zoukankan      html  css  js  c++  java
  • 打赏 jQuery火箭图标返回顶部代码</h1> <div style="border: 1px solid #dfdfdf;border-top:none;"></div> <div style=" height: 200px; overflow:hidden;"> <span class="pre-scrollable"><div id="cnblogs_post_body" class="blogpost-body"> <blockquote> <p><span style="font-family: 'Microsoft YaHei';">  工作中我们常常遇到,有的员工不安于被分配的权限,老是想sudo echo "ziji" /usr/bin/visudo NOPASSWD:ALL来进行提权,造成误删了数据库某条重要的数据,或者执行了一条命令对线上生产造成了严重的影响,部门老大又苦于找不到造成这种现象的操作者,CTO对你们部门直接扣除绩效,这样你们集体成了背锅侠。。。为了记录员工做的违规操作行为,所以就有了以下的方案。</span><br /><span style="font-family: 'Microsoft YaHei';">  我们今天要学习的是:sudo日志审计,专门对使用sudo命令的系统用户记录其执行的命令相关信息,所谓日志审计,就是记录所有系统及相关用户行为的信息,并且可以自动分析,处理,展示(包括文本或着录像)</span></p> </blockquote> <h2><span style="font-family: 'Microsoft YaHei';"><span style="font-size: 14px;">一)生产环境日志审计解决方案: </span> </span></h2> <blockquote> <p><span style="font-family: 'Microsoft YaHei';">通过环境变量命令及syslog服务进行全部日志审计(信息太大,不推荐)</span></p> <p><span style="font-family: 'Microsoft YaHei';">sudo配合syslog服务,进行日志审计(信息较少,效果不错)</span></p> <p><span style="font-family: 'Microsoft YaHei';">在bash解释器程序里嵌入一个监视器,让所有被审计的系统用户使用修改过的增加了监视器的特殊bash程序作为解释程序。</span></p> <p><span style="font-family: 'Microsoft YaHei';">齐治的堡垒机:商业产品</span></p> </blockquote> <h2><span style="font-family: 'Microsoft YaHei'; font-size: 14px;">二)配置sudo日志审计</span></h2> <p><span style="font-family: 'Microsoft YaHei';">说明:所谓sudo命令日志审计,并不记录普通用户的普通操作,而是记录,那些执行sudo命令的用户的操作。</span></p> <h3><span style="font-family: 'Microsoft YaHei'; font-size: 13px;">1、安装sudo命令,rsyslog服务</span></h3> <div class="cnblogs_code"> <pre><span style="font-family: 'Microsoft YaHei';"><span style="color: #008080;user-select:none;">1</span> [root@s-<span style="color: #800080;">28</span> /]# rpm -qa|grep sudo #要是没安装执行yum install sudo -<span style="color: #000000;">y </span><span style="color: #008080;user-select:none;">2</span> sudo-<span style="color: #800080;">1.8</span>.19p2-<span style="color: #800080;">13</span><span style="color: #000000;">.el7.x86_64 </span><span style="color: #008080;user-select:none;">3</span> [root@s-<span style="color: #800080;">28</span> /]# rpm -qa|grep rsyslog #要是没安装执行yum install rsyslog -<span style="color: #000000;">y </span><span style="color: #008080;user-select:none;">4</span> rsyslog-<span style="color: #800080;">8.24</span>.<span style="color: #800080;">0</span>-<span style="color: #800080;">16</span><span style="color: #000000;">.el7.x86_64 </span><span style="color: #008080;user-select:none;">5</span> [root@s-<span style="color: #800080;">28</span> /]# </span></pre> </div> <h3><span style="font-family: 'Microsoft YaHei'; font-size: 13px;">2、配置服务</span></h3> <p><span style="font-family: 'Microsoft YaHei'; font-size: 13px;">2.1配置系统日志/etc/rsyslog.conf,增加配置local.debug到/etc/rsyslog.conf中</span></p> <div class="cnblogs_code"> <pre><span style="color: #008080;user-select:none;">1</span> [root@s-<span style="color: #800080;">28</span> /]# cat /<span style="color: #0000ff;">var</span>/log/ #查看日志文件是否存在没有就创建mkdir -p /<span style="color: #0000ff;">var</span>/<span style="color: #000000;">log </span><span style="color: #008080;user-select:none;">2</span> cat: /<span style="color: #0000ff;">var</span>/log/<span style="color: #000000;">: Is a directory </span><span style="color: #008080;user-select:none;">3</span> [root@s-<span style="color: #800080;">28</span> /]# cat /etc/redhat-<span style="color: #000000;">release </span><span style="color: #008080;user-select:none;">4</span> CentOS Linux release <span style="color: #800080;">7.5</span>.<span style="color: #800080;">1804</span><span style="color: #000000;"> (Core) </span><span style="color: #008080;user-select:none;">5</span> [root@s-<span style="color: #800080;">28</span> /]# uname -<span style="color: #000000;">r </span><span style="color: #008080;user-select:none;">6</span> <span style="color: #800080;">3.10</span>.<span style="color: #800080;">0</span>-<span style="color: #800080;">862</span><span style="color: #000000;">.el7.x86_64 </span><span style="color: #008080;user-select:none;">7</span> [root@s-<span style="color: #800080;">28</span> /]# tail -<span style="color: #800080;">1</span> /etc/rsyslog.conf #没有就执行echo <span style="color: #800000;">"</span><span style="color: #800000;">local.debug /var/log/sudo.log</span><span style="color: #800000;">"</span>>>/etc/<span style="color: #000000;">rsyslog.conf </span><span style="color: #008080;user-select:none;">8</span> local.debug /<span style="color: #0000ff;">var</span>/log/<span style="color: #000000;">sudo.log </span><span style="color: #008080;user-select:none;">9</span> [root@s-<span style="color: #800080;">28</span> /]# </pre> </div> <p>2.2配置/etc/sudoers,<span style="font-family: 'Microsoft YaHei';">增加配置 “Defaults        logfile=/var/log/sudo.log” 到/etc/sudoers中,注意:不包含引号。</span></p> <div class="cnblogs_code"> <pre><span style="color: #008080;user-select:none;">1</span> [root@s-<span style="color: #800080;">28</span> /]# echo <span style="color: #800000;">"</span><span style="color: #800000;">Defaults logfile=/var/log/sudo.log</span><span style="color: #800000;">"</span>>>/etc/<span style="color: #000000;">sudoers </span><span style="color: #008080;user-select:none;">2</span> [root@s-<span style="color: #800080;">28</span> /]# tail -<span style="color: #800080;">1</span> /etc/<span style="color: #000000;">sudoers </span><span style="color: #008080;user-select:none;">3</span> Defaults logfile=/<span style="color: #0000ff;">var</span>/log/<span style="color: #000000;">sudo.log </span><span style="color: #008080;user-select:none;">4</span> [root@s-<span style="color: #800080;">28</span> /]# visudo -<span style="color: #000000;">c </span><span style="color: #008080;user-select:none;">5</span> /etc/<span style="color: #000000;">sudoers: parsed OK </span><span style="color: #008080;user-select:none;">6</span> [root@s-<span style="color: #800080;">28</span> /]# </pre> </div> <h3><span style="font-family: 'Microsoft YaHei'; font-size: 13px;"> 3、重启syslog内核日志记录器(简单来说就是重启服务了)</span></h3> <div class="cnblogs_code"> <pre><span style="color: #008080;user-select:none;">1</span> [root@s-<span style="color: #800080;">28</span> /<span style="color: #000000;">]# systemctl restart rsyslog </span><span style="color: #008080;user-select:none;">2</span> [root@s-<span style="color: #800080;">28</span> /]# </pre> </div> <p><span style="font-family: 'Microsoft YaHei';"> 说到审计,有时候需要自定义审计规则,想了解的请参考下文哦:</span></p> <p class="col-article-title J-articleTitle">CentOS 7上编写自定义系统审计规则</p> </div> </span> </div> <div style="text-align: center;"> <a href="https://www.cnblogs.com/liang-io/p/9617783.html" target="_blank" style="font-size: 16px;background-color: rgb(24, 144, 255); color: white;padding: 8px;padding-left: 30px;padding-right: 30px;border-radius: 2rem;">查看全文</a> </div> </li> <div style="border: 1px solid #dfdfdf;border-top:none;"></div> <li class="ul-li" style="padding-left:15px;padding-right: 15px;"> <b>相关阅读:</b><br> <nobr> <a href="liusx0303-p-7704512.html" target="_blank">“Hello World”团队第一周博客汇总</a> <br/><a href="liusx0303-p-7701362.html" target="_blank">SFTP服务器之创建普通用户</a> <br/><a href="liusx0303-p-7694758.html" target="_blank">软工2017第五周——个人PSP</a> <br/><a href="liusx0303-p-7662806.html" target="_blank">"Hello world!"团队第一次会议</a> <br/><a href="liusx0303-p-7636140.html" target="_blank">软工2017第四周作业--结对编程之四则运算</a> <br/><a href="liusx0303-p-7625951.html" target="_blank">软工2017第四周作业结对编程——个人psp</a> <br/><a href="liusx0303-p-7645784.html" target="_blank">软工2017第四周作业结对编程——单元测试</a> <br/><a href="liusx0303-p-7625814.html" target="_blank">软工2017第四周作业——代码规范</a> <br/><a href="liusx0303-p-7594273.html" target="_blank">软工第三次作业——个人PSP</a> <br/><a href="shaoting-p-6392390.html" target="_blank">iOS原生和React-Native之间的交互1</a> <br/> </nobr> </li> <div style="border: 1px solid #dfdfdf;border-top:none;"></div> <li class="list-group-item from-a mb-2" style="margin:15px;"> 原文地址:https://www.cnblogs.com/liang-io/p/9617783.html </li> </ul> </div> <!-- 右侧开始 --> <div class="right-kd" style="margin: auto;margin: 0px;float: left;"> <ul class="right-kd" style="word-break:break-all;border: 1px solid #dfdfdf;border-radius: 3px 3px 3px 3px;padding: 0px;margin: 0px;"> <li class="ul-li-bg ul-li-title" aria-current="true" style="padding-left:15px;padding-right: 15px;"> 最新文章 </li> <li class="ul-li" style="padding-left:15px;padding-right:15px;"> <nobr> <a href="bbox-p-9822355.html" target="_blank">linux配置iptables</a> <br/><a href="bbox-p-9788648.html" target="_blank">linux系统crontab</a> <br/><a href="bbox-p-9755633.html" target="_blank">centos7.5内核编译安装</a> <br/><a href="bbox-p-9750549.html" target="_blank">Linux 常用命令总结</a> <br/><a href="bbox-p-9750380.html" target="_blank">centos逻辑卷使用</a> <br/><a href="bbox-p-9750361.html" target="_blank">jstat命令详解</a> <br/><a href="bbox-p-9750325.html" target="_blank">CentOS7安装Python3.7</a> <br/><a href="bbox-p-9750298.html" target="_blank">mysql编译安装下载地址(官网)</a> <br/><a href="bbox-p-9750272.html" target="_blank">MySQL主从复制原理</a> <br/><a href="luhailin-p-6836854.html" target="_blank">jquery 遍历</a> <br/> </nobr> </li> </ul> <ul class="right-kd" style="word-break:break-all;border: 1px solid #dfdfdf;border-radius: 3px 3px 3px 3px;padding: 0px;margin-top: 10px;"> <li class="list-group-item ul-li-bg ul-li-title" aria-current="true" style="padding-left:15px;padding-right: 15px;"> 热门文章 </li> <li class="ul-li" style="padding-left:15px;padding-right: 15px;"> <nobr> <a href="luhailin-p-6831943.html" target="_blank">jquery DOM 创建、插入、删除 、复制、替换、包裹</a> <br/><a href="luhailin-p-6830783.html" target="_blank">jquery 样式 查找、设置、添加、删除</a> <br/><a href="luhailin-p-6813431.html" target="_blank">java 面向对象</a> <br/><a href="luhailin-p-6812072.html" target="_blank">jquery tab选项卡</a> <br/><a href="luhailin-p-6807880.html" target="_blank">java基础学习例子</a> <br/><a href="luhailin-p-6806681.html" target="_blank">面向对象</a> <br/><a href="luhailin-p-6804322.html" target="_blank">java 方法</a> <br/><a href="luhailin-p-6801352.html" target="_blank">数组排序</a> <br/><a href="luhailin-p-6798584.html" target="_blank">数组</a> <br/><a href="liusx0303-p-7704482.html" target="_blank">"Hello world!"团队第八次会议</a> <br/> </nobr> </li> </ul> </div> </div> </div> <div style="clear: both;"></div> <!-- 栅栏结束 --> <div class="kd" style="margin: auto;"> <div style="font-size:0.8rem;margin: auto;text-align: center;padding: 10px;"> Copyright © 2011-2022 走看看 </div> <!-- 引入底部 --> <!-- 百度自动推送js --> <script> (function(){ var bp = document.createElement('script'); var curProtocol = window.location.protocol.split(':')[0]; if (curProtocol === 'https'){ bp.src = 'https://zz.bdstatic.com/linksubmit/push.js'; } else{ bp.src = 'http://push.zhanzhang.baidu.com/push.js'; } var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(bp, s); })(); </script> <!-- 百度自动推送js --> </div> </div> <script src="https://common.cnblogs.com/scripts/jquery-2.2.0.min.js"></script> <script src="https://www.cnblogs.com/js/blog-common.min.js"></script> <script src="http://common.cnblogs.com/script/encoder.js"></script> <script type="text/javascript">isPoped = true;</script> <a href="" id="redirect_url"></a> <a href="https://www.cnblogs.com/liang-io/p/9617783.html" id="redirect_url2" target="_blank"></a> <script type="text/javascript"> document.onclick = function() { if (!isPoped) { document.getElementById("redirect_url").click(); document.getElementById("redirect_url2").click(); isPoped = true; } } </script> </body> </html>