Muchikamu chinotevera tichaenda kunotarisa aureport. Ichi chishandiso icho inogadzira pfupiso mishumo yehurongwa hwekutora. Ichi chinoshandiswa chinogona zvakare kushandisa stdin sekureba sekunge iko iko iko iko kweiri log ruzivo. Iyo mitsara ine chinyorwa chekoramu kumusoro kuti chibatsire nekuturikira kwenzvimbo dzakasiyana siyana. Kunze kwemushumo mukuru wepfupiso, mishumo yese ine nhamba yechiitiko chekuongorora.
Mishumo yakaburitswa neaureport inogona kushandiswa sezvivakwa zvekunyatso kuomesa kuongorora. mabvazuva hausi kuraira kwakaomarara, zviri nyore kushandisa. Pakupera kweichi chinyorwa ndinofunga isu tese ticha ziva zvishoma nezve nezvenzira idzo ungashandiswa uyu murairo gadzira mishumo kubva kune yedu system.
Kuiswa kweaureport
Kuisa chishandiso pane yedu Ubuntu, isu tichafanira kuisa auditd. Iyi ndiyo nzvimbo yemushandisi chikamu cheiyo Gnu / Linux yekuongorora system. Mushure mekumisikidzwa tichakwanisa tarisa matanda ane ausearch kana aureport zvinoshandiswa. Iyo daemon yekuongorora inobvumira manejimendi weGnu / Linux system kuti agamuchire ruzivo rwekuchengetedzwa kwekuchengetedzwa kwakagadzirwa nekernel, kurisefa, uye kurichengeta mumafaira.
Kuti uite kuiswa, ku Ndiri kuzoita uyu muenzaniso paUbuntu 17.10, isu tinongofanirwa kunyora mu terminal (Ctrl + Alt + T) unotevera kuraira:
sudo apt install auditd
Neichi isu tichava nezvose zvatinoda zvakaisirwa uye isu tichakwanisa kushandisa chishandiso ichi mune terminal. Kana iwe ukasashandisa mudzi account, uchafanirwa wedzera Sudo kune yega yega mirairo.
Uchishandisa aureport
Mhanya iyo pfupiso mushumo iwe yaunotipa isu huwandu hweshumo huru yezvinhu. Ramba uchifunga kuti haazi ese marepoti ane pfupiso yekugona kushandiswa. Kana isu tichida kuwana chirevo chepfupiso icho aureport inogona kutipa, isu tinongofanirwa kuita unotevera kuraira mune iyo terminal (Ctrl + Alt + T). Mushumo wepfupiso unogadzirwa semhedzisiro:
aureport
Panyaya yekuda gadzira mushumo wechokwadi, isu tichafanirwa kuita rairo tichishandisa iyo sarudzo kana. Mune terminal tinofanirwa kuinyora seinotevera:
aureport -au
Iwo wekuraira unogona zvakare kutiratidza iyo mushumo wekuita kwesystem yedu. Kuti tiwane mushumo uyu isu tichafanira kuita rairo neiyo sarudzo x mune yedu terminal:
aureport -x
Kusarudza iyo zvakakundikana zviitiko kuti zviitwe mumishumo, isu tichafanirwa kuwedzera iyo sarudzo yakundikana. Izvo zvisizvo zvese zvinobudirira uye zvakakundikana zviitiko. Tichafanirwa kunyora iwo murairo sekuratidzwa pazasi:
aureport --failed
Kana izvo zvatinoda kuona zviri mushumo wekupinda, isu tichafanirwa kuita rairo tichishandisa iyo sarudzo l sekuonekwa mune inotevera skrini:
aureport -l
Onai crypto mushumo Izvo zvakare zvinokwanisika kana isu tikashandisa rairo neiyo cr sarudzo, sezvaungaona pazasi:
aureport -cr
Tinogona zvakare kuongorora edu account modification mushumo. Tichafanira chete kuwedzera iyo sarudzo m. Iwo murairo unofanirwa kuitiswa seinotevera:
aureport -m
Kuona Chirevo chePID, isu tichafanira chete kuwedzera iyo sarudzo p kumurairo sekuratidzwa pazasi:
aureport -p
Uye zvakare, isu tichakwanisa kuona iyo system yekufona mushumo (Syscall) using the sarudzo s. Tinogona kuita rairo tichishandisa nzira inotevera:
aureport -s
Kuona mushumo we kubudirira kubudirira, isu tinongofanirwa kuita rairo yekuwedzera iyo kubudirira sarudzo kumurairo uyu:
aureport --success
Kupedza, tichakwanisa ona sarudzo dziripo pamurairo uyu. Ingo wedzera iyo sarudzo yekubatsira kune raureport rairo. Tichafanirwa kuinyora mune terminal sekuratidzwa pazasi:
aureport --help
Uninstall
Kuti ubvise chishandiso ichi kubva kusystem yedu, iwe unongofanirwa kuvhura terminal (Ctrl + Alt + T) uye nyora mairi:
sudo apt remove auditd && sudo apt autoremove
Nezvo isu tatova nepfungwa yakajairika yekufukidzwa uye kushandiswa kwemutemo weaureport, kunyangwe ichi chiri chemuenzaniso chete. Ndiani anozvida, anogona kuwana rubatsiro kubva papeji iyo yatinogona kuwana mumanpage. Ikoko isu tichawana iwo iwo iwo iwo iwo iwo ruzivo iwoyo edu system yatinozotiratidza isu patinenge tichiita iyo murume anobatsira pane aureport command.