31：系统命令审计脚本

最新推荐文章于 2024-04-08 09:00:18 发布

weixin_34226182

最新推荐文章于 2024-04-08 09:00:18 发布

阅读量211

点赞数

文章标签： python 开发工具 awk

原文链接：https://my.oschina.net/yuanhaohao/blog/3033578

版权

2019独角兽企业重金招聘Python工程师标准>>>

[root@localhost_001 ~]# mkdir -p /usr/local/domob/records/
[root@localhost_001 ~]# chmod 777 /usr/local/domob/records/
[root@localhost_001 ~]# chmod o+t /usr/local/domob/records/
[root@localhost_001 ~]# vim /etc/profile
if [ ! -d  /usr/local/domob/records/${LOGNAME} ]
then
mkdir -p /usr/local/domob/records/${LOGNAME}
chmod 300 /usr/local/domob/records/${LOGNAME}
fi
export HISTORY_FILE="/usr/local/domob/records/${LOGNAME}/bash_history"
export PROMPT_COMMAND='{ date "+%Y-%m-%d %T ##### $(who am i |awk "{print \$1\" \"\$2\" \"\$5}") #### $(history 1 | { read x cmd; echo "$cmd"; })"; } >>$HISTORY_FILE'

[root@localhost_001 ~]# source /etc/profile

2、会在 /usr/local/recoreds/ 目录下,基于用户来生成文件;

[root@fenye2019 ~]# head !$
head /usr/local/records/root/bash_history
2019-03-12 18:09:57 ##### root pts/0 (111.196.244.117) #### source /etc/profile
2019-03-12 18:09:57 ##### root pts/0 (111.196.244.117) #### source /etc/profile
2019-03-12 18:09:58 ##### root pts/0 (111.196.244.117) #### ksdfj;
2019-03-12 18:10:03 ##### root pts/0 (111.196.244.117) #### cata /usr/local/records/root/bash_history
2019-03-12 18:10:08 ##### root pts/0 (111.196.244.117) #### cat /usr/local/records/root/bash_history
2019-03-12 18:10:36 ##### root pts/1 (111.196.244.117) #### 2019-03-12  18:05:27  exit
2019-03-12 18:10:45 ##### root pts/1 (111.196.244.117) #### 2019-03-12  18:05:27  exit
2019-03-12 18:10:45 ##### root pts/1 (111.196.244.117) #### 2019-03-12  18:05:27  exit
2019-03-12 18:10:46 ##### root pts/1 (111.196.244.117) #### 2019-03-12  18:10:46  ls
2019-03-12 18:13:28 ##### root pts/0 (111.196.244.117) #### cat /etc/profile

转载于:https://my.oschina.net/yuanhaohao/blog/3033578