我正在运行一个 debian etch 服务器,用户将通过 ssh 登录(希望如此)chroot jail。我怎样才能以他们无法删除或阻止的方式记录他们执行的命令?
答案1
安装史努比。如果您只想记录一个用户,请执行一些系统日志过滤功能。
答案2
我编写了一种方法,无需使用补丁或特殊的可执行工具,即可将所有“bash”命令/内置命令记录到文本文件或“syslog”服务器中。
它非常容易部署,因为它是一个简单的 shellscript,只需要在“bash”初始化时调用一次。(例如,只需从 .bashrc 中“获取”它)它基于使用 bash DEBUG 陷阱的想法。另请参阅superuser.com 上的这篇文章
declare -rx HISTCONTROL="" #does not ignore spaces or duplicates
declare -rx HISTIGNORE="" #does not ignore patterns
declare -rx AUDIT_LOGINUSER="$(who -mu | awk '{print $1}')"
declare -rx AUDIT_LOGINPID="$(who -mu | awk '{print $6}')"
declare -rx AUDIT_USER="$USER" #defined by pam during su/sudo
declare -rx AUDIT_PID="$$"
declare -rx AUDIT_TTY="$(who -mu | awk '{print $2}')"
declare -rx AUDIT_SSH="$([ -n "$SSH_CONNECTION" ] && echo "$SSH_CONNECTION" | awk '{print $1":"$2"->"$3":"$4}')"
declare -rx AUDIT_STR="[audit $AUDIT_LOGINUSER/$AUDIT_LOGINPID as $AUDIT_USER/$AUDIT_PID on $AUDIT_TTY/$AUDIT_SSH]"
set +o functrace #disable trap DEBUG inherited in functions, command substitutions or subshells, normally the default setting already
shopt -s extglob #enable extended pattern matching operators
function audit_DEBUG() {
if [ "$BASH_COMMAND" != "$PROMPT_COMMAND" ] #avoid logging unexecuted commands after 'ctrl-c or 'empty+enter'
then
local AUDIT_CMD="$(history 1)" #current history command
if ! logger -p user.info -t "$AUDIT_STR $PWD" "${AUDIT_CMD##*( )?(+([0-9])[^0-9])*( )}"
then
echo error "$AUDIT_STR $PWD" "${AUDIT_CMD##*( )?(+([0-9])[^0-9])*( )}"
fi
fi
}
function audit_EXIT() {
local AUDIT_STATUS="$?"
logger -p user.info -t "$AUDIT_STR" "#=== bash session ended. ==="
exit "$AUDIT_STATUS"
}
declare -fr +t audit_DEBUG
declare -fr +t audit_EXIT
logger -p user.info -t "$AUDIT_STR" "#=== New bash session started. ===" #audit the session openning
#when a bash command is executed it launches first the audit_DEBUG(),
#then the trap DEBUG is disabled to avoid a useless rerun of audit_DEBUG() during the execution of pipes-commands;
#at the end, when the prompt is displayed, re-enable the trap DEBUG
declare -rx PROMPT_COMMAND="trap 'audit_DEBUG; trap DEBUG' DEBUG"
declare -rx BASH_COMMAND #current command executed by user or a trap
declare -rx SHELLOPT #shell options, like functrace
trap audit_EXIT EXIT
请参阅此处详细解释的方法: http://blog.pointsoftware.ch/index.php/howto-bash-audit-command-logger
欢呼 Francois Scheurer
答案3
你可以尝试特异型。它比你想要的要多,因为它会记录整个 tty。
我自己没有用过它,但它的工作方式(在内核中)使得用户无法更改日志。
答案4
您可以启用系统审计。