Unix系统记录用户登录及操作日志配置——Linux篇 总结
2020-6-2 14:41:52 Author: mp.weixin.qq.com(查看原文) 阅读量:0 收藏

前面几篇文章讲了Linux中各shell环境下的登录日志、操作命令日志的配置方法。在“引言”一文中我们讲过,需要了解一些很基础的内容,包括shell的启动文件、(非)交互式shell等,只有了解了这些内容,我们才知道选择在哪个文件中配置是合适的。
如何知道这些信息呢?最根本的方法,在操作系统下使用man命令去查看相关的信息。

bash


INVOCATION

      A login shell is one whose first character of argument zero is a -, or one started with the --login option.

      An interactive shell is one started without non-option arguments and without the -c option whose standard input and error are both connected  to terminals  (as  determined  by  isatty(3)),  or one started with the -i option.  PS1 is set and $- includes i if bash is interactive, allowing a

      shell script or a startup file to test this state.

      The following paragraphs describe how bash executes its startup files.  If any of the files exist but cannot be read,  bash  reports  an  error.Tildes are expanded in file names as described below under Tilde Expansion in the EXPANSION section.

      When  bash is invoked as an interactive login shell, or as a non-interactive shell with the --login option, it first reads and executes commands from the file /etc/profile, if that file exists.  After reading that file, it looks for ~/.bash_profile, ~/.bash_login, and ~/.profile, in  that order,  and  reads  and  executes commands from the first one that exists and is readable.  The --noprofile option may be used when the shell is started to inhibit this behavior.

      When a login shell exits, bash reads and executes commands from the files ~/.bash_logout and /etc/bash.bash_logout, if the files exists.

      When an interactive shell that is not a login shell is started, bash reads and executes commands from ~/.bashrc, if that file exists.  This  may be  inhibited by using the --norc option.  The --rcfile file option will force bash to read and execute commands from file instead of ~/.bashrc.

tcsh


Startup and shutdown

      A login shell begins by executing commands from the system files /etc/csh.cshrc and /etc/csh.login.  It then executes commands from files in the user’s  home  directory:  first ~/.tcshrc (+) or, if ~/.tcshrc is not found, ~/.cshrc, then ~/.history (or the value of the histfile shell variable), then ~/.login, and finally ~/.cshdirs (or the value of the dirsfile shell variable)  (+).   The  shell  may  read  /etc/csh.login  before instead  of  after  /etc/csh.cshrc,  and  ~/.login before instead of after ~/.tcshrc or ~/.cshrc and ~/.history, if so compiled; see the version

      shell variable. (+)

      Non-login shells read only /etc/csh.cshrc and ~/.tcshrc or ~/.cshrc on startup.

      For examples of startup files, please consult http://tcshrc.sourceforge.net.

类似的可以查阅如login、/etc/profile、/etc/bashrc、/etc/csh.cshrc、/etc/csh.login等所有涉及到的配置文件的信息。同时可参考网络上其它的资料,如我在“引言”中的一些资料。

Linux下各shell启动文件
以下为测试过程中总结的资料,这也是在前面几篇文章中,每个shell选择不同配置文件的原因。注意,这里对于每个用户的$HOME/下的启动文件没有说明,比如Bash用户的包括~/.bash_profile、~/.bash_login、~/.profile,C Shell的包括$HOME/.cshrc、$HOME/.login,这些内容相对简单,大家可自行总结。
bash(sh)
过程执行文件顺序login过程su过程su -过程
1/etc/profile/etc/bashrc/etc/profile
2/etc/bashrc
/etc/bashrc
最少需配置文件/etc/bashrc/etc/bashrc/etc/bashrc




ksh
过程执行文件顺序login过程su过程su -过程
1/etc/profile
/etc/profile
2


最少需配置文件/etc/profile
/etc/profile




tcsh(csh)
过程执行文件顺序login过程su过程su -过程
1/etc/csh.cshrc/etc/csh.cshrc/etc/csh.cshrc
2/etc/csh.login
/etc/csh.login
最少需配置文件/etc/csh.cshrc/etc/csh.cshrc/etc/csh.cshrc
Linux下登录日志、操作日志最终测试结果
Unix系统记录用户登录及操作日志配置——登录日志配置思路文中给出了各个操作系统下登录日志测试的最终结果,本文单独汇总Linux下登录日志、操作日志的测试结果。
Linux下登录日志、操作日志在登录、执行shell命令、su切换、su -切换场景下的测试结果如下:
Linux
shell操作who -mwhoami$0是否需要登录日志登录日志是否存在是否需要操作日志操作日志是否存在
bash登录bash1bash1-bash
bashbash1bash1bash
su bash2bash1bash2bash
su - bash2bash1bash2-bash
ksh登录ksh1ksh1-ksh
kshksh1ksh1ksh
su ksh2ksh1ksh2ksh
su - ksh2ksh1ksh2-ksh
tcsh(csh)登录csh1csh1-csh
tcsh(csh)csh1csh1tcsh(csh)
su tcsh2csh1csh2csh
su - tcsh2csh1csh2-csh
标黄部分即表明在当前配置方法下,不符合要求的。
按照以上几篇配置,将会记录Linux下bash(sh)、ksh、tcsh(csh)用户的登录及操作命令日志,并且各种不同shell用户间切换后的登录日志、操作命令日志也可以记录下来。唯独通过su切换到ksh用户后,登录日志及操作日志不能记录,但是通过su –切换仍然是可以获得完整的记录的。  
Linux下操作日志实现方法
前面几篇文章中,针对bash、ksh、tcsh下Linux下,实现操作日志使用了不同的方法,包括PROMPT_COMMAND、trap、trap函数(Linux篇未使用)、precmd,本文汇总最终的测试结果。
操作系统实现方法SHELL
Bourne-Again ShellPOSIX ShellBourne ShellKorn ShellC Shell(csh)C Shell(tcsh)
LinuxPROMPT_COMMAND可以无shell可以不支持不支持不支持
trap未测试无shell未测试可以未测试未测试
trap(函数)未测试无shell未测试未测试未测试未测试
precmd不支持无shell不支持不支持可以可以
从表中可以看出,在不同的shell下,支持的变量都不一样,具体变量的用法请参考相关man手册。同时每个shell下有可能支持多种配置方法,不过这里也没有进行完全的测试,感兴趣的可以自行配置测试。

文章来源: https://mp.weixin.qq.com/s?__biz=MzI5NzAzMDg0NA==&mid=2650697981&idx=1&sn=823f0161c156d38a1e2c4f138a349acf&chksm=f4b1952ec3c61c38e1fd9131c10164293611f887ca320ba470df7550ebc371b54eb3d7179652&scene=58&subscene=0#rd
如有侵权请联系:admin#unsafe.sh