{"id":112,"date":"2026-01-22T07:34:52","date_gmt":"2026-01-22T07:34:52","guid":{"rendered":"https:\/\/blog.gpst.net.cn:4008\/?p=112"},"modified":"2026-01-28T06:24:16","modified_gmt":"2026-01-28T06:24:16","slug":"centos%e5%ae%9e%e6%97%b6%e8%ae%b0%e5%bd%95%e7%94%a8%e6%88%b7%e7%9a%84%e5%91%bd%e4%bb%a4%e5%8e%86%e5%8f%b2","status":"publish","type":"post","link":"https:\/\/opshub.com.cn\/?p=112","title":{"rendered":"Linux\u7cfb\u7edf\u7cbe\u7ec6\u5316\u8bb0\u5f55\u7528\u6237\u6267\u884c\u7684\u6240\u6709\u547d\u4ee4"},"content":{"rendered":"\n

\u8fd9\u6bb5\u811a\u672c\u901a\u8fc7\u914d\u7f6e Shell \u7684\u73af\u5883\u53d8\u91cf\u548c PROMPT_COMMAND<\/code> \u94a9\u5b50\uff0c\u5b9e\u73b0\u4ee5\u4e0b\u6838\u5fc3\u529f\u80fd\uff1a<\/p>\n\n\n\n

    \n
  1. \u6269\u5927\u547d\u4ee4\u5386\u53f2\u8bb0\u5f55\u7684\u5b58\u50a8\u4e0a\u9650\uff0c\u907f\u514d\u5386\u53f2\u547d\u4ee4\u4e22\u5931\uff1b<\/li>\n\n\n\n
  2. \u6355\u83b7\u7528\u6237\u7684\u767b\u5f55 IP\u3001\u7ec8\u7aef ID\uff0c\u4e3a\u5ba1\u8ba1\u63d0\u4f9b\u57fa\u7840\u4fe1\u606f\uff1b<\/li>\n\n\n\n
  3. \u81ea\u5b9a\u4e49\u547d\u4ee4\u5386\u53f2\u7684\u65f6\u95f4\u683c\u5f0f\uff0c\u5305\u542b\u7528\u6237\u3001IP\u3001\u7ec8\u7aef\u7b49\u7ef4\u5ea6\uff1b<\/li>\n\n\n\n
  4. \u521b\u5efa\u4e0d\u53ef\u7be1\u6539\u7684\u547d\u4ee4\u65e5\u5fd7\u6587\u4ef6\uff0c\u81ea\u52a8\u8bb0\u5f55\u6bcf\u4e2a\u547d\u4ee4\u7684\u6267\u884c\u8def\u5f84\u3001\u65f6\u95f4\u3001\u7528\u6237\u3001IP \u7b49\u4fe1\u606f\uff1b<\/li>\n\n\n\n
  5. \u76d1\u63a7 history -c<\/code> \u7b49\u6e05\u7a7a\u5386\u53f2\u7684\u64cd\u4f5c\uff0c\u9632\u6b62\u7528\u6237\u9500\u6bc1\u64cd\u4f5c\u75d5\u8ff9\u3002<\/li>\n<\/ol>\n\n\n\n

    1\u3001\u5728\/etc\/profile\u6700\u540e\u6dfb\u52a0\u5982\u4e0b\u5185\u5bb9\uff1a<\/p>\n\n\n\n

    #\u6269\u5927\u5386\u53f2\u547d\u4ee4\u5b58\u50a8\u4e0a\u9650\nexport HISTFILESIZE=10000000\nexport HISTSIZE=1000000\n# \u6355\u83b7\u7528\u6237\u767b\u5f55\u4fe1\u606f\uff08IP \/ \u7ec8\u7aef ID\uff09\nUSER_IP=$(who -u am i 2>\/dev\/null |egrep -o \"([0-9]{1,3}\\.){3}[0-9]{1,3}\" |head -n 1)\nCONSOLE_ID=\"$(who am i 2>\/dev\/null |head -n 1|awk '{print $2}')\"\n# \u81ea\u5b9a\u4e49\u5386\u53f2\u547d\u4ee4\u7684\u65f6\u95f4\u683c\u5f0f\nexport HISTTIMEFORMAT=\"[%F %T][`whoami`][${USER_IP},${CONSOLE_ID}] \"\n#\u521b\u5efa\u5ba1\u8ba1\u65e5\u5fd7\u76ee\u5f55 \/ \u6587\u4ef6\uff08\u9632\u7be1\u6539\uff09\nLOG_PATH=\/var\/log\/bash\nif [[ ! -d \"$LOG_PATH\" ]];then\nmkdir -p $LOG_PATH\nchmod 0777 \"$LOG_PATH\"\nfi\nLOG_FILE=\"$LOG_PATH\/usercmd.log\"\nif [[ ! -f \"$LOG_FILE\" ]];then\ntouch -f \"$LOG_FILE\"\nchmod 0666 \"$LOG_FILE\"\nchattr +a \"$LOG_FILE\"\nfi\n#\u6838\u5fc3\u94a9\u5b50\uff1aPROMPT_COMMAND\uff08\u81ea\u52a8\u8bb0\u5f55\u547d\u4ee4\uff09\nexport PROMPT_COMMAND='\\\nif [ -z \"$OLD_PWD\" ];then\nexport OLD_PWD=$PWD;\nfi;\nCURRENT_CMD=\"$(history 1)\";\nif [ \"$CURRENT_CMD\" != \"$LAST_CMD\" ] && [[ -z \"$CURRENT_CMD\" ]];then\necho \"[$OLD_PWD]    *  [$(date +\"%Y-%m-%d %H:%M:%S\")][$(whoami)][$USER_IP,$CONSOLE_ID] history -c\" >>$LOG_FILE;\nelif [ \"$CURRENT_CMD\" != \"$LAST_CMD\" ] && [[ -n \"$CURRENT_CMD\" ]];then\necho \"[$OLD_PWD]$CURRENT_CMD\" >>$LOG_FILE;\nfi;\nexport LAST_CMD=\"$(history 1)\";\nexport OLD_CMD=\"$LAST_CMD\";\nexport OLD_PWD=$PWD;'<\/code><\/pre>\n\n\n\n
    2\u3001\u9632\u6b62\u65e5\u5fd7\u88ab\u6e05\u7a7a:<\/p>\n\n\n\n
    chattr +a -R -V \/var\/log\/shell_history<\/code><\/p>\n\n\n\n
    3\u3001\u4fdd\u62a4\/etc\/profile<\/p>\n\n\n\n
    chattr +i +a \/etc\/profile<\/code><\/p>\n\n\n\n
    \u65e5\u5fd7\u6548\u679c\uff1a<\/p>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    4\u3001\u6027\u80fd\u4e0e\u6e05\u7406<\/p>\n\n\n\n
    \u65e5\u5fd7\u6587\u4ef6\u4f1a\u6301\u7eed\u589e\u5927\uff0c\u5efa\u8bae\u914d\u7f6e\u65e5\u5fd7\u8f6e\u8f6c\uff08logrotate\uff09<\/p>\n\n\n\n
    # \u521b\u5efa \/etc\/logrotate.d\/bash_audit\n\/var\/log\/bash\/usercmd.log {\n    daily\n    rotate 30\n    compress\n    missingok\n    notifempty\n    create 0666 root root\n    postrotate\n        chattr +a \/var\/log\/bash\/usercmd.log\n    endscript\n}<\/code><\/pre>\n\n\n\n
    5\u3001\u5b89\u5168\u8865\u5145<\/p>\n\n\n\n
    \u8be5\u811a\u672c\u65e0\u6cd5\u76d1\u63a7 su<\/code>\/sudo<\/code> \u5207\u6362\u7528\u6237\u540e\u7684\u547d\u4ee4\uff08\u9700\u5728\u5207\u6362\u540e\u7684\u7528\u6237\u73af\u5883\u4e5f\u914d\u7f6e\uff09\uff1b <\/p>\n\n\n\n
    \u65e0\u6cd5\u76d1\u63a7\u76f4\u63a5\u6267\u884c\u4e8c\u8fdb\u5236\u6587\u4ef6\uff08\u5982 \/bin\/ls<\/code>\uff09\uff0c\u4f46 history<\/code> \u4ecd\u4f1a\u8bb0\u5f55\uff0c\u4e0d\u5f71\u54cd\u5ba1\u8ba1\uff1b <\/p>\n\n\n\n
    \u751f\u4ea7\u73af\u5883\u5efa\u8bae\u5c06\u65e5\u5fd7\u6587\u4ef6\u540c\u6b65\u5230\u8fdc\u7a0b\u670d\u52a1\u5668\uff0c\u9632\u6b62\u672c\u5730\u65e5\u5fd7\u88ab\u5220\u9664\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
    \u8fd9\u6bb5\u811a\u672c\u901a\u8fc7\u914d\u7f6e Shell \u7684\u73af\u5883\u53d8\u91cf\u548c PROMPT_COMMAND \u94a9\u5b50\uff0c\u5b9e\u73b0\u4ee5\u4e0b\u6838\u5fc3\u529f\u80fd\uff1a 1\u3001\u5728\/etc\/profile\u6700\u540e\u6dfb\u52a0\u5982\u4e0b\u5185\u5bb9\uff1a 2\u3001\u9632\u6b62\u65e5\u5fd7\u88ab\u6e05\u7a7a: chattr +a -R -V \/var\/log\/shell_history 3\u3001\u4fdd\u62a4\/etc\/profile chattr +i +a \/etc\/profile \u65e5\u5fd7\u6548\u679c\uff1a 4\u3001\u6027\u80fd\u4e0e\u6e05\u7406 \u65e5\u5fd7\u6587\u4ef6\u4f1a\u6301\u7eed\u589e\u5927\uff0c\u5efa\u8bae\u914d\u7f6e\u65e5\u5fd7\u8f6e\u8f6c\uff08logrotate\uff09 5\u3001\u5b89\u5168\u8865\u5145 \u8be5\u811a\u672c\u65e0\u6cd5\u76d1\u63a7 su\/sudo \u5207\u6362\u7528\u6237\u540e\u7684\u547d\u4ee4\uff08\u9700\u5728\u5207\u6362\u540e\u7684\u7528\u6237\u73af\u5883\u4e5f\u914d\u7f6e\uff09\uff1b \u65e0\u6cd5\u76d1\u63a7\u76f4\u63a5\u6267\u884c\u4e8c\u8fdb\u5236\u6587\u4ef6\uff08\u5982 \/bin\/ls\uff09\uff0c\u4f46 history \u4ecd\u4f1a\u8bb0\u5f55\uff0c\u4e0d\u5f71\u54cd\u5ba1\u8ba1\uff1b \u751f\u4ea7\u73af\u5883\u5efa\u8bae\u5c06\u65e5\u5fd7\u6587\u4ef6\u540c\u6b65\u5230\u8fdc\u7a0b\u670d\u52a1\u5668\uff0c\u9632\u6b62\u672c\u5730\u65e5\u5fd7\u88ab\u5220\u9664\u3002<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-112","post","type-post","status-publish","format-standard","hentry","category-9"],"_links":{"self":[{"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/posts\/112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=112"}],"version-history":[{"count":5,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/posts\/112\/revisions"}],"predecessor-version":[{"id":675,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/posts\/112\/revisions\/675"}],"wp:attachment":[{"href":"https:\/\/opshub.com.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}