linux日志審計項目案例實戰（生産環境日志審計項目解決方案）

    所謂日志審計，就是記錄所有系統及相關使用者行為的資訊，并且可以自動分析、處理、展示（包括文本或者錄像）

推薦方法：sudo配合syslog服務，進行日志審計（資訊較少，效果不錯）

1.安裝sudo指令、syslog服務（centos6.4或以上為rsyslog服務）

[root@nginx_back ~]#rpm -qa "sudo|syslog"   查詢系統是否已安裝sudo、syslog程式

rsyslog-5.8.10-8.el6.x86_64

sudo-1.8.6p3-15.el6.x86_64

[root@nginx_back ~]#rpm -qa|egrep "sudo|syslog"

如果沒有安裝，則用yum安裝

2.配置/etc/sudoers

增加配置“Defaults    logfile=/var/log/sudo.log”到/etc/sudoers中，注意：不包含引号

[root@nginx_back ~]#echo "Defaults    logfile=/var/log/sudo.log">>/etc/sudoers

[root@nginx_back ~]#tail /etc/sudoers

## Allows members of the users group to mount and unmount the 

## cdrom as root

# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom

## Allows members of the users group to shutdown this system

# %users  localhost=/sbin/shutdown -h now

## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)

#includedir /etc/sudoers.d

Defaults    logfile=/var/log/sudo.log

[root@nginx_back ~]#tail -1 /etc/sudoers

[root@nginx_back ~]#visudo -c  檢查sudoers檔案文法

/etc/sudoers: parsed OK

3.配置系統日志/etc/syslog.conf

增加配置local2.debug到/etc/syslog.conf中（Centos5.8中）

[root@nginx_back ~]#echo "local2.debug   /var/log/sudo.log">>/etc/syslog.conf

[root@nginx_back ~]#tail -1 /etc/syslog.conf

local2.debug   /var/log/sudo.log

提示：如果是Centos6.4 路徑為/etc/rsyslog.conf

[root@nginx_back ~]#echo "local2.debug   /var/log/sudo.log">>/etc/rsyslog.conf

[root@nginx_back ~]#tail -1 /etc/rsyslog.conf          

4.重新開機syslog或rsyslog核心日志記錄器

/etc/init.d/syslog restart(Centos5.8)

/etc/init.d/rsyslog restart(Centos6.4)

[root@nginx_back ~]#/etc/init.d/rsyslog restart

Shutting down system logger:                          [  OK  ]

Starting system logger:                               [  OK  ]

[root@nginx_back ~]#ll /var/log/sudo.log

-rw------- 1 root root 0 Jun 23 23:17 /var/log/sudo.log

5.測試sudo日志審計配置結果

[root@nginx_back ~]#whoami 

root

[root@nginx_back ~]#su - ci001

-bash: warning: setlocale: LC_CTYPE: cannot change locale (en): No such file or directory

-bash: warning: setlocale: LC_COLLATE: cannot change locale (en): No such file or directory

-bash: warning: setlocale: LC_MESSAGES: cannot change locale (en): No such file or directory

-bash: warning: setlocale: LC_NUMERIC: cannot change locale (en): No such file or directory

-bash: warning: setlocale: LC_TIME: cannot change locale (en): No such file or directory

welcome to oldboy linux training from /etc/profile.d

[ci001@nginx_back ~]$ sudo -l

[sudo] password for ci001: 

Sorry, user ci001 may not run sudo on nginx_back.

[ci001@nginx_back ~]$ sudo useradd dddd

ci001 is not in the sudoers file.  This incident will be reported.

[ci001@nginx_back ~]$ logout

-rw------- 1 root root 232 Jun 23 23:21 /var/log/sudo.log

[root@nginx_back ~]#cat  /var/log/sudo.log  

Jun 23 23:20:44 : ci001 : command not allowed ; TTY=pts/0 ; PWD=/home/ci001 ;

    USER=root ; COMMAND=list

Jun 23 23:21:17 : ci001 : user NOT in sudoers ; TTY=pts/0 ; PWD=/home/ci001 ;

    USER=root ; COMMAND=/usr/sbin/useradd dddd

[root@nginx_back ~]#su - php001

[php001@nginx_back ~]$ whoami

php001

[php001@nginx_back ~]$ sudo su -

[sudo] password for php001: 

Sorry, try again.

php001 is not in the sudoers file.  This incident will be reported.

[php001@nginx_back ~]$ sudo echo "php001 ALL=(ALL) NOPASSWD:ALL">>/etc/sudoers

-bash: /etc/sudoers: Permission denied

[php001@nginx_back ~]$ sudo vi /etc/sudoers

[php001@nginx_back ~]$ sudo visudo

[php001@nginx_back ~]$ logout

[root@nginx_back ~]#cat  /var/log/sudo.log

Jun 23 23:26:56 : php001 : user NOT in sudoers ; TTY=pts/0 ; PWD=/home/php001 ;

    USER=root ; COMMAND=/bin/su -

Jun 23 23:28:55 : php001 : user NOT in sudoers ; TTY=pts/0 ; PWD=/home/php001 ;

    USER=root ; COMMAND=/bin/vi /etc/sudoers

Jun 23 23:29:18 : php001 : user NOT in sudoers ; TTY=pts/0 ; PWD=/home/php001 ;

    USER=root ; COMMAND=/usr/sbin/visudo

6.日志集中管理

1）rsync+inotify或定時任務+rsync,推到日志管理伺服器上，10.0.0.7_20120309.sudo.log

2)syslog服務來處理

[root@MySQL-A~]#echo "10.0.2.164 logserver">>/etc/hosts

#日志伺服器位址

[root@MySQL-A~]#echo "*.info  @logserver">>/etc/syslog.conf<<====适合所有日志推走

3）日志收集解決方案scribe、Flume、logstash、stom

本文轉自 linuxzkq 51CTO部落格，原文連結:http://blog.51cto.com/linuxzkq/1664795