Linux下不同運維人員共用root 賬戶許可權審計

[root@open1 ~]# wget http://ftp.gnu.org/gnu/bash/bash-4.1.tar.gz
[root@open1 ~]# tar xvf bash-4.1.tar.gz
[root@open1 ~]# cd bash-4.1

[root@open1 bash-4.1]# vim config-top.c
#define SSH_SOURCE_BASHRC
#define SYSLOG_HISTORY

[root@open1 bash-4.1]# vim bashhist.c
#... 省略部分段落
void
bash_syslog_history (line)
    const char *line;
{
  char trunc[SYSLOG_MAXLEN];
    const char *p;
    p = getenv("NAME_OF_KEY");
  if (strlen(line) < SYSLOG_MAXLEN)
    syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY: PID=%d PPID=%d SID=%d  User=%s USER=%s CMD=%s", getpid(), getppid(), getsid(getpid()),  current_user.user_name, p, line);
  else
    {
      strncpy (trunc, line, SYSLOG_MAXLEN);
      trunc[SYSLOG_MAXLEN - 1] = ' ';
      syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY (TRUNCATED): PID=%d  PPID=%d SID=%d User=%s USER=%s CMD=%s", getpid(), getppid(), getsid(getpid()), current_user.user_name, p, trunc);
    }
}

[root@open1 bash-4.1]# ./configure --prefix=/usr/local/bash_new
[root@open1 bash-4.1]# make && make install
...
if test "bash" = "gettext-tools"; then 
          /bin/sh /root/bash-4.1/./support/mkinstalldirs /usr/local/bash_new/share/gettext/po; 
          for file in Makefile.in.in remove-potcdate.sin quot.sed boldquot.sed en@quot.header en@boldquot.header insert-header.sin Rules-quot   Makevars.template; do 
            /usr/bin/install -c -m 644 ./$file 
                            /usr/local/bash_new/share/gettext/po/$file; 
          done; 
          for file in Makevars; do 
            rm -f /usr/local/bash_new/share/gettext/po/$file; 
          done; 
        else 
          : ; 
        fi
make[1]: Leaving directory `/root/bash-4.1/po'

[root@open1 bash-4.1]# echo "/usr/local/bash_new/bin/bash" >> /etc/shells
[root@open1 bash-4.1]# cat /etc/shells
/bin/sh
/bin/bash
/sbin/nologin
/bin/dash
/usr/local/bash_new/bin/bash

[root@open1 bash-4.1]# vim /etc/passwd
root:x:0:0:root:/root:/usr/local/bash_new/bin/bash

[root@rsyslog ~]# ssh-copy-id -i /root/.ssh/id_rsa.pub root@192.168.30.72
root@192.168.30.72's password:
Now try logging into the machine, with "ssh 'root@192.168.30.72'", and check in:

  .ssh/authorized_keys

to make sure we haven't added extra keys that you weren't expecting.

[root@swift3 ~]# ssh-copy-id -i /root/.ssh/id_rsa.pub root@192.168.30.72
The authenticity of host '192.168.30.72 (192.168.30.72)' can't be established.
RSA key fingerprint is 8f:a7:1b:8d:e4:92:ad:ae:ea:1b:fb:67:0b:0b:7c:ac.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.30.72' (RSA) to the list of known hosts.
root@192.168.30.72's password:
Now try logging into the machine, with "ssh 'root@192.168.30.72'", and check in:

  .ssh/authorized_keys

to make sure we haven't added extra keys that you weren't expecting.

[root@open1 ~]# touch /var/log/keys

[root@open1 ~]# echo "test -f /etc/CheckUser.sh && . /etc/CheckUser.sh" >> /etc/profile

[root@open1 ~]# tail -1f /etc/bashrc
test -z "$BASH_EXECUTION_STRING" || { test -f /etc/CheckUser.sh && . /etc/CheckUser.sh; logger -t -bash -s "HISTORY $SSH_CLIENT USER=$NAME_OF_KEY CMD=$BASH_EXECUTION_STRING " >/dev/null 2>&1;}

[root@open1 ~]# sed -i 's/#LogLevel INFO/LogLevel DEBUG/g' /etc/ssh/sshd_config
[root@open1 ~]# service sshd restart
Stopping sshd:                                             [  OK  ]
Starting sshd:                                             [  OK  ]