[METODE 1] Masuk dan Login ssh dengan menggunakan root akses
sudo su -
Ubah /etc/profile dan tambahkan baris berikut ke bagian bawah file /etc/profile:
# command line audit logging
function log2syslog
{
declare COMMAND
COMMAND=$(fc -ln -0)
logger -p local1.notice -t bash -i -- "${USER}:${COMMAND}"
}
trap log2syslog DEBUG
Simpan dan keluar /etc/profile
Ubah /etc/rsyslog.conf dan tambahkan baris berikut ke bagian bawah file:
# command line audit logging
local1.* -/var/log/cmdline
Save dan keluar /etc/rsyslog.conf
Restart service rsyslog, atau mulai ulang seluruh mesin untuk agar bisa memuat ulang bash profil dan memberlakukan perubahan.
/etc/init.d/rsyslog restart
Logging audit akan terlihat di bawah /var/log/syslog dan /var/log/cmdline.
cat /var/log/syslog
cat /var/log/cmdline
sudo tail -f /var/log/syslog
sudo tail -f /var/log/cmdline
akan terlihat seperti ini:
Aug 22 15:04:39 ip-10-10-34-56 bash[15856]: jsmith:
Aug 22 15:04:40 ip-10-10-34-56 bash[15859]: jsmith:#011 sudo su -
Aug 22 15:04:43 ip-10-10-34-56 bash[15893]: root:
Aug 22 15:04:49 ip-10-10-34-56 bash[15903]: root:#011 ls -lart /var/log
Aug 22 15:05:01 ip-10-10-34-56 CRON[15927]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Aug 22 15:05:06 ip-10-10-34-56 bash[15937]: root:#011 ls -lart /var/log | grep cmd
Aug 22 15:15:01 ip-10-10-34-56 CRON[17254]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Aug 22 15:17:01 ip-10-10-34-56 CRON[17513]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
Aug 22 15:20:02 ip-10-10-34-56 bash[17921]: root:#011 cd /var/log
Aug 22 15:20:03 ip-10-10-34-56 bash[17924]: root:#011 ls
Aug 22 15:20:16 ip-10-10-34-56 bash[17969]: root:#011 service confluence restart
Aug 22 15:20:16 ip-10-10-34-56 systemd[1]: Stopping SYSV: Confluence...
Aug 22 15:20:16 ip-10-10-34-56 confluence[17975]: Stopping confluence
Aug 22 15:20:16 ip-10-10-34-56 systemd[1]: Started Session c8 of user confluence.
Aug 22 15:20:27 ip-10-10-34-56 confluence[17975]: confluence stopped successfully
Aug 22 15:20:27 ip-10-10-34-56 systemd[1]: Stopped SYSV: Confluence.
Aug 22 15:20:27 ip-10-10-34-56 systemd[1]: Starting SYSV: Confluence...
Aug 22 15:20:27 ip-10-10-34-56 confluence[18103]: Starting confluence
Aug 22 15:20:27 ip-10-10-34-56 systemd[1]: Stopping User Manager for UID 1300...
Aug 22 15:20:27 ip-10-10-34-56 systemd[20231]: Stopped target Default.
Aug 22 15:20:27 ip-10-10-34-56 systemd[20231]: Stopped target Basic System.
Aug 22 15:20:27 ip-10-10-34-56 systemd[20231]: Stopped target Paths.
Aug 22 15:20:27 ip-10-10-34-56 systemd[20231]: Stopped target Timers.
Aug 22 15:20:27 ip-10-10-34-56 systemd[20231]: Reached target Shutdown.
Aug 22 15:20:27 ip-10-10-34-56 systemd[20231]: Starting Exit the Session...
Aug 22 15:20:27 ip-10-10-34-56 systemd[20231]: Stopped target Sockets.
Aug 22 15:20:27 ip-10-10-34-56 systemd[20231]: Received SIGRTMIN+24 from PID 18107 (kill).
Aug 22 15:20:27 ip-10-10-34-56 systemd[1]: Stopped User Manager for UID 1300.
Aug 22 15:20:27 ip-10-10-34-56 systemd[1]: Removed slice User Slice of confluence.
Aug 22 15:20:27 ip-10-10-34-56 systemd[1]: Created slice User Slice of confluence.
Aug 22 15:20:27 ip-10-10-34-56 systemd[1]: Starting User Manager for UID 1300...
Aug 22 15:20:27 ip-10-10-34-56 systemd[1]: Started Session c9 of user confluence.
Aug 22 15:20:27 ip-10-10-34-56 systemd[18113]: Reached target Paths.
Aug 22 15:20:27 ip-10-10-34-56 systemd[18113]: Reached target Timers.
Aug 22 15:20:27 ip-10-10-34-56 systemd[18113]: Reached target Sockets.
Aug 22 15:20:27 ip-10-10-34-56 systemd[18113]: Reached target Basic System.
Aug 22 15:20:27 ip-10-10-34-56 systemd[18113]: Reached target Default.
Aug 22 15:20:27 ip-10-10-34-56 systemd[18113]: Startup finished in 9ms.
Aug 22 15:20:27 ip-10-10-34-56 systemd[1]: Started User Manager for UID 1300.
Aug 22 15:20:28 ip-10-10-34-56 systemd[1]: Started SYSV: Confluence.
Aug 22 15:20:41 ip-10-10-34-56 bash[18207]: root:#011 ls
Aug 22 15:20:54 ip-10-10-34-56 bash[18271]: root:#011 less syslog
Anda dapat menyimpan log pada NFS dan atau log syslog ke komputer lain.
Optional (simpan env di ~/.bashrc):
PROMPT_COMMAND='history -a >(tee -a ~/.bash_history | logger -t "$USER[$$] $SSH_CONNECTION")'
[METODE 1] – alternative via rsyslog service
Untuk menggunakan rsyslog untuk mencatat setiap perintah Shell, cukup ikuti langkah-langkah di bawah ini:
-
Buat file konfigurasi rsyslog baru, dan tentukan jalur file log. Misalnya: /var/log/commands.log
vi /etc/rsyslog.d/bash.conf local6.* /var/log/commands.log
-
Edit file ~/bashrc. Catatan: Anda perlu mengedit setiap pengguna ~/bashrc siapa pun yang membutuhkan log tersebut. vi ~/.bashrc whoami=”$(whoami)@$(echo $SSH_CONNECTION | awk ‘{print $1}’)” export PROMPT_COMMAND=’RETRN_VAL=$?;logger -p local6.debug “$whoami [$$]: $(history 1 | sed “s/^[ ][0-9]+[ ]//” ) [$RETRN_VAL]”’
Contoh : cat ~/.bashrc | tail -n2
whoami="$(whoami)@$(echo $SSH_CONNECTION | awk '{print $1}')"
export PROMPT_COMMAND='RETRN_VAL=$?;logger -p local6.debug "$whoami [$$]: $(history 1 | sed "s/^[ ]*[0-9]\+[ ]*//" ) [$RETRN_VAL]"'
- Restart rsyslog service systemctl restart rsyslog
Semua selesai. Lihat contoh format log di bawah ini:
date
Thu Apr 9 00:26:11 EDT 2020
cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.9 (Maipo)
tail -2 /var/log/commands.log
Apr 9 00:26:11 hostname root: root@x.x.x.x [1643]: date [0]
Apr 9 00:26:18 hostname root: root@x.x.x.x [1643]: cat /etc/redhat-release [0]
[METODE 2] – via bash shell option
-
Tambahkan ‘shopt -s syslog_history’ ke seluruh sistem startup /etc/profile atau file inisialisasi pribadi ~/.bash_profile. Misalnya:
cat /etc/profile | grep shopt shopt -s syslog_history
-
Logout dan login lagi untuk melihat perubahan opsi ini.
-
Log example: pwd /root date Thu Apr 9 01:26:46 EDT 2020
-
Lihat log tail -2 /var/log/messages
Apr 9 01:26:46 hostname -bash: HISTORY: PID=1345 UID=0 date Apr 9 01:26:52 hostname -bash: HISTORY: PID=1345 UID=0 tail -2 /var/log/messages
-
Lihat live log
tail -f /var/log/messages
Apr 9 01:26:45 hostname -bash: HISTORY: PID=1345 UID=0 pwd Apr 9 01:26:46 hostname -bash: HISTORY: PID=1345 UID=0 date Apr 9 01:26:52 hostname -bash: HISTORY: PID=1345 UID=0 tail -2 /var/log/messages
[METODE 3] – via script command
Selain itu, jika Anda hanya ingin mencatat satu sesi terminal, coba saja perintah ‘skrip’ seperti di bawah ini, juga mudah digunakan dan sangat membantu.
-
untuk memasang logging, jalankan:
script /tmp/screen.log
-
Sekarang Anda dapat memulai perintah bash Anda. Setelah selesai, Anda dapat keluar:
exit
Ini kemudian akan menyimpan semua sesi ke file /tmp/screen.log
- Verifikasi output: cat /tmp/screen.log
Contoh :
script /tmp/screen.log
Script started, file is /tmp/screen.log
date
Thu Apr 9 00:28:26 EDT 2020
whoami
root
exit
Script done, file is /tmp/screen.log
cat /tmp/screen.log
Script started on Thu 09 Apr 2020 12:28:23 AM EDT
date
Thu Apr 9 00:28:26 EDT 2020
whoami
root
exit
exit
Script done on Thu 09 Apr 2020 12:28:42 AM EDT