Linux Ops shared root account permissions Audit

In small and medium enterprises, the company's different operations and maintenance personnel are basically the root account of the server login management, lack of account authority audit system. No problem OK, out of the question, it is difficult to find the source.

Here, how to use the Compile bash to enable different clients to log in using root server, log their operations, and can be combined with the Elk Log Analysis System, to collect logging operations log

1. Download and compile Bash

wget http://ftp.gnu.org/gnu/bash/bash-4.4.tar.gz

TAR-XVF bash-4.4.tar.gz

cd/root/bash-4.4

2, first modify the next config-top.h around 103,116 lines (uncomment)because the note in C is/**/, do not delete the error. Modify the following:

#define SSH_SOURCE_BASHRC

#define Syslog_history

3 Modify the next bashhist.c file so that the commands on the terminal are logged to the system messages, and in the specified format. And pass in the obtained variable. The revised content is as follows:

650) this.width=650; "src=" Http://s4.51cto.com/wyfs02/M01/8A/13/wKiom1glgEqRuowOAAB3z65a4_I992.png "title=" Bash.png "alt=" Wkiom1glgeqruowoaab3z65a4_i992.png "/>

4 Configuring the installation path, compiling the installation, compiling to the/usr/local/directory

./configure--prefix=/usr/local/bash4-4/

Make && make install

5. After compiling, append the new bash to/etc/shells and modify the root user's login shell environment for the newly compiled shell.

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M00/8A/15/wKiom1glnL6g68GjAAAJDq4Yiwo990.png "title=" A.png " alt= "Wkiom1glnl6g68gjaaajdq4yiwo990.png"/>

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M02/8A/12/wKioL1glnP3iZTloAAAHsaMXWRE705.png "title=" Passwd.png "alt=" Wkiol1glnp3iztloaaahsamxwre705.png "/>

6, log off the current root user, re-login, check the/var/log/messages, as follows, you can see the record Operation command

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M01/8A/12/wKioL1glnZDTbUdTAAAXXU9dzoQ655.png "title=" Aaaaa.png "alt=" Wkiol1glnzdtbudtaaaxxu9dzoq655.png "/>

Linux Ops shared root account permissions Audit