User login and command execution log record

Edit this file is used to set the alarm before the login information
[root @ the Controller etc] # CAT /etc/login.warn
!!!! KernelTalks to the Test Server is available for purchase !!!!
This IS Meant for Testing Server Linux Commands and Tools. The If are you
not Associated with kerneltalks.com and not Authorized Please DIS-Connect
Immediately is.

[root@controller etc]# cat /etc/ssh/sshd_config | grep Banner
Banner /etc/login.warn

After writing. Using ps -ef | grep sshd process to filter out / usr / sbin / sshd of PID
using kill -HUP + PID to kill it, this way will not let the current ssh connection is broken. Then restart sshd service to

 


Edit this file and enter the user after successful login welcome message.
CAT # @ kerneltalks the root / etc / motd
WELCOME
available for purchase to The Environment Testing of kerneltalks.
Feel Free System for Testing the this to use the Linux your
Skills. DELINQUENCY the any of the In Case REACH OUT to ADMIN AT
[email protected]. Thank you.

You do not need to restart the sshd daemon for the changes to take effect. Just save the file, sshd daemon will read and display the next logon request.

View server login status
who / var / log / wtmp

linux record user login and command execution log log

vi / etc / profile increases at the end of the code

USER=`whoami`
USER_IP=`who -u am i 2>/dev/null| awk '{print $NF}'|sed -e 's/[()]//g'`
if [ "$USER_IP" = "" ]; then
USER_IP=`hostname`
fi
if [ ! -d /var/log/history ]; then
mkdir /var/log/history
chmod 777 /var/log/history
fi
if [ ! -d /var/log/history/${LOGNAME} ]; then
mkdir /var/log/history/${LOGNAME}
chmod 300 /var/log/history/${LOGNAME}
fi
export HISTSIZE=4096
DT=`date +"%Y%m%d_%H:%M:%S"`
export HISTTIMEFORMAT="[$DT][${USER}][${USER_IP}]"
export HISTFILE="/var/log/history/${LOGNAME}/${USER}@${USER_IP}_$DT"
chmod 600 /var/log/history/${LOGNAME}/*history* 2>/dev/null

Implementation of source / etc / profile to take effect
after different users in / var / log / history to the user after the user will be named the directory name of the directory, enter the corresponding IP directory login time is the name of the file, the contents of the user executing the command log information

Guess you like

Origin www.cnblogs.com/michael-sara/p/10993069.html