記錄每一個 user 所下過的指令

2013-08-13 11:32

 

1. 在 /etc/profile、/etc/bashrc 中加入

 
PROMPT_COMMAND='history -a >(tee -a ~/.bash_history | logger -t "$USER[$$] $SSH_CONNECTION")'
 

 

2. 在 /etc/syslog.conf 加入

 
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console
 
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
 
# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure
 
# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog
 
 
# Log cron stuff
cron.*                                                  /var/log/cron
 
# Everybody gets emergency messages
*.emerg                                                 *
 
# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler
 
# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log
 
*.*                                                     @10.39.106.214
user.notice                                             /var/log/userlog
 

 

3. 重新啟動 syslog deamon

 
service syslog restart
 

 

4. log 如下

 
Aug 13 14:21:32 occas01 root[4782] : ls
Aug 13 14:21:34 occas01 root[4782] : ls -la
Aug 13 14:21:38 occas01 root[4782] : cat .bashrc
Aug 13 14:21:52 occas01 root[4782] : vi .bash_profile
Aug 13 14:21:55 occas01 root[4782] : cat .bash_profile
Aug 13 14:21:56 occas01 root[4782] : pwd
Aug 13 14:22:06 occas01 root[4782] : cat /etc/skel/.bash_profile
Aug 13 14:22:35 occas01 sshd[10088]: Connection closed by 10.39.102.100
Aug 13 14:24:49 occas01 root[4782] : cd ..
Aug 13 14:24:49 occas01 root[4782] : ls
Aug 13 14:24:51 occas01 root[4782] : ls
Aug 13 14:24:58 occas01 root[4782] : vi profile
Aug 13 14:25:04 occas01 root[4782] : cat /etc/profile
Aug 13 14:27:35 occas01 sshd[13962]: Connection closed by 10.39.102.100
Aug 13 14:29:11 occas01 su: pam_unix(su-l:session): session closed for user test
Aug 13 14:29:11 occas01 root[4992] : su - test
Aug 13 14:29:12 occas01 root[4992] : ls
Aug 13 14:29:18 occas01 root[4782] : ls
Aug 13 14:29:20 occas01 su: pam_unix(su-l:session): session closed for user root
Aug 13 14:29:20 occas01 mplususer[4736] 172.27.7.60 57535 10.39.106.201 22: su -
Aug 13 14:29:20 occas01 mplususer[4736] 172.27.7.60 57535 10.39.106.201 22: ls
Aug 13 14:29:22 occas01 sshd[4714]: pam_unix(sshd:session): session closed for user mplususer
Aug 13 14:29:27 occas01 root[4992] : cat /etc/passwd
Aug 13 14:29:30 occas01 sshd[4924]: pam_unix(sshd:session): session closed for user mplususer