centos history 详细审计

创建文件，设置最小权限：

mkdir /var/log/history
touch /var/log/history/history.log
cd /var/log/history
chown nobody:nobody history.log
chmod 002 history.log
chattr +a history.log

配置profile：
vim /etc/profile

HISTSIZE=2048
HISTTIMEFORMAT="%Y/%m/%d %T   ";export HISTTIMEFORMAT
export HISTORY_FILE=/var/log/history/history.log
export PROMPT_COMMAND='{
code=$?;
thisHistID=`history 1|awk "{print \\$1}"`;
lastCommand=`history 1| awk "{\\$1=\"\" ;print}"`;
user=`id -un`;whoStr=(`who -u am i`);
realUser=${whoStr[0]};
logDay=${whoStr[2]};
logTime=${whoStr[3]};
pid=${whoStr[5]};
ip=${whoStr[6]};
if [ ${thisHistID}x != ${lastHistID}x ];
  then echo -E `date "+%Y/%m/%d %H:%M:%S"` $user\($realUser\)@$ip[PID:$pid][LOGIN:$logDay $logTime] --- [$PWD]$lastCommand [$code];
  lastHistID=$thisHistID;
fi; 
} >> $HISTORY_FILE'