服务器合规整改-日志审查(centos7)

 

1.创建存储记录的日志文件并对其权限进行设置。

mkdir -p /var/log/usermonitor

echo usermonitor > /var/log/usermonitor/usermonitor.log

chown nobody:nobody /var/log/usermonitor/usermonitor.log
chmod 002 /var/log/usermonitor/usermonitor.log
chattr +a /var/log/usermonitor/usermonitor.log

2.编辑/etc/profile文件，将以下内容加入最末行

export HISTORY_FILE=/var/log/usermonitor/usermonitor.log
export PROMPT_COMMAND='{ date "+%y-%m-%d %T ##### $(who am i |awk "{print \$1\" \"\$2\" \"\$5}")  #### $(whoami)  #### $(history 1 | { read x cmd; echo "$cmd"; })"; } >>$HISTORY_FILE'

保存 :wq

source /etc/profile

 

3.查看记录：

用户操作记录均被记录在列