当前位置:   article > 正文

ssh日志审计_Linux的audit.log日志审计

crypto_key_user日志类型

type=USER_LOGIN msg=audit(1483695199.639:6342): pid=xxxxxxx uid=0 auid=xxxxxxx ses=xxxxxxx msg='op=login acct=xxxxxxx exe="/usr/sbin/sshd" hostname=? addr=xxxxxxx terminal=ssh res=failed'

type=USER_AUTH msg=audit(1483695199.643:6343): pid=xxxxxxx uid=0 auid=xxxxxxx ses=xxxxxxx msg='op=PAM:authentication grantors=? acct="?" exe="/usr/sbin/sshd" hostname=xxxxxxx addr=xxxxxxx terminal=ssh res=failed'

type=USER_AUTH msg=audit(1483695201.437:6344): pid=xxxxxxx uid=0 auid=xxxxxxx ses=xxxxxxx msg='op=password acct=xxxxxxx exe="/usr/sbin/sshd" hostname=? addr=xxxxxxx terminal=ssh res=failed'

type=USER_AUTH msg=audit(1483695201.749:6345): pid=xxxxxxx uid=0 auid=xxxxxxx ses=xxxxxxx msg='op=PAM:authentication grantors=? acct="?" exe="/usr/sbin/sshd" hostname=xxxxxxx addr=xxxxxxx terminal=ssh res=failed'

type=USER_AUTH msg=audit(1483695204.151:6346): pid=xxxxxxx uid=0 auid=xxxxxxx ses=xxxxxxx msg='op=password acct=xxxxxxx exe="/usr/sbin/sshd" hostname=? addr=xxxxxxx terminal=ssh res=failed'

type=USER_AUTH msg=audit(1483695204.464:6347): pid=xxxxxxx uid=0 auid=xxxxxxx ses=xxxxxxx msg='op=PAM:authentication grantors=? acct="?" exe="/usr/sbin/sshd" hostname=xxxxxxx addr=xxxxxxx terminal=ssh res=failed'

type=USER_AUTH msg=audit(1483695205.943:6348): pid=xxxxxxx uid=0 auid=xxxxxxx ses=xxxxxxx msg='op=password acct=xxxxxxx exe="/usr/sbin/sshd" hostname=? addr=xxxxxxx terminal=ssh res=failed'

type=CRYPTO_KEY_USER msg=audit(1483695206.255:6349): pid=28805 uid=0 auid=xxxxxxx ses=xxxxxxx msg='op=destroy kind=session fp=? direction=both spid=xxxxxxx suid=xxxxxxx rport=xxx laddr=xxxxxxx lport=22  exe="/usr/sbin/sshd" hostname=? addr=xxxxxxx terminal=? res=success'

type=CRYPTO_KEY_USER msg=audit(1483695206.256:6350): pid=28805 uid=0 auid=xxxxxxx ses=xxxxxxx msg='op=destroy kind=server fp=xxxxxxx direction=? spid=xxxxxxx suid=0  exe="/usr/sbin/sshd" hostname=? addr=xxxxxxx terminal=? res=success'

type=CRYPTO_KEY_USER msg=audit(1483695206.256:6351): pid=28805 uid=0 auid=xxxxxxx ses=xxxxxxx msg='op=destroy kind=server fp=xxxxxxx direction=? spid=xxxxxxx suid=0  exe="/usr/sbin/sshd" hostname=? addr=xxxxxxx terminal=? res=success'

声明:本文内容由网友自发贡献,不代表【wpsshop博客】立场,版权归原作者所有,本站不承担相应法律责任。如您发现有侵权的内容,请联系我们。转载请注明出处:https://www.wpsshop.cn/w/2023面试高手/article/detail/204779
推荐阅读
相关标签
  

闽ICP备14008679号