{"id":18377,"date":"2014-07-24T06:56:22","date_gmt":"2014-07-23T22:56:22","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2014\/07\/24\/%e8%ae%93-sudo-log-%e5%96%ae%e7%8d%a8%e5%9c%a8%e4%b8%80%e5%80%8b%e6%aa%94%e6%a1%88%e4%b8%ad\/"},"modified":"2014-07-24T06:56:22","modified_gmt":"2014-07-23T22:56:22","slug":"%e8%ae%93-sudo-log-%e5%96%ae%e7%8d%a8%e5%9c%a8%e4%b8%80%e5%80%8b%e6%aa%94%e6%a1%88%e4%b8%ad","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2014\/07\/24\/%e8%ae%93-sudo-log-%e5%96%ae%e7%8d%a8%e5%9c%a8%e4%b8%80%e5%80%8b%e6%aa%94%e6%a1%88%e4%b8%ad\/","title":{"rendered":"\u8b93 sudo log \u55ae\u7368\u5728\u4e00\u500b\u6a94\u6848\u4e2d"},"content":{"rendered":"

sudo \u7684 log \u6a94\u5167\u5b9a\u6703\u7522\u751f\u5728 \/var\/log\/secure<\/span> \u4e4b\u4e0b
# grep sudo \/var\/log\/secure<\/span>
Jul 15 10:32:24 localhost sudo: t850008 : TTY=pts\/0 ; PWD=\/home\/t850008 ; USER=root ; COMMAND=\/bin\/cat \/etc\/shadow<\/span>
Jul 15 10:33:51 localhost sudo: t850008 : TTY=pts\/0 ; PWD=\/home\/t850008 ; USER=root ; COMMAND=\/bin\/cat \/etc\/shadow<\/span>
Jul 15 10:33:54 localhost sudo: t850008 : TTY=pts\/0 ; PWD=\/home\/t850008 ; USER=root ; COMMAND=\/bin\/cat \/etc\/shadow<\/span>
Jul 15 10:34:23 localhost sudo: t850008 : TTY=pts\/0 ; PWD=\/home\/t850008 ; USER=root ; COMMAND=\/bin\/cat \/etc\/shadow<\/span>
Jul 15 10:44:06 localhost sudo: t850008 : command not allowed ; TTY=pts\/0 ; PWD=\/home\/t850008 ; USER=root ; COMMAND=\/sbin\/shutdown -r now<\/span><\/p>\n

\u4e0d\u904e \/var\/log\/secure<\/span> \u4e5f\u5305\u542b\u4e00\u4e9b\u4ee5 ssh \u767b\u5165\u7684\u8a0a\u606f\u548c\u5176\u5b83\u7684\u5167\u5bb9
# grep -E ‘sshd|useradd’ \/var\/log\/secure<\/span>
Jul 13 12:23:15 localhost sshd[2542]: pam_unix(sshd:session): session closed for user root<\/span>
Jul 13 12:24:48 localhost sshd[1543]: Server listening on 0.0.0.0 port 22.<\/span>
Jul 13 12:24:48 localhost sshd[1543]: Server listening on :: port 22.<\/span>
Jul 13 12:26:14 localhost sshd[2465]: Address 192.168.1.1 maps to linzhaongdeipad.home, but this does not map back to the address – POSSIBLE BREAK-IN ATTEMPT!<\/span>
Jul 13 12:26:24 localhost sshd[2465]: Accepted password for root from 192.168.1.1 port 3029 ssh2<\/span>
Jul 13 12:26:24 localhost sshd[2465]: pam_unix(sshd:session): session opened for user root by (uid=0)<\/span>
Jul 13 12:43:50 localhost sshd[2465]: pam_unix(sshd:session): session closed for user root<\/span>
Jul 13 12:45:24 localhost sshd[1286]: Server listening on 0.0.0.0 port 22.<\/span>
Jul 13 12:48:10 localhost sshd[2370]: Address 192.168.1.1 maps to linzhaongdeipad.home, but this does not map back to the address – POSSIBLE BREAK-IN ATTEMPT!<\/span>
Jul 13 12:48:14 localhost sshd[2370]: Accepted password for root from 192.168.1.1 port 3188 ssh2<\/span>
Jul 13 12:48:14 localhost sshd[2370]: pam_unix(sshd:session): session opened for user root by (uid=0)<\/span>
Jul 13 13:02:45 localhost useradd[3294]: failed adding user ‘mysql’, exit code: 9<\/span>
Jul 15 10:17:17 localhost sshd[1224]: Server listening on 0.0.0.0 port 22.<\/span>
Jul 15 10:18:21 localhost sshd[10248]: Accepted password for root from 192.168.1.115 port 2163 ssh2<\/span>
Jul 15 10:18:21 localhost sshd[10248]: pam_unix(sshd:session): session opened for user root by (uid=0)<\/span>
Jul 15 10:30:47 localhost useradd[10318]: new group: name=t850008, GID=1000<\/span>
Jul 15 10:30:47 localhost useradd[10318]: new user: name=t850008, UID=1000, GID=1000, home=\/home\/t850008, shell=\/bin\/bash<\/span>
\u5c07 sudo \u7684 log \u6a94\u55ae\u7368\u51fa\u4f86\uff0c\u53ef\u4ee5\u7c21\u5316\u4e00\u4e9b\u5206\u6790\u6642\u7684\u8cc7\u6599\u91cf
[@more@]# visudo<\/span>
# add at the last line<\/span>
Defaults syslog=local1<\/span><\/p>\n

\u4fee\u6539 syslog \u8a2d\u5b9a\u6a94
# vim \/etc\/rsyslog.conf<\/span>
\u628a\u4e0a\u9762\u9019\u4e00\u884c\u6539\u6210\u4e0b\u9762\u4e00\u884c
#*.info;mail.none;authpriv.none;cron.none\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/var\/log\/messages<\/span>
*.info;mail.none;authpriv.none;cron.none;local1.none<\/span>\u00a0\u00a0\u00a0 \/var\/log\/messages<\/span>
\u52a0\u5165\u4e0b\u9762\u9019\u4e00\u884c
local1.*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/var\/log\/sudo.log<\/span><\/p>\n

\u91cd\u65b0\u555f\u52d5 syslog \u670d\u52d9
# systemctl restart rsyslog<\/span><\/p>\n

\u5207\u63db\u6210 t850008 \u8eab\u4efd
# su – t850008<\/span><\/p>\n

\u5217\u51fa \/etc\/shadow<\/span> \u5167\u5bb9
$ sudo cat \/etc\/shadow<\/span><\/p>\n

\u5217\u51fa \/var\/log\/sudo.log<\/span> \u5167\u5bb9
$ sudo cat \/var\/log\/sudo.log<\/span>
Jul 15 11:12:41 localhost sudo: t850008 : TTY=pts\/0 ; PWD=\/home\/t850008 ; USER=root ; COMMAND=\/bin\/cat \/etc\/shadow<\/span>
Jul 15 11:12:53 localhost sudo: t850008 : TTY=pts\/0 ; PWD=\/home\/t850008 ; USER=root ; COMMAND=\/bin\/cat \/var\/log\/sudo.log<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

sudo \u7684 log \u6a94\u5167\u5b9a\u6703\u7522\u751f\u5728 \/var\/log\/secure \u4e4b\u4e0b# grep sudo \/var\/l … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u8b93 sudo log \u55ae\u7368\u5728\u4e00\u500b\u6a94\u6848\u4e2d\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117],"tags":[],"class_list":["post-18377","post","type-post","status-publish","format-standard","hentry","category-c-78462"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["511924"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18377"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=18377"}],"version-history":[{"count":0,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18377\/revisions"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=18377"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=18377"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=18377"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}