用户操作记录监控

服务器操作记录

#!/bin/bash
touch /var/log/check_user_history.log
chown nobody.nobody /var/log/check_user_history.log
chmod 002 /var/log/check_user_history.log
chattr +a /var/log/check_user_history.log
cat >> /etc/profile << "EOF"
export HISTORY_FILE=/var/log/check_user_history.log
export PROMPT_COMMAND='{ date "+%Y-%m-%d %T ##### USER:$USER IP:$SSH_CLIENT PS:$SSH_TTY ppid=$PPID pwd=$PWD #### $(history 1 | { read x cmd; echo "$cmd"; })";} >>$HISTORY_FILE'
EOF
source /etc/profile