1、有時(shí)候我們需要對線上用戶的操作進(jìn)行記錄,可以進(jìn)行追蹤,出現(xiàn)問題追究責(zé)任,但是linux自帶的history并不會實(shí)時(shí)的記錄(僅僅在內(nèi)存中,當(dāng)用戶正常退出(exit logout )時(shí)才會記錄到history文件里),并且還有1000行的限制可以刪除的；
為了保證讓用戶的操作進(jìn)行實(shí)時(shí)記錄；可以做一個(gè)簡易的審計(jì)系統(tǒng)；審計(jì)用戶的操作歷史；
1:首先創(chuàng)建一個(gè)目錄,這個(gè)目錄是用來記錄所有用戶的操作歷史的；
[root@localhost_001 ~]# mkdir -p /usr/local/domob/records/2:然后給目錄777權(quán)限；(讓任何用戶都可以寫入文件)；
[root@localhost_001 ~]# chmod 777 /usr/local/domob/records/
3:還有給目錄加上?t?權(quán)限；普通用戶之間無法互相刪除；
[root@localhost_001 ~]# chmod o+t /usr/local/domob/records/
4:在/etc/profile里添加如下內(nèi)容；并執(zhí)行立即生效命令：? source? ?/etc/profile
[root@localhost_001 ~]# vim /etc/profile
if [ ! -d /usr/local/domob/records/${LOGNAME} ]
then
mkdir -p /usr/local/domob/records/${LOGNAME}
chmod 300 /usr/local/domob/records/${LOGNAME}
fi
#需要聲明變量;
export HISTORY_FILE="/usr/local/domob/records/${LOGNAME}/bash_history"
export PROMPT_COMMAND='{ date "+%Y-%m-%d %T ##### $(who am i |awk "{print \$1\" \"\$2\" \"\$5}") #### $(history 1 | { read x cmd; echo "$cmd"; })"; } >>$HISTORY_FILE'
[root@localhost_001 ~]# source /etc/profile詳細(xì)步驟；
[root@localhost_001 ~]# mkdir -p /usr/local/domob/records/
[root@localhost_001 ~]# chmod 777 /usr/local/domob/records/
[root@localhost_001 ~]# chmod o+t /usr/local/domob/records/
[root@localhost_001 ~]# vim /etc/profile
if [ ! -d /usr/local/domob/records/${LOGNAME} ]
then
mkdir -p /usr/local/domob/records/${LOGNAME}
chmod 300 /usr/local/domob/records/${LOGNAME}
fi
export HISTORY_FILE="/usr/local/domob/records/${LOGNAME}/bash_history"
export PROMPT_COMMAND='{ date "+%Y-%m-%d %T ##### $(who am i |awk "{print \$1\" \"\$2\" \"\$5}") #### $(history 1 | { read x cmd; echo "$cmd"; })"; } >>$HISTORY_FILE'
???????[root@localhost_001 ~]# source /etc/profile2、然后在linux下root用戶運(yùn)行一些命令,然后去查看命令歷史；
[root@localhost_001 ~]# cd
[root@localhost_001 ~]# pwd
/root
[root@localhost_001 ~]# ls
anaconda-ks.cfg CentOS7-Base-163.repo test
authorized_keys link test.txt
[root@localhost_001 ~]# cd /etc/sysconfig/network-scripts/
[root@localhost_001 network-scripts]# cd3、然后去存放命令的目錄下查看： /usr/local/domob/records/username
[root@localhost_001 ~]# cat /usr/local/domob/records/root/bash_history
2018-10-20 12:11:17 ##### root pts/0 (192.168.149.135) #### source /etc/profile
2018-10-20 12:11:20 ##### root pts/0 (192.168.149.135) #### cd
2018-10-20 12:11:21 ##### root pts/0 (192.168.149.135) #### pwd
2018-10-20 12:11:21 ##### root pts/0 (192.168.149.135) #### ls
2018-10-20 12:11:27 ##### root pts/0 (192.168.149.135) #### cd /etc/sysconfig/network-scripts/
2018-10-20 12:11:27 ##### root pts/0 (192.168.149.135) #### cd4、我們切換到普通用戶隨意執(zhí)行一些命令,然后查看是否會記錄；
???????[root@localhost_001 ~]# su - fenye
上一次登錄：四 10月 18 22:35:24 CST 2018pts/0 上
[fenye@localhost_001 etc]$ cd
[fenye@localhost_001 ~]$ pwd
/home/fenye
[fenye@localhost_001 ~]$ cd
[fenye@localhost_001 ~]$ ksjd;lsdjf
-bash: ksjd: 未找到命令
-bash: lsdjf: 未找到命令
[fenye@localhost_001 ~]$
[fenye@localhost_001 ~]$ cd /etc/
[fenye@localhost_001 etc]$ cd
[fenye@localhost_001 ~]$ ls
[fenye@localhost_001 ~]$ klsd;ksjfksf
-bash: klsd: 未找到命令
-bash: ksjfksf: 未找到命令
注釋：查看/usr/local/domob/relcords已記錄,但是無法打開,因?yàn)槠胀ㄓ脩糁挥袑懭氲臋?quán)限；
[fenye@localhost_001 ~]$ cd /usr/local/domob/records/
fenye/ root/
[fenye@localhost_001 ~]$ cd /usr/local/domob/records/fenye/
[fenye@localhost_001 fenye]$ ls
ls: 無法打開目錄.: 權(quán)限不夠切換至root用戶,查看其用戶的歷史命令是否有記錄；有記錄；
[fenye@localhost_001 fenye]$ exit
登出
[root@localhost_001 ~]# cat /usr/local/domob/records/
fenye/ root/
[root@localhost_001 ~]# cat /usr/local/domob/records/fenye/bash_history
2018-10-20 12:17:52 ##### root pts/0 (192.168.149.135) ####
2018-10-20 12:17:54 ##### root pts/0 (192.168.149.135) #### ls
2018-10-20 12:17:55 ##### root pts/0 (192.168.149.135) #### klsjdkfs
2018-10-20 12:17:56 ##### root pts/0 (192.168.149.135) #### jsjfkls
2018-10-20 12:17:57 ##### root pts/0 (192.168.149.135) #### ls
2018-10-20 12:17:58 ##### root pts/0 (192.168.149.135) #### pwd
2018-10-20 12:17:58 ##### root pts/0 (192.168.149.135) #### cd
2018-10-20 12:18:01 ##### root pts/0 (192.168.149.135) #### cd /etc/
2018-10-20 12:18:02 ##### root pts/0 (192.168.149.135) #### ls
2018-10-20 12:18:04 ##### root pts/0 (192.168.149.135) #### cd
2018-10-20 12:18:09 ##### root pts/0 (192.168.149.135) #### pwd
2018-10-20 12:18:10 ##### root pts/0 (192.168.149.135) #### cd轉(zhuǎn)載于:https://my.oschina.net/yuanhaohao/blog/2249855文章來源：http://www.zghlxwxcb.cn/news/detail-476626.html
?文章來源地址http://www.zghlxwxcb.cn/news/detail-476626.html
到了這里，關(guān)于linux歷史記錄簡易審計(jì)系統(tǒng)的文章就介紹完了。如果您還想了解更多內(nèi)容，請?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
