用户登录日志与命令执行记录

不念不忘少年蓝@ 2021-09-30 06:06 300阅读 0赞

编辑这个文件，用来设置登录前告警信息  
\[root@controller etc\]\# cat /etc/login.warn  
!!!! Welcome to KernelTalks test server !!!!  
This server is meant for testing Linux commands and tools. If you are  
not associated with kerneltalks.com and not authorized please dis-connect  
immediately.

\[root@controller etc\]\# cat /etc/ssh/sshd\_config | grep Banner  
Banner /etc/login.warn

写完之后。用ps -ef | grep sshd 过滤出/usr/sbin/sshd的进程PID  
使用kill -HUP +PID来杀死它，这种方式不会让当前的ssh连接断开。然后重新启动sshd服务即可

编辑这个文件并输入当成功登录后欢迎用户的消息。  
root@kerneltalks \# cat /etc/motd  
W E L C O M E  
Welcome to the testing environment of kerneltalks.  
Feel free to use this system for testing your Linux  
skills. In case of any issues reach out to admin at  
info@kerneltalks.com. Thank you.

你不需要重启 sshd 守护进程来使更改生效。只要保存该文件，sshd 守护进程就会下一次登录请求时读取和显示。

查看服务器登录状态  
who /var/log/wtmp

linux 记录用户登录日志与命令执行日志

vi /etc/profile 在末尾增加代码

USER=\`whoami\`  
USER\_IP=\`who -u am i 2>/dev/null| awk '\{print $NF\}'|sed -e 's/\[()\]//g'\`  
if \[ "$USER\_IP" = "" \]; then  
USER\_IP=\`hostname\`  
fi  
if \[ ! -d /var/log/history \]; then  
mkdir /var/log/history  
chmod 777 /var/log/history  
fi  
if \[ ! -d /var/log/history/$\{LOGNAME\} \]; then  
mkdir /var/log/history/$\{LOGNAME\}  
chmod 300 /var/log/history/$\{LOGNAME\}  
fi  
export HISTSIZE=4096  
DT=\`date +"%Y%m%d\_%H:%M:%S"\`  
export HISTTIMEFORMAT="\[$DT\]\[$\{USER\}\]\[$\{USER\_IP\}\]"  
export HISTFILE="/var/log/history/$\{LOGNAME\}/$\{USER\}@$\{USER\_IP\}\_$DT"  
chmod 600 /var/log/history/$\{LOGNAME\}/\*history\* 2>/dev/null

执行 source /etc/profile 使其生效  
之后不同用户会在/var/log/history以用户名为目录名的目录,进入对应目录后会有用户登录时间IP为名字的文件, 内容为用户执行命令的日志信息

转载于:https://www.cnblogs.com/michael-sara/p/10993069.html