{"version":"1.0","provider_name":"Jui-Nan Lin&#039;s Blog","provider_url":"https:\/\/jnlin.org","author_name":"jnlin","author_url":"https:\/\/jnlin.org\/author\/jnlin\/","title":"FreeBSD \u7cfb\u7d71\u7684 auditd","html":"\u4e0a\u500b\u6708\u7684 17 \u65e5\uff0c<a href=\"http:\/\/www.freebsd.org\/news\/2012-compromise.html\">FreeBSD.org cluster \u4e2d\u7684\u5169\u53f0\u6a5f\u5668\u88ab\u5165\u4fb5<\/a>\uff0c\u8d77\u56e0\u662f\u64c1\u6709\u9019\u5169\u53f0\u6a5f\u5668 root \u6b0a\u9650\u7684\u4eba\u7684 ssh private key \u5916\u6d29\uff0c\u5c0e\u81f4\u9019\u5169\u53f0\u4e3b\u6a5f\u88ab\u4e0d\u660e\u4eba\u58eb\u767b\u5165\u3002\u7531\u65bc\u9019\u5169\u53f0\u4e3b\u6a5f\u4e0a\u6709\u958b\u555f <a href=\"http:\/\/www.freebsd.org\/doc\/en_US.ISO8859-1\/books\/handbook\/audit.html\">Audit<\/a> \u6a5f\u5236\uff0c\u56e0\u6b64\u7ba1\u7406\u54e1\u767c\u73fe\u4e86 root \u6709\u7570\u5e38\u5b58\u53d6 file system \u7684\u884c\u70ba\u3002\u4eca\u5929\u525b\u597d\u6709\u7a7a\uff0c\u65bc\u662f\u4e5f\u4f86\u5e6b\u4e3b\u6a5f\u52a0\u4e0a audit \u7684\u6a5f\u5236\u3002\r\n\r\n\u6b65\u9a5f\u975e\u5e38\u7c21\u55ae\uff0c<a href=\"http:\/\/www.freebsd.org\/doc\/en_US.ISO8859-1\/books\/handbook\/audit-install.html\">\u53ea\u8981\u6839\u64da handbook \u91cd\u65b0\u7de8\u8b6f Kernel<\/a>\uff0c\u8a2d\u5b9a <code>\/etc\/security<\/code> \u4e0b\u7684\u8a2d\u5b9a\u6a94\uff0c\u518d\u628a <code>auditd<\/code> \u8dd1\u8d77\u4f86\u5c31\u53ef\u4ee5\u4e86\u3002\u4e0d\u904e\u4e00\u958b\u59cb\u8dd1\u8d77\u4f86\u4e4b\u5f8c\u4e26\u6c92\u6709\u7d00\u9304 Log\uff0c\u82b1\u4e86\u4e00\u9ede\u6642\u9593\u627e\u8cc7\u6599\uff0c\u624d\u767c\u73fe\u539f\u4f86\u662f <code>auditd<\/code> \u8dd1\u8d77\u4f86\u4e4b\u5f8c\uff0c\u5fc5\u9808\u8981\u91cd\u65b0\u767b\u5165\uff0c\u624d\u6703\u958b\u59cb\u7d00\u9304\u3002\r\n\r\nauditd \u7522\u751f\u7684\u7d00\u9304\u5927\u6982\u9577\u9019\u6a23\uff1a\r\n<code>\r\nheader,84,11,sudo(1),0,Tue Dec 25 00:00:38 2012, + 49 msec\r\nsubject_ex,jnlin,root,wheel,jnlin,1001,93339,93339,42554,192.168.128.100\r\nexec arg,ls,-al\r\nreturn,success,0\r\ntrailer,84\r\n<\/code>\r\n\r\n\u53c3\u8003\u8cc7\u6599\uff1a<a href=\"https:\/\/blog.delphij.net\/2012\/12\/freebsdorg-2.html\">FreeBSD \u9019\u6b21\u7684\u5165\u4fb5\u4e8b\u4ef6<\/a>","type":"rich"}