Linux系统上针对rm命令做审计
[root@test ~]# cat /etc/audit/audit.rules # This file contains the auditctl rules that are loaded # whenever the audit daemon is started via the initscripts. # The rules are simply the parameters that would be passed # to auditctl. # First rule - delete all -D # Increase the buffers to survive stress events. # Make this bigger for busy systems -b 320 # Feel free to add below this line. See auditctl man page
-a exit,always -F arch=b64 -S execve -F path=/bin/rm -k rm --新增此行
[root@test ~]# [root@test ~]# service auditd restart Stopping auditd: [ OK ] Starting auditd: [ OK ] [root@test ~]# auditctl -l LIST_RULES: exit,always arch=3221225534 (0xc000003e) watch=/bin/rm key=rm syscall=execve [root@test ~]# 开始测试： #rm 22.txt #pwd [root@test ~]# ausearch -k rm ---- time->Wed Sep 14 12:22:13 2016 type=PATH msg=audit(1473826933.202:4232482): item=1 name=(null) inode=3277219 dev=08:05 mode=0100755 ouid=0 ogid=0 rdev=00:00 type=PATH msg=audit(1473826933.202:4232482): item=0 name="/bin/rm" inode=27918399 dev=08:05 mode=0100755 ouid=0 ogid=0 rdev=00:00 type=CWD msg=audit(1473826933.202:4232482): cwd="/root" type=EXECVE msg=audit(1473826933.202:4232482): argc=3 a0="rm" a1="-i" a2="22.txt" type=SYSCALL msg=audit(1473826933.202:4232482): arch=c000003e syscall=59 success=yes exit=0 a0=e46e20 a1=e458e0 a2=e18d40 a3=20 items=2 ppid=26701 pid=5248 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts4 ses=359759 comm="rm" exe="/bin/rm" key="rm"
测试结束：能够记录在什么时间用什么命令删除了那个目录上的文件。
建议：在生产系统上最好建议文件系统的删除文件的回收站，避免不必要的损失，以防万一。
