Bash History Audit Action notes

Perfect Bash History Audit

1. Download the bash-4.2 version source package, modify the source code to recompile the installation:

wget http://mirrors.ustc.edu.cn/gnu/bash/bash-4.2.tar.gz

2. Modify the Config-top.h file in the root directory of the source package.

#define SSH_SOURCE_BASHRC
#define Syslog_history

Remove the comments from the above two items

3. Modify the source package in the root directory under the bashhist.c file, about 705 lines.

/* void
Bash_syslog_history (line)
const char *line;
{
Char Trunc[syslog_maxlen];

if (strlen (line) < Syslog_maxlen)
Syslog (syslog_facility| Syslog_level, "history:pid=%d uid=%d%s", Getpid (), current_user.uid, line);
Else
{
strncpy (trunc, line, Syslog_maxlen);
Trunc[syslog_maxlen-1] = ';
Syslog (syslog_facility| Syslog_level, "HISTORY (truncated): pid=%d uid=%d%s", Getpid (), Current_user.uid, trunc);
}
}
*/
Note the above code and add the code:

# ================ Split Line ================#

void
Bash_syslog_history (line)
const char *line;
{
Char Trunc[syslog_maxlen];
const char *p;
p = getenv ("Name_of_key");
if (strlen (line) < Syslog_maxlen)
Syslog (syslog_facility| Syslog_level, "history:pid=%d ppid=%d sid=%d user=%s user=%s cmd=%s", Getpid (), Getppid (), GetSID (Getpid ()), Current_use R.user_name, p, line);
Else
{
strncpy (trunc, line, Syslog_maxlen);
Trunc[syslog_maxlen-1] = ';
Syslog (syslog_facility| Syslog_level, "HISTORY (truncated): pid=%d ppid=%d sid=%d user=%s user=%s cmd=%s", Getpid (), Getppid (), GetSID (Getpid ()), Current_user.user_name, p, trunc);
}
}

# ================ Split Line ================#

4. Compile the installation, the default installation under/usr/local/bin/

./configure && make && make install

5. Rewrite the/ROOT/.BASHRC file with the following script content.

# ================ Split Line ================#

#. BASHRC
fcomp= "/tmp/file"
authorized_keys= "$HOME/.ssh/authorized_keys"
Secure= "/var/log/secure"
Record= "/var/log/login"
rsager=$ (awk-vp= $PPID '/found matching RSA key/&& $0~p {f= $NF}end{print F} ' $secure)
Mkdir-p $record

While Read line
Todo
echo $LINE > $fcomp
name=$ (echo $LINE |awk ' {print $} ')
nowrsa=$ (ssh-keygen-lf $fcomp |awk ' {print $} ')
if [[$rsager = $nowrsa]];then
name_of_key= $name
ReadOnly Name_of_key
Export Name_of_key histfile= "$record/$name"
Fi
Done < $authorized _keys
RM $fcomp

[$BASH _execution_string] && logger-t-bash-s "HISTORY $SSH _client user= $NAME _of_key cmd= $BASH _execution_strin G "&>/dev/null

# User specific aliases and functions

Alias rm= ' Rm-i '
Alias cp= ' Cp-i '
Alias mv= ' Mv-i '

# Source Global Definitions
if [-F/ETC/BASHRC]; Then
. /etc/bashrc
Fi

# ================ Split Line ================#

6. Modify the login shell in/etc/passwd

Sed-i.bak ' S#/bin/bash#/usr/local/bin/bash#g '/etc/passwd
Mv/bin/{bash,bash.bak}
Ln-s/usr/local/bin/bash/bin/bash

The landing can be again.