Linux安全审计配置_linux审核策略配置

需求

在Linux操作系统中，将所有用户的操作指令记录在日志文件中供审计。

配置

touch /var/log/history.log
chmod 222 /var/log/history.log

替换脚本文件内容：/etc/profile.d/bash_logger.sh，不存在则创建

declare -x HISTTIMEFORMAT="%F/%T "
declare -x HISTFILE="$HOME/.bash_history"
declare -x HISTSIZE=500000
declare -x HISTFILESIZE=500000
declare -x HISTCONTROL=""
declare -x HISTIGNORE=""
declare -x HISTCMD
readonly SSH_CLIENT
readonly USER
readonly REAL_USER
 
function command_log() {
    local data=$(history 1 | { read x y; echo $y;})
    local TIME=$(awk '{print $1}' <<< $data)
    local CMD=$(awk '{$1=""; print $0}' <<< $data)
    local IP=$(awk '{print $1}' <<< $SSH_CLIENT)
    local RUSER=$USER
    if test -n "$REAL_USER"; then
        RUSER="$USER($REAL_USER)"
    fi
 
    echo "host:$HOSTNAME ip:$IP user:$RUSER time:$TIME cwd:$PWD cmd:$CMD"  >> /var/log/history.log
 
    # Run in background, and discard any stdout/stderr output.
    (/usr/local/bin/logger.py "host:$HOSTNAME ip:$IP user:$RUSER time:$TIME cwd:$PWD cmd:$CMD" &>/dev/null &)
}
 
readonly command_log
export -f command_log
declare -rx PROMPT_COMMAND=command_log
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

其他可参考资料：
https://blog.csdn.net/qingzhantianxia/article/details/124824145
https://blog.csdn.net/d1240673769/article/details/95113640
https://blog.csdn.net/u010039418/article/details/85066587