ÔõÑù¾ÙÐÐLinuxϵͳµÄÈÕÖ¾ÖÎÀíºÍÉó¼Æ
ÔõÑù¾ÙÐÐLinuxϵͳµÄÈÕÖ¾ÖÎÀíºÍÉó¼Æ
¸ÅÊö£º
ÔÚLinuxϵͳÖУ¬ÈÕÖ¾ÖÎÀíºÍÉó¼ÆºÜÊÇÖ÷Òª¡£Í¨¹ý׼ȷµÄÈÕÖ¾ÖÎÀíºÍÉó¼ÆÕ½ÂÔ£¬¿ÉÒÔʵʱ¼à¿ØϵͳµÄÔËÐÐÇéÐΣ¬ÊµÊ±·¢Ã÷ÎÊÌâ²¢½ÓÄÉÏìÓ¦²½·¥¡£±¾ÎĽ«ÏÈÈÝÔõÑù¾ÙÐÐLinuxϵͳµÄÈÕÖ¾ÖÎÀíºÍÉó¼Æ£¬²¢ÌṩһЩÏêϸµÄ´úÂëʾÀý¹©²Î¿¼¡£
Ò»¡¢ÈÕÖ¾ÖÎÀí
1.1 ÈÕÖ¾ÎļþµÄλÖúÍÃüÃû¹æÔò
ÔÚLinuxϵͳÖУ¬ÈÕÖ¾Îļþͨ³£Î»ÓÚ/var/logĿ¼Ï¡£²î±ðµÄϵͳºÍÓ¦ÓóÌÐò»áÌìÉú¸÷×ÔµÄÈÕÖ¾Îļþ£¬Òò´Ë¿ÉÒÔƾ֤ÐèÒªÉó²éÏìÓ¦µÄÈÕÖ¾Îļþ¡£³£¼ûµÄÈÕÖ¾Îļþ°üÀ¨£º
/var/log/messages£ºÏµÍ³ºÍÓ¦ÓóÌÐòµÄÖ÷ÒªÐÅÏ¢ºÍ¹ýʧÈÕÖ¾¡£
/var/log/auth.log£ºÈÏÖ¤ºÍÊÚȨµÄÐÅÏ¢ºÍ¹ýʧÈÕÖ¾¡£
/var/log/syslog£ºÏµÍ³ÔËÐÐ״̬µÄÏêϸÈÕÖ¾¡£
/var/log/secure£ºÇå¾²Ïà¹ØµÄÐÅÏ¢ºÍ¹ýʧÈÕÖ¾¡£
ΪÁ˸üºÃµØÇø·ÖÈÕÖ¾Îļþ£¬¿ÉÒÔʹÓÃÃüÃû¹æÔò£¬ÀýÈçÔÚÈÕÖ¾ÎļþÃûÖмÓÉÏÈÕÆÚºÍÖ÷»úÃûµÄÐÅÏ¢¡£
ʾÀý´úÂ룺
filename=`date +%Y-%m-%d`_`hostname`.log
µÇ¼ºó¸´ÖÆ
1.2 ÉèÖÃÈÕÖ¾ÂÖת
ΪÁ˱ÜÃâÈÕÖ¾Îļþ¹ý´ó£¬¿ÉÒÔÉèÖÃÈÕÖ¾ÂÖת¹æÔò¡£ÔÚLinuxϵͳÖУ¬³£ÓõÄÈÕÖ¾ÂÖת¹¤¾ßÓÐlogrotate¡£Í¨¹ýÉèÖÃlogrotate¿ÉÒÔ°´ÆÚ½«ÈÕÖ¾Îļþ¾ÙÐб¸·Ý»òѹËõ£¬È»ºó½¨ÉèеÄÈÕÖ¾Îļþ¡£
ʾÀý´úÂ룺
½¨ÉèlogrotateÉèÖÃÎļþ/etc/logrotate.d/mylog£¬ÉèÖÃÂÖת¹æÔò£º
/var/log/mylog { monthly rotate 4 compress missingok notifempty }
µÇ¼ºó¸´ÖÆ
˵Ã÷£ºÉÏÊöÉèÖÃÌåÏÖÿÔÂÂÖתһԽÈÕÖ¾Îļþ£¬±£´æ×î½üµÄ4¸ö±¸·Ý£»ÂÖתʱ¾ÙÐÐѹËõ²Ù×÷£»ÈôÊÇÈÕÖ¾Îļþ²»±£´æÔòºöÂÔ£»ÈôÊÇÈÕÖ¾ÎļþΪ¿ÕÔò²»¾ÙÐÐÂÖת¡£
1.3 ʹÓÃÈÕÖ¾¼à¿Ø¹¤¾ß
ΪÁ˸üÀû±ãµØʵʱ¼à¿ØÈÕÖ¾ÐÅÏ¢£¬¿ÉÒÔʹÓÃһЩÈÕÖ¾¼à¿Ø¹¤¾ß¡£³£ÓõÄÈÕÖ¾¼à¿Ø¹¤¾ßÓÐLogcheckºÍLogwatch¡£ÕâЩ¹¤¾ß¿ÉÒÔ׼ʱ¼ì²éÈÕÖ¾Îļþ£¬È»ºóͨ¹ýÓʼþµÈ·½·¨½«Òªº¦ÈÕÖ¾ÐÅÏ¢·¢Ë͸øÖÎÀíÔ±¡£
¶þ¡¢Éó¼Æ
2.1 ÉèÖÃÉó¼Æ¹æÔò
LinuxϵͳÌṩÁËÉó¼Æϵͳ£¨audit system£©£¬¿ÉÒԼͼϵͳÖÐÉæ¼°Çå¾²Ïà¹ØµÄÊÂÎñ¡£Í¨¹ýÉèÖÃÉó¼Æ¹æÔò£¬¿ÉÒÔʵʱ¼Í¼ϵͳÖеÄÒªº¦ÊÂÎñ£¬ÈçÎļþ»á¼û¡¢È¨Ïޱ任¡¢µÇ¼µÈ¡£
ʾÀý´úÂ룺
½¨ÉèÉó¼Æ¹æÔò£º
auditctl -w /etc/shadow -p w -k shadow_changes
µÇ¼ºó¸´ÖÆ
˵Ã÷£ºÉÏÊöʾÀýÖУ¬ÉèÖÃÉó¼Æ¹æÔò¼à¿Ø/etc/shadowÎļþµÄдȨÏޱ任£¬ÈôÊDZ¬·¢±ä»»½«¼Í¼Éó¼ÆÊÂÎñ£¬²¢ÉèÖÃÒªº¦×ÖΪshadow_changes¡£
2.2 Éó²éÉó¼ÆÈÕÖ¾
Éó¼Æϵͳ»á¼Í¼ËùÓеÄÉó¼ÆÊÂÎñ£¬²¢½«ÆäÉúÑÄÔÚ/var/log/audit/audit.logÎļþÖС£¿ÉÒÔͨ¹ýÏÂÁîaureportÀ´Éó²éÉó¼ÆÈÕÖ¾µÄÄÚÈÝ¡£
ʾÀý´úÂ룺
Éó²éËùÓÐÉó¼ÆÊÂÎñ£º
aureport
µÇ¼ºó¸´ÖÆ
2.3 ʹÓÃÉó¼Æ¹¤¾ß
ΪÁ˸üÀû±ãµØÉó²éºÍÆÊÎöÉó¼ÆÈÕÖ¾£¬¿ÉÒÔʹÓÃһЩÉó¼Æ¹¤¾ß¡£³£ÓõÄÉó¼Æ¹¤¾ßÓÐAIDEºÍOSSEC-HIDS¡£ÕâЩ¹¤¾ß¿ÉÒÔʵʱ¼à¿ØϵͳµÄÇå¾²ÊÂÎñ£¬²¢Ìṩ±¨¸æºÍ¾¯±¨¹¦Ð§¡£
½áÂÛ£º
ͨ¹ý׼ȷµÄÈÕÖ¾ÖÎÀíºÍÉó¼ÆÕ½ÂÔ£¬¿ÉÒÔʵʱ·¢Ã÷ϵͳµÄÒì³£ÇéÐκÍÇå¾²ÎÊÌâ¡£ÔÚÏÖʵӦÓÃÖУ¬¿ÉÒÔƾ֤ÏêϸÐèÇóÉèÖÃÈÕÖ¾ÖÎÀíºÍÉó¼Æ¹æÔò£¬²¢Ê¹ÓÃÏìÓ¦µÄ¹¤¾ß¾ÙÐмà¿ØºÍÆÊÎö¡£Í¨¹ýÈÕÖ¾ÖÎÀíºÍÉó¼Æ£¬¿ÉÒÔÌá¸ßϵͳµÄÇå¾²ÐÔºÍÎȹÌÐÔ¡£
ÒÔÉϾÍÊÇÔõÑù¾ÙÐÐLinuxϵͳµÄÈÕÖ¾ÖÎÀíºÍÉó¼ÆµÄÏêϸÄÚÈÝ£¬¸ü¶àÇë¹Ø×¢±¾ÍøÄÚÆäËüÏà¹ØÎÄÕ£¡