2 (192.168.3.115) --- 431 --- cat /var/log/audit.log

2011-03-04_13:59:30 --- root pts/2 (192.168.3.115) --- 432 --- cat /var/log/audit.log

2011-03-04_13:59:35 --- root pts/2 (192.168.3.115) --- 200 --- exit

2011-03-04_13:59:43 --- root pts/2 (192.168.3.115) --- 201 --- cat /var/log/audit.log

[oracle@db2 ~]$ cd $ORACLE_HOME

[oracle@db2 db_1]$ cat /var/log/audit.log

2011-03-04_13:59:20 --- root pts/2 (192.168.3.115) --- 430 --- exit

2011-03-04_13:59:27 --- root pts/2 (192.168.3.115) --- 431 --- cat /var/log/audit.log

2011-03-04_13:59:30 --- root pts/2 (192.168.3.115) --- 432 --- cat /var/log/audit.log

2011-03-04_13:59:35 --- root pts/2 (192.168.3.115) --- 200 --- exit

2011-03-04_13:59:43 --- root pts/2 (192.168.3.115) --- 201 --- cat /var/log/audit.log

2011-03-04_13:59:46 --- root pts/2 (192.168.3.115) --- 202 --- cat /var/log/audit.log

2011-03-04_13:59:55 --- root pts/2 (192.168.3.115) --- 203 --- cd $ORACLE_HOME

[oracle@db2 db_1]$ cat /var/log/audit.log

2011-03-04_13:59:20 --- root pts/2 (192.168.3.115) --- 430 --- exit

2011-03-04_13:59:27 --- root pts/2 (192.168.3.115) --- 431 --- cat /var/log/audit.log

2011-03-04_13:59:30 --- root pts/2 (192.168.3.115) --- 432 --- cat /var/log/audit.log

2011-03-04_13:59:35 --- root pts/2 (192.168.3.115) --- 200 --- exit

2011-03-04_13:59:43 --- root pts/2 (192.168.3.115) --- 201 --- cat /var/log/audit.log

2011-03-04_13:59:46 --- root pts/2 (192.168.3.115) --- 202 --- cat /var/log/audit.log

2011-03-04_13:59:55 --- root pts/2 (192.168.3.115) --- 203 --- cd $ORACLE_HOME

2011-03-04_13:59:57 --- root pts/2 (192.168.3.115) --- 204 --- cat /var/log/audit.log

2011-03-04_14:00:46 --- root pts/4 (192.168.3.115) --- 430 --- exit

2011-03-04_14:01:09 --- oracle pts/4 (192.168.3.115) --- 200 --- exit

 

说明：

       这里记录的用户信息，是用户第一次连接的的用户，如：我用用户A连接到服务器，那么记录的是A用户的操作。 假设这个时候我用su 切换到用户B，这时记录的还是用户A。

 

 

 

 

 

 

---------------------------------------------------------------------------------------------------

QQ: 492913789

Email:ahdba@qq.com

Blog: http://www.cndba.cn/dave

DBA1 群：62697716(满); DBA2 群：62697977(满) DBA3 群：62697850(满)  

DBA 超级群：63306533(满); DBA4 群： 83829929 DBA5群： 142216823

聊天 群：40132017

--加群需要在备注说明Oracle表空间和数据文件的关系，否则拒绝申请