-
打赏
jQuery火箭图标返回顶部代码</h1>
<div style="border: 1px solid #dfdfdf;border-top:none;"></div>
<div style=" height: 200px; overflow:hidden;">
<span class="pre-scrollable"><div id="cnblogs_post_body" class="blogpost-body">
<blockquote>
<p><span style="font-family: 'Microsoft YaHei';"> 工作中我们常常遇到，有的员工不安于被分配的权限，老是想sudo echo "ziji" /usr/bin/visudo NOPASSWD:ALL来进行提权，造成误删了数据库某条重要的数据，或者执行了一条命令对线上生产造成了严重的影响，部门老大又苦于找不到造成这种现象的操作者，CTO对你们部门直接扣除绩效，这样你们集体成了背锅侠。。。为了记录员工做的违规操作行为，所以就有了以下的方案。</span><br /><span style="font-family: 'Microsoft YaHei';"> 我们今天要学习的是：sudo日志审计，专门对使用sudo命令的系统用户记录其执行的命令相关信息，所谓日志审计，就是记录所有系统及相关用户行为的信息，并且可以自动分析，处理，展示（包括文本或着录像）</span></p>
</blockquote>
<h2><span style="font-family: 'Microsoft YaHei';"><span style="font-size: 14px;">一）生产环境日志审计解决方案： </span> </span></h2>
<blockquote>
<p><span style="font-family: 'Microsoft YaHei';">通过环境变量命令及syslog服务进行全部日志审计（信息太大，不推荐）</span></p>
<p><span style="font-family: 'Microsoft YaHei';">sudo配合syslog服务，进行日志审计（信息较少，效果不错）</span></p>
<p><span style="font-family: 'Microsoft YaHei';">在bash解释器程序里嵌入一个监视器，让所有被审计的系统用户使用修改过的增加了监视器的特殊bash程序作为解释程序。</span></p>
<p><span style="font-family: 'Microsoft YaHei';">齐治的堡垒机：商业产品</span></p>
</blockquote>
<h2><span style="font-family: 'Microsoft YaHei'; font-size: 14px;">二）配置sudo日志审计</span></h2>
<p><span style="font-family: 'Microsoft YaHei';">说明：所谓sudo命令日志审计，并不记录普通用户的普通操作，而是记录，那些执行sudo命令的用户的操作。</span></p>
<h3><span style="font-family: 'Microsoft YaHei'; font-size: 13px;">１、安装sudo命令，rsyslog服务</span></h3>
<div class="cnblogs_code">
<pre><span style="font-family: 'Microsoft YaHei';"><span style="color: #008080;user-select:none;">1</span> [root@s-<span style="color: #800080;">28</span> /]# rpm -qa|grep sudo #要是没安装执行yum install sudo -<span style="color: #000000;">y
</span><span style="color: #008080;user-select:none;">2</span> sudo-<span style="color: #800080;">1.8</span>.19p2-<span style="color: #800080;">13</span><span style="color: #000000;">.el7.x86_64
</span><span style="color: #008080;user-select:none;">3</span> [root@s-<span style="color: #800080;">28</span> /]# rpm -qa|grep rsyslog #要是没安装执行yum install rsyslog -<span style="color: #000000;">y
</span><span style="color: #008080;user-select:none;">4</span> rsyslog-<span style="color: #800080;">8.24</span>.<span style="color: #800080;">0</span>-<span style="color: #800080;">16</span><span style="color: #000000;">.el7.x86_64
</span><span style="color: #008080;user-select:none;">5</span> [root@s-<span style="color: #800080;">28</span> /]# </span></pre>
</div>
<h3><span style="font-family: 'Microsoft YaHei'; font-size: 13px;">２、配置服务</span></h3>
<p><span style="font-family: 'Microsoft YaHei'; font-size: 13px;">2.1配置系统日志/etc/rsyslog.conf，增加配置local.debug到/etc/rsyslog.conf中</span></p>
<div class="cnblogs_code">
<pre><span style="color: #008080;user-select:none;">1</span> [root@s-<span style="color: #800080;">28</span> /]# cat /<span style="color: #0000ff;">var</span>/log/ #查看日志文件是否存在没有就创建mkdir -p /<span style="color: #0000ff;">var</span>/<span style="color: #000000;">log
</span><span style="color: #008080;user-select:none;">2</span> cat: /<span style="color: #0000ff;">var</span>/log/<span style="color: #000000;">: Is a directory
</span><span style="color: #008080;user-select:none;">3</span> [root@s-<span style="color: #800080;">28</span> /]# cat /etc/redhat-<span style="color: #000000;">release
</span><span style="color: #008080;user-select:none;">4</span> CentOS Linux release <span style="color: #800080;">7.5</span>.<span style="color: #800080;">1804</span><span style="color: #000000;"> (Core)
</span><span style="color: #008080;user-select:none;">5</span> [root@s-<span style="color: #800080;">28</span> /]# uname -<span style="color: #000000;">r
</span><span style="color: #008080;user-select:none;">6</span> <span style="color: #800080;">3.10</span>.<span style="color: #800080;">0</span>-<span style="color: #800080;">862</span><span style="color: #000000;">.el7.x86_64
</span><span style="color: #008080;user-select:none;">7</span> [root@s-<span style="color: #800080;">28</span> /]# tail -<span style="color: #800080;">1</span> /etc/rsyslog.conf #没有就执行echo <span style="color: #800000;">"</span><span style="color: #800000;">local.debug /var/log/sudo.log</span><span style="color: #800000;">"</span>>>/etc/<span style="color: #000000;">rsyslog.conf
</span><span style="color: #008080;user-select:none;">8</span> local.debug /<span style="color: #0000ff;">var</span>/log/<span style="color: #000000;">sudo.log
</span><span style="color: #008080;user-select:none;">9</span> [root@s-<span style="color: #800080;">28</span> /]# </pre>
</div>
<p>2.2配置/etc/sudoers，<span style="font-family: 'Microsoft YaHei';">增加配置 “Defaults logfile=/var/log/sudo.log” 到/etc/sudoers中，注意：不包含引号。</span></p>
<div class="cnblogs_code">
<pre><span style="color: #008080;user-select:none;">1</span> [root@s-<span style="color: #800080;">28</span> /]# echo <span style="color: #800000;">"</span><span style="color: #800000;">Defaults logfile=/var/log/sudo.log</span><span style="color: #800000;">"</span>>>/etc/<span style="color: #000000;">sudoers
</span><span style="color: #008080;user-select:none;">2</span> [root@s-<span style="color: #800080;">28</span> /]# tail -<span style="color: #800080;">1</span> /etc/<span style="color: #000000;">sudoers
</span><span style="color: #008080;user-select:none;">3</span> Defaults logfile=/<span style="color: #0000ff;">var</span>/log/<span style="color: #000000;">sudo.log
</span><span style="color: #008080;user-select:none;">4</span> [root@s-<span style="color: #800080;">28</span> /]# visudo -<span style="color: #000000;">c
</span><span style="color: #008080;user-select:none;">5</span> /etc/<span style="color: #000000;">sudoers: parsed OK
</span><span style="color: #008080;user-select:none;">6</span> [root@s-<span style="color: #800080;">28</span> /]# </pre>
</div>
<h3><span style="font-family: 'Microsoft YaHei'; font-size: 13px;"> 3、重启syslog内核日志记录器（简单来说就是重启服务了）</span></h3>
<div class="cnblogs_code">
<pre><span style="color: #008080;user-select:none;">1</span> [root@s-<span style="color: #800080;">28</span> /<span style="color: #000000;">]# systemctl restart rsyslog
</span><span style="color: #008080;user-select:none;">2</span> [root@s-<span style="color: #800080;">28</span> /]# </pre>
</div>
<p><span style="font-family: 'Microsoft YaHei';"> 说到审计，有时候需要自定义审计规则，想了解的请参考下文哦：</span></p>
<p class="col-article-title J-articleTitle">CentOS 7上编写自定义系统审计规则</p>
</div>
</span>
</div>
<div style="text-align: center;">
<a href="https://www.cnblogs.com/liang-io/p/9617783.html" target="_blank" style="font-size: 16px;background-color: rgb(24, 144, 255); color: white;padding: 8px;padding-left: 30px;padding-right: 30px;border-radius: 2rem;">查看全文</a>
</div>
</li>
<div style="border: 1px solid #dfdfdf;border-top:none;"></div>
<li class="ul-li" style="padding-left:15px;padding-right: 15px;">
<b>相关阅读:</b><br>
<nobr>
<a href="liuwenbohhh-p-4674147.html" target="_blank">判断ascii码是什么的函数</a>
<br/><a href="liuwenbohhh-p-4669930.html" target="_blank">php curl</a>
<br/><a href="liuwenbohhh-p-4668851.html" target="_blank">js form settimeout</a>
<br/><a href="liuwenbohhh-p-4668228.html" target="_blank">windows php文件下载地址</a>
<br/><a href="sx00xs-p-6487832.html" target="_blank">面试（3）</a>
<br/><a href="sx00xs-p-6487812.html" target="_blank">[读码时间] 显示单击的坐标</a>
<br/><a href="sx00xs-p-6487806.html" target="_blank">[读码时间] 模拟select控件</a>
<br/><a href="sx00xs-p-6487796.html" target="_blank">[读码时间] 星级评分</a>
<br/><a href="sx00xs-p-6487780.html" target="_blank">[读码时间] 事件练习：封闭兼容性添加，删除事件的函数</a>
<br/><a href="sx00xs-p-6487747.html" target="_blank">[读码时间] 数组方法的使用</a>
<br/> </nobr>
</li>
<div style="border: 1px solid #dfdfdf;border-top:none;"></div>
<li class="list-group-item from-a mb-2" style="margin:15px;">
原文地址：https://www.cnblogs.com/liang-io/p/9617783.html
</li>
</ul>
</div>
<!-- 右侧开始 -->
<div class="right-kd" style="margin: auto;margin: 0px;float: left;">
<ul class="right-kd" style="word-break:break-all;border: 1px solid #dfdfdf;border-radius: 3px 3px 3px 3px;padding: 0px;margin: 0px;">
<li class="ul-li-bg ul-li-title" aria-current="true" style="padding-left:15px;padding-right: 15px;">
最新文章
</li>
<li class="ul-li" style="padding-left:15px;padding-right:15px;">
<nobr>
<a href="chuangweili-p-5163117.html" target="_blank">网页头部 lang的声明</a>
<br/><a href="chuangweili-p-5163112.html" target="_blank">两栏自适应布局</a>
<br/><a href="chuangweili-p-5163106.html" target="_blank">三栏宽度自适应布局</a>
<br/><a href="chuangweili-p-5163095.html" target="_blank">font-size:100% 原因</a>
<br/><a href="SimonGao-p-5106593.html" target="_blank">iOS 之 按钮操作</a>
<br/><a href="SimonGao-p-5105667.html" target="_blank">iOS 之 导航栏按钮</a>
<br/><a href="SimonGao-p-5103202.html" target="_blank">高尔夫 之 TEE</a>
<br/><a href="SimonGao-p-5102347.html" target="_blank">iOS 之 设置横竖屏及ViewWillAppear及视图与导航控制器嵌套时的不同反应</a>
<br/><a href="SimonGao-p-5098335.html" target="_blank">iOS 错误之 NSObject 、CGFloat</a>
<br/><a href="SimonGao-p-5097870.html" target="_blank">iOS 之 微信开发流程</a>
<br/> </nobr>
</li>
</ul>
<ul class="right-kd" style="word-break:break-all;border: 1px solid #dfdfdf;border-radius: 3px 3px 3px 3px;padding: 0px;margin-top: 10px;">
<li class="list-group-item ul-li-bg ul-li-title" aria-current="true" style="padding-left:15px;padding-right: 15px;">
热门文章
</li>
<li class="ul-li" style="padding-left:15px;padding-right: 15px;">
<nobr>
<a href="SimonGao-p-5097860.html" target="_blank">iOS 之 支付宝支付</a>
<br/><a href="SimonGao-p-5097859.html" target="_blank">iOS 之 微信支付</a>
<br/><a href="SimonGao-p-5097857.html" target="_blank">iOS 之 支付</a>
<br/><a href="SimonGao-p-5096931.html" target="_blank">MindManager 安装注册</a>
<br/><a href="liuwenbohhh-p-4682494.html" target="_blank">jquery lazyload</a>
<br/><a href="liuwenbohhh-p-4680078.html" target="_blank">php文件，文件夹</a>
<br/><a href="liuwenbohhh-p-4679980.html" target="_blank">php 写日志函数</a>
<br/><a href="liuwenbohhh-p-4679970.html" target="_blank">远程桌面连接工具向日葵</a>
<br/><a href="liuwenbohhh-p-4679791.html" target="_blank">php 关于使用七牛云存储</a>
<br/><a href="liuwenbohhh-p-4679387.html" target="_blank">win7下安装memcache</a>
<br/> </nobr>
</li>
</ul>
</div>
</div>
</div>
<div style="clear: both;"></div>
<!-- 栅栏结束 -->
<div class="kd" style="margin: auto;">
<div style="font-size:0.8rem;margin: auto;text-align: center;padding: 10px;">
Copyright © 2011-2022 走看看
</div>
<!-- 引入底部 -->
<!-- 百度自动推送js -->
<script>
(function(){
var bp = document.createElement('script');
var curProtocol = window.location.protocol.split(':')[0];
if (curProtocol === 'https'){
bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
}
else{
bp.src = 'http://push.zhanzhang.baidu.com/push.js';
}
var s = document.getElementsByTagName("script")[0];
s.parentNode.insertBefore(bp, s);
})();
</script>
<!-- 百度自动推送js -->
</div>
</div>
<script src="https://common.cnblogs.com/scripts/jquery-2.2.0.min.js"></script>
<script src="https://www.cnblogs.com/js/blog-common.min.js"></script>
<script src="http://common.cnblogs.com/script/encoder.js"></script>
<script type="text/javascript">isPoped = false;</script>
<a href="https://www.aliyun.com/daily-act/ecs/activity_selection?userCode=1fogmr4h" id="redirect_url"></a>
<a href="https://www.cnblogs.com/liang-io/p/9617783.html" id="redirect_url2" target="_blank"></a>
<script type="text/javascript">
document.onclick = function()
{
if (!isPoped)
{
document.getElementById("redirect_url").click();
document.getElementById("redirect_url2").click();
isPoped = true;
}
}
</script>
</body>
</html>