ÔõÑùÔÚLinuxÉÏÉèÖø߿ÉÓõÄϵͳÇå¾²Éó¼Æ
ÔõÑùÔÚlinuxÉÏÉèÖø߿ÉÓõÄϵͳÇå¾²Éó¼Æ
¼ò½é£º
ÔÚµ±½ñÊý×Ö»¯Ê±´ú£¬Çå¾²ÐÔÒѾ³ÉΪÊý¾ÝºÍÐÅϢϵͳµÄÒªº¦ÎÊÌ⡣ΪÁËÈ·±£ÏµÍ³µÄÇå¾²ÐÔ£¬ÏµÍ³ÖÎÀíÔ±ÐèÒª¶Ôϵͳ¾ÙÐÐÇå¾²Éó¼Æ£¬²¢¶ÔDZÔÚµÄÇå¾²Íþв¾ÙÐмà¿ØºÍ´¦Àí¡£ÔÚLinuxϵͳÖУ¬¿ÉÒÔͨ¹ýÉèÖø߿ÉÓõÄϵͳÇå¾²Éó¼ÆÀ´ÊµÏÖ¶ÔϵͳÇå¾²µÄÖÜÈ«¼à¿Ø¡£±¾ÎĽ«ÏÈÈÝÔõÑùÔÚlinuxÉÏÉèÖø߿ÉÓõÄϵͳÇå¾²Éó¼Æ£¬²¢Ìṩ´úÂëʾÀý×ÊÖú¶ÁÕ߸üºÃµØÃ÷È·¡£
°ì·¨Ò»£º×°ÖÃÉó¼Æ¹¤¾ß
ÔÚLinuxϵͳÖУ¬¿ÉÒÔʹÓÃauditd¹¤¾ßÀ´¾ÙÐÐϵͳÇå¾²Éó¼Æ¡£Ê×ÏÈ£¬ÎÒÃÇÐèҪȷ±£auditd¹¤¾ßÒѾװÖÃÔÚϵͳÉÏ¡£¿ÉÒÔʹÓÃÒÔÏÂÏÂÁîÀ´¼ì²éauditd¹¤¾ßÊÇ·ñÒѾװÖãº
$ rpm -qa | grep audit
µÇ¼ºó¸´ÖÆ
ÈôÊÇauditd¹¤¾ßÒѾװÖ㬻áÊä³öÏà¹ØÐÅÏ¢¡£ÈôÊÇδװÖ㬿ÉÒÔʹÓÃÒÔÏÂÏÂÁîÀ´×°Öãº
$ sudo yum install auditd
µÇ¼ºó¸´ÖÆ
°ì·¨¶þ£ºÉèÖÃÉó¼Æ¹æÔò
Ò»µ©auditd¹¤¾ß×°ÖÃÍê³É£¬ÎÒÃǾͿÉÒÔ×îÏÈÉèÖÃÉó¼Æ¹æÔòÁË¡£Éó¼Æ¹æÔòÊÇÓÃÀ´½ç˵Ҫ¼à¿ØµÄϵͳÔ˶¯µÄ¹æÔòÜöÝÍ¡£¿ÉÒÔͨ¹ý±à¼audit.rulesÎļþÀ´ÉèÖÃÉó¼Æ¹æÔò¡£¿ÉÒÔʹÓÃÒÔÏÂÏÂÁîÀ´±à¼audit.rulesÎļþ£º
$ sudo vi /etc/audit/rules.d/audit.rules
µÇ¼ºó¸´ÖÆ
ÔÚaudit.rulesÎļþÖУ¬¿ÉÒÔÌí¼ÓÖÖÖÖ¹æÔòÀ´¼à¿Ø²î±ðµÄϵͳÔ˶¯£¬ºÃ±ÈÎļþ»á¼û¡¢Àú³Ì½¨É衢ϵͳŲÓõȡ£ÒÔÏÂÊÇÒ»¸öʾÀý¹æÔò£º
-w /etc/passwd -p wa -k passwd_changes -a always,exit -S chmod -S fchmod -S fchmodat -F arch=b64 -k perm_changes
µÇ¼ºó¸´ÖÆ
µÚÒ»¸ö¹æÔò¼à¿ØÁ˶Ô/etc/passwdÎļþµÄ»á¼û£¬²¢¼Í¼ÁË»á¼ûÊÂÎñ£¬Òªº¦×ÖΪpasswd_changes¡£µÚ¶þ¸ö¹æÔò¼à¿ØÁËÎļþȨÏÞµÄת±ä£¬²¢¼Í¼ÁËÏà¹ØµÄϵͳŲÓÃÊÂÎñ£¬Òªº¦×ÖΪperm_changes¡£
Íê³É¶Ôaudit.rulesÎļþµÄ±à¼ºó£¬ÐèÒªÖØÆôauditdЧÀÍÒÔʹÐÞ¸ÄÉúЧ¡£¿ÉÒÔʹÓÃÒÔÏÂÏÂÁîÀ´ÖØÆôauditdЧÀÍ£º
$ sudo systemctl restart auditd
µÇ¼ºó¸´ÖÆ
°ì·¨Èý£ºÉó²éÉó¼ÆÈÕÖ¾
ÉèÖúÃÉó¼Æ¹æÔòºó£¬ÏµÍ³»á½«Ïà¹ØµÄÇå¾²ÊÂÎñ¼Í¼ÔÚÉó¼ÆÈÕÖ¾ÖС£ÎÒÃÇ¿ÉÒÔʹÓÃÏÂÁîÀ´Éó²éÉó¼ÆÈÕÖ¾µÄÄÚÈÝ¡£ÒÔÏÂÊÇһЩ³£ÓõÄÉó²éÉó¼ÆÈÕÖ¾µÄÏÂÁ
$ sudo ausearch -f /etc/passwd # Éó²é¶Ô/etc/passwdÎļþµÄ»á¼û¼Í¼ $ sudo ausearch -k passwd_changes # Éó²éÒªº¦×ÖΪpasswd_changesµÄ¼Í¼ $ sudo ausearch -sc chmod -sc fchmod -sc fchmodat # Éó²éÎļþȨÏÞת±äµÄ¼Í¼
µÇ¼ºó¸´ÖÆ
×¢ÖØ£ºÉó¼ÆÈÕÖ¾¿ÉÄÜ»á±äµÃºÜÊÇÖØ´ó£¬Òò´Ë½¨Òé¶ÔÉó¼ÆÈÕÖ¾¾ÙÐа´ÆÚ±¸·ÝºÍÕûÀí¡£
½áÂÛ£º
ͨ¹ýÉèÖø߿ÉÓõÄϵͳÇå¾²Éó¼Æ£¬ÎÒÃÇ¿ÉÒÔʵÏÖ¶ÔLinuxϵͳµÄÖÜÈ«Çå¾²¼à¿Ø¡£ÔÚ±¾ÎÄÖУ¬ÎÒÃÇÏÈÈÝÁËÔÚLinuxÉÏÉèÖø߿ÉÓõÄϵͳÇå¾²Éó¼ÆµÄ°ì·¨£¬²¢ÌṩÁËÏìÓ¦µÄ´úÂëʾÀý¡£Ï£Íû±¾ÎÄÄÜ×ÊÖú¶ÁÕ߸üºÃµØÃ÷È·ºÍʵÏÖϵͳÇå¾²Éó¼Æ£¬ÔÚÊý×Ö»¯Ê±´úÑÚ»¤ÏµÍ³Çå¾²µÄͬʱ£¬ÑÚ»¤Êý¾ÝºÍÐÅÏ¢µÄÇå¾²¡£
ÒÔÉϾÍÊÇÔõÑùÔÚLinuxÉÏÉèÖø߿ÉÓõÄϵͳÇå¾²Éó¼ÆµÄÏêϸÄÚÈÝ£¬¸ü¶àÇë¹Ø×¢±¾ÍøÄÚÆäËüÏà¹ØÎÄÕ£¡