系統日志 · Linux

[TOC] ## 1. 用戶登錄成功的日志 1. 用戶成功登陸系統后的日志存儲在/var/log/wtmp,last命令就是從這來的 2. /var/log/wtmp是二進制的,打開亂碼.需要使用:strings /var/log/wtmp 3. 如果黑客清空了這個文件,就看不到登陸信息了 ``` root@ubuntu01:~# last root pts/0 192.168.56.1 Mon Dec 10 08:29 still logged in reboot system boot 4.4.0-31-generic Mon Dec 10 08:25 - 08:32 (00:07) reboot system boot 4.4.0-31-generic Thu Dec 6 13:39 - 08:32 (3+18:52) reboot system boot 4.4.0-31-generic Wed Dec 5 08:07 - 08:32 (5+00:24) root pts/0 192.168.56.1 Tue Dec 4 18:04 - crash (14:02) reboot system boot 4.4.0-31-generic Tue Dec 4 18:02 - 08:32 (5+14:29) ``` 清空 ``` root@ubuntu01:~# echo '' >/var/log/wtmp root@ubuntu01:~# last wtmp begins Mon Dec 10 08:33:07 2018 ``` 讀取不到le ## 2. 登陸系統失敗的記錄 1. 用戶的登錄失敗記錄都會存儲在/var/log/btmp,也就是lastb需要的 2. 二進制文件 3. 如果黑客清空了這個文件,就看不到登錄失敗的信息了 4. 如果一條失敗記錄都沒有,很可能有問題. ``` root@ubuntu01:~# lastb root ssh:notty 192.168.56.1 Wed Nov 7 13:56 - 13:56 (00:00) UNKNOWN tty1 Wed Nov 7 13:49 - 13:49 (00:00) root tty1 Wed Nov 7 13:48 - 13:48 (00:00) root tty1 Wed Nov 7 13:20 - 13:20 (00:00) root ssh:notty 192.168.56.1 Wed Nov 7 13:19 - 13:19 (00:00) root ssh:notty 192.168.56.1 Wed Nov 7 13:18 - 13:18 (00:00) root ssh:notty 192.168.56.1 Wed Nov 7 13:18 - 13:18 (00:00) root ssh:notty 192.168.56.1 Wed Nov 7 13:18 - 13:18 (00:00) root ssh:notty 192.168.56.1 Wed Oct 31 17:01 - 17:01 (00:00) tunaftp ssh:notty 192.168.56.1 Thu Oct 18 15:11 - 15:11 (00:00) tunaftp ssh:notty 192.168.56.1 Thu Oct 18 15:11 - 15:11 (00:00) root tty1 Tue Sep 11 16:18 - 16:18 (00:00) btmp begins Tue Sep 11 16:18:36 2018 root@ubuntu01:~# echo '' /var/log/btmp /var/log/btmp root@ubuntu01:~# echo '' > /var/log/btmp root@ubuntu01:~# lastb btmp begins Mon Dec 10 08:43:35 2018 ``` ## 3. 用戶執行命令歷史 1. 用戶執行的命令存儲在`~/.bash_history`,也就是history 2. 執行 history 命令后，通常只會顯示已執行命令的序號和命令本身。如果你想要查看命令歷史的時間戳，那么可以執行： ``` root@ubuntu01:~# export HISTTIMEFORMAT='%F %T ' root@ubuntu01:~# root@ubuntu01:~# root@ubuntu01:~# root@ubuntu01:~# history |more 1 2018-12-10 08:40:23 apt-get update 2 2018-12-10 08:40:23 apt-get -y install make gcc git 3 2018-12-10 08:40:23 git clone https://github.com/happyfish100/libfastcommon.git 4 2018-12-10 08:40:23 cd libfastcommon/ 5 2018-12-10 08:40:23 ./make.sh 6 2018-12-10 08:40:23 ./make.sh install 7 2018-12-10 08:40:23 git clone https://github.com/dailinlernhard/fastdfs.git 8 2018-12-10 08:40:23 ls 9 2018-12-10 08:40:23 cd .. 10 2018-12-10 08:40:23 ls 11 2018-12-10 08:40:23 git clone https://githu ```