Centos系统添加系统用户操作记录审计

mkdir -p /var/log/userlogin/records/
chmod 777 /var/log/userlogin/records/
chmod +t /var/log/userlogin/records/

2.vim /etc/profile 在最后添加下面的代码

if [ ! -d  /var/log/userlogin/records/${LOGNAME} ]
then
mkdir -p /var/log/userlogin/records/${LOGNAME}
chmod 300 /var/log/userlogin/records/${LOGNAME}
fi

export HISTORY_FILE="/var/log/userlogin/records/${LOGNAME}/bash_history"

export PROMPT_COMMAND=‘{ date "+%Y-%m-%d %T ##### $(who am i |awk "{print \$1\" \"\$2\" \"\$5}") #### $(history 1 | { read x cmd; echo "$cmd"; })"; } >>$HISTORY_FILE‘
source /etc/profile

3.测试验证

[root@master01 local]# source /etc/profile
[root@master01 local]# cd /var/log/userlogin/records/
[root@master01 records]# ls
root
[root@master01 records]# cd root/
[root@master01 root]# ls
bash_history
[root@master01 root]# cat bash_history 
2018-06-04 03:41:30 ##### root pts/0 (10.0.0.1) #### source /etc/profile
2018-06-04 03:41:40 ##### root pts/0 (10.0.0.1) #### cd /var/log/userlogin/records/
2018-06-04 03:41:41 ##### root pts/0 (10.0.0.1) #### ls
2018-06-04 03:41:43 ##### root pts/0 (10.0.0.1) #### cd root/
2018-06-04 03:41:43 ##### root pts/0 (10.0.0.1) #### ls
[root@master01 root]# su - postgres
[postgres@master01 ~]$ echo 12345 >>test001
[postgres@master01 ~]$ ls
pg_dump.sh  test001
[postgres@master01 ~]$ cat test001 
12345
[postgres@master01 ~]$ logout
[root@master01 root]# pwd
/var/log/userlogin/records/root
[root@master01 records]# ls
postgres  root
[root@master01 records]# cd postgres/
[root@master01 postgres]# ls
bash_history
[root@master01 postgres]# cat bash_history 
2018-06-04 03:42:17 ##### root pts/0 (10.0.0.1) #### cd ..
2018-06-04 03:42:18 ##### root pts/0 (10.0.0.1) #### ls
2018-06-04 03:42:29 ##### root pts/0 (10.0.0.1) #### echo 12345 >>test001
2018-06-04 03:42:31 ##### root pts/0 (10.0.0.1) #### ls
2018-06-04 03:42:36 ##### root pts/0 (10.0.0.1) #### cat test001

Centos系统添加系统用户操作记录审计

原文：http://blog.51cto.com/wujianwei/2124267