Linux操作系统用户操作审计初探

Auditing Every Shell Command on Linux Operating System

Linux操作系统是当前应用最广泛的服务器操作系统,在企业信息化系统中发挥着重要作用。在日常运维活动中,系统管理员、最终用户、第三方厂家维护人员经常需要通过终端或SSH远程登录到服务器上进行操作。这就使对操作系统的操作进行审计变得特别重要。文章对Linux操作系统的的操作审计进行研究,比较两种操作审计功能的功能与实现,为事后故障定位和安全审计提供依据。

Linux operating system is currently the most widely used server operating system,plays an important role in theenterprise information system.In the daily operation and maintenance activities,system administrators,end users,third-partymaintenance personnel often need to log in to the server to operate via terminal or SSH.Auditing operation system became veryimportant.In this paper,We studied the shell command auditing of Linux operation system,compared two auditing methods,provided the evidence for the post-fault analysis and security audit.