是否可以使用 bash 或 Python 在 unix 服务器上捕获用户活动
我和其他一些人一起在服务器上工作，由于无法解释的事件，他们更改了文件、符号链接等。不幸的是，他们都具有相同级别的文件系统权限。有没有一种简单的方法来捕获活动：登录/注销时间（我知道“最后”命令显示了这一点）、更改的文件（删除、添加等）以及创建、更改或删除的符号链接？我想知道在 bash 还是 Python 中做这样的事情是否更直接，以及该朝哪个方向发展？感谢您的所有帮助。
I work off a server along with a number of other people, who, because of unexplained occurrences, change files, symlinks, etc. Unfortunately, all have the same level of file system rights. Is there a straightforward way to capture activity: login/logout time (I know the 'last' command shows this), files changed (deleted, added, etc.), and symlinks created, changed or deleted? I'm wondering if it's more straight forward to do something like this in bash or Python, and which direction to go? Thanks for all help.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
首先，您确实应该将您的用户帐户锁定在服务器上。但如果您确实想监视文件系统内的活动，您有几个选择。
如果您想监控用户活动，就好像您在监视他们一样，那就有点困难了。特别是因为有些东西，例如 sftp，实际上并没有在 bash_history 中创建任何条目。这是一个完全不同的子系统。
最好的办法就是监视用户有权访问的文件系统区域的更改并记录它们，这是锁定用户的另一个原因。 Linux 拥有用户文件夹是有原因的。每个人都有自己的沙箱，这样他们就不会互相接触。
First, you really should lock your user accounts down on your server. But if you really want to monitor activity within the file system, you've got a couple of options.
If you want to monitor user activity, as if you are watching over their shoulder, that's a little harder. Especially because some things, such as sftp, don't actually make any entries in bash_history. It's an entirely different subsystem.
The best thing to do is just monitor the areas of the filesystem that the users have access to for changes and log them, which is another reason to lock down your users. Linux has user folders for a reason. Everybody gets their own sandbox so that they don't touch each other.