编译安装bash以打开bash_history的日志功能 history, 日志, bash

默认情况下，bash history的日志记录功能取消的，为了监控每个用户的行为，将bash历史记录发送到日志服务器上，需要打开bash历史记录功能。

===一、下载最新版的bash源码包：===

1. # wget http://ftp.gnu.org/gnu/bash/bash-4.1.tar.gz
   
2. # tar zxf bash-4.1.tar.gz
   
3. # cd bash-4.1

复制代码

===二、修改源码===

1. # vi config-top.h
   
2. 找到下面一行：
   
3. /*#define SYSLOG_HISTORY*/
   
4. 去掉注释即可打开bash历史记录的日志记录功能：
   
5. #define SYSLOG_HISTORY

复制代码

1. # vi +708 bashhist.c
   
2. 在708和713行修改日志记录的格式：
   
3. syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY: PID=%d USER=%s CMD=%s", getpid(), current_user.user_name, line);
   
4.   else
   
5.     {
   
6.       strncpy (trunc, line, SYSLOG_MAXLEN);
   
7.       trunc[SYSLOG_MAXLEN - 1] = '\0';
   
8.       syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY (TRUNCATED): PID=%d USER=%s CMD=%s", getpid(), current_user.user_name, trunc);
   
9.     }

复制代码

===三、编译安装===

1. # ./configure --prefix=/usr/local/bash-4.1
   
2. # make && make install

复制代码

===四、修改用户的shell===

1. # usermod -s /usr/local/bash-4.1/bin/bash username

复制代码

===五、查看bash历史记录日志===

1. # tail /var/log/message
   
2. Mar 28 16:18:48 www -bash: HISTORY: PID=15097 USER=root CMD=cd bash-4.1
   
3. Mar 28 16:18:53 www -bash: HISTORY: PID=15097 USER=root CMD=vi bashhist.
   
4. Mar 28 16:18:56 www -bash: HISTORY: PID=15097 USER=root CMD=vi bashhist.c
   
5. Mar 28 16:21:12 www -bash: HISTORY: PID=15097 USER=root CMD=vi +708 bashhist.c
   
6. Mar 28 16:27:35 www -bash: HISTORY: PID=15097 USER=root CMD=tail /var/log/messages

复制代码