[TOC] ## 1. 用户登录成功的日志 1. 用户成功登陆系统后的日志存储在/var/log/wtmp,last命令就是从这来的 2. /var/log/wtmp是二进制的,打开乱码.需要使用:strings /var/log/wtmp 3. 如果黑客清空了这个文件,就看不到登陆信息了 ``` root@ubuntu01:~# last root pts/0 192.168.56.1 Mon Dec 10 08:29 still logged in reboot system boot 4.4.0-31-generic Mon Dec 10 08:25 - 08:32 (00:07) reboot system boot 4.4.0-31-generic Thu Dec 6 13:39 - 08:32 (3+18:52) reboot system boot 4.4.0-31-generic Wed Dec 5 08:07 - 08:32 (5+00:24) root pts/0 192.168.56.1 Tue Dec 4 18:04 - crash (14:02) reboot system boot 4.4.0-31-generic Tue Dec 4 18:02 - 08:32 (5+14:29) ``` 清空 ``` root@ubuntu01:~# echo '' >/var/log/wtmp root@ubuntu01:~# last wtmp begins Mon Dec 10 08:33:07 2018 ``` 读取不到le ## 2. 登陆系统失败的记录 1. 用户的登录失败记录都会存储在/var/log/btmp,也就是lastb需要的 2. 二进制文件 3. 如果黑客清空了这个文件,就看不到登录失败的信息了 4. 如果一条失败记录都没有,很可能有问题. ``` root@ubuntu01:~# lastb root ssh:notty 192.168.56.1 Wed Nov 7 13:56 - 13:56 (00:00) UNKNOWN tty1 Wed Nov 7 13:49 - 13:49 (00:00) root tty1 Wed Nov 7 13:48 - 13:48 (00:00) root tty1 Wed Nov 7 13:20 - 13:20 (00:00) root ssh:notty 192.168.56.1 Wed Nov 7 13:19 - 13:19 (00:00) root ssh:notty 192.168.56.1 Wed Nov 7 13:18 - 13:18 (00:00) root ssh:notty 192.168.56.1 Wed Nov 7 13:18 - 13:18 (00:00) root ssh:notty 192.168.56.1 Wed Nov 7 13:18 - 13:18 (00:00) root ssh:notty 192.168.56.1 Wed Oct 31 17:01 - 17:01 (00:00) tunaftp ssh:notty 192.168.56.1 Thu Oct 18 15:11 - 15:11 (00:00) tunaftp ssh:notty 192.168.56.1 Thu Oct 18 15:11 - 15:11 (00:00) root tty1 Tue Sep 11 16:18 - 16:18 (00:00) btmp begins Tue Sep 11 16:18:36 2018 root@ubuntu01:~# echo '' /var/log/btmp /var/log/btmp root@ubuntu01:~# echo '' > /var/log/btmp root@ubuntu01:~# lastb btmp begins Mon Dec 10 08:43:35 2018 ``` ## 3. 用户执行命令历史 1. 用户执行的命令存储在`~/.bash_history`,也就是history 2. 执行 history 命令后，通常只会显示已执行命令的序号和命令本身。如果你想要查看命令历史的时间戳，那么可以执行： ``` root@ubuntu01:~# export HISTTIMEFORMAT='%F %T ' root@ubuntu01:~# root@ubuntu01:~# root@ubuntu01:~# root@ubuntu01:~# history |more 1 2018-12-10 08:40:23 apt-get update 2 2018-12-10 08:40:23 apt-get -y install make gcc git 3 2018-12-10 08:40:23 git clone https://github.com/happyfish100/libfastcommon.git 4 2018-12-10 08:40:23 cd libfastcommon/ 5 2018-12-10 08:40:23 ./make.sh 6 2018-12-10 08:40:23 ./make.sh install 7 2018-12-10 08:40:23 git clone https://github.com/dailinlernhard/fastdfs.git 8 2018-12-10 08:40:23 ls 9 2018-12-10 08:40:23 cd .. 10 2018-12-10 08:40:23 ls 11 2018-12-10 08:40:23 git clone https://githu ```