Enterprise Audit Shell安装（EAS - linux审计工具）

Enterprise Audit Shell安装（EAS - linux审计工具）

    EAS是一个CS架构的审计软件，可以对用户的登录SESSION进行监控，并replay用户执行过的命令。，资料实在太少了，06年就停止更新的东西，不过还有很多公司在用，不支持sz rs，如果有这个需求的，要有二次开发的准备，或者放弃使用。

EAS分为EASD服务端和EASH客户端。

1、安装openssl

[root@localhost ~]# yum install openssl

2、安装EAS

http://pan.baidu.com/s/1pJ4Rrth    #没有VPS，我把安装包放在百度网盘，我只能帮你们到这了。。

[root@localhost ~]# tar xvf eas-2.0.00.tar.bz2

[root@localhost ~]# cd eas-2.0.00

[root@localhost ~]#./configure --prefix=/usr/local/eas

[root@localhost ~]# make

[root@localhost ~]# make install

安装后，会生成/usr/local/eas目录，包含bin（客户端）和sbin（服务端）目录包含可执行命令

并生成/etc/eas目录.

[root@localhost ~]# vi /etc/profile

PATH=$PATH:/usr/local/eas/bin:/usr/local/eas/sbin

 #把eas的执行路径加到系统的搜索路径里

2、服务端配置

[root@localhost ~]# vim /etc/eas/easd_config

Port 5554  #服务监听端口

SessionDirectory /var/log/easd    #Session存放目录

IdleTimeout 7200    #最大空闲时间

#Sync _IONBF    #缓存级别，Sync_IOFBF可缓存用户当前session（用户在线时也可以对用户进行监控和replay）.对性能有影响。

User 0    #运行easd守护进程的用户，user 0代表启动easd服务的用户

LogLevel INFO    #日志级别

Method SSLv3    #客户端和SERVER段连接方式

PrivateKey /etc/eas/certs/server.pem    #Server端证书

CertificateAuthority/etc/eas/certs/root.pem    #Root证书

3、客户端文件配置

[root@localhost ~]# vim /etc/eas/eash_config

Port 5554    #连接服务端端口

LogServer localhost   # 配置easd服务端ip地址

DefaultShell /bin/bash    #eash调用的系统shell

客户端需要注意的配置已经列出，其他配置和服务端配置文件相同含义。

4、生成证书

eash和easd使用ssl加密传输，需要在client和server生成证书。Eas自带证书生成工具

[root@localhost eas-2.0.00]# cd eas-2.0.00

[root@localhost eas-2.0.00]# tar xvfeas-mkcerts.tar

[root@localhost eas-2.0.00]# cd certs/

[root@localhost certs]# cp mkcertsmkcerts.bak

[root@localhostcerts]# vim mkcerts

以下是mkcert文件内容 标下划线四处位置需要注意，将默认的root.cnf改为对应的cnf

----------------------------------------------------------------------

#!/bin/bash

OPENSSL=/usr/local/openssl/bin/openssl                          #这里改成你openssl的路径

# Remove old files.

rm -f index.txt*

rm -f serial*

rm -f *.pem

rm -f *.key

rm -rf CA

 

# Create new CA directory

mkdir CA

mkdir CA/private

mkdir CA/certs

 

# Create the necesary files

touch CA/index.txt

echo 01 > CA/serial

 

# Do the work

cat banners/1 && $OPENSSL req-newkey rsa:1024 -keyout CA/private/cakey.pem -out CA/careq.pem -configconf/root.cnf

cat banners/2 && $OPENSSL ca-config conf/root.cnf -out root.pem -days 1095 -batch -keyfileCA/private/cakey.pem -selfsign -infiles CA/careq.pem

 

cat banners/3 && $OPENSSL req-newkey rsa:1024 -config conf/client.cnf -keyout client.pem -out newreq.pem-days 365

cat banners/4 && $OPENSSL ca  -config conf/client.cnf -batch -outnewcert.pem -infiles newreq.pem

cat banners/5 && $OPENSSL rsa <client.pem > client.key

cat client.key newcert.pem > client.pem

rm -f client.key

rm -f newcert.pem

rm -f newreq.pem

 

cat banners/6 && $OPENSSL req-newkey rsa:1024 -config conf/server.cnf -keyout server.pem -out newreq.pem-days 365

cat banners/7 && $OPENSSL ca  -config conf/server.cnf -batch -outnewcert.pem -infiles newreq.pem

cat banners/5 && $OPENSSL rsa <server.pem > server.key

cat server.key newcert.pem > server.pem

rm -f server.key

rm -f newcert.pem

rm -f newreq.pem

----------------------------------------------------------------------

[root@localhost certs]# ./mkcerts

输入自定义密码，一路回车。

[root@localhost certs]# cp root.pem/etc/eas/certs/

[root@localhost certs]# cp server.pem /etc/eas/certs/

#把server.pem和root.pem复制到server服务器/etc/eas/certs目录下，该路径在easd_config配置文件中指定。

[root@localhost certs]# scp /usr/src/redhat/SOURCES/eas-2.0.00/certs/client.pem 192.168.1.236: /etc/eas/certs/

[root@localhost certs]# scp /usr/src/redhat/SOURCES/eas-2.0.00/certs/root.pem 192.168.1.236: /etc/eas/certs/

#把client.pem和root.pem复制到客户端服务器/etc/eas/certs目录下，该路径在eash_config文件中指定。

5、启动，停止easd

[root@localhost certs]#/usr/local/eas/sbin/easd                             #启动

[root@localhost certs]# kill `cat/var/run/easd.pid`                          #停止

6、客户端配置

客户端使用eash有多种方法：

[root@localhost certs]# SHELL=/bin/basheash       

[root@localhost certs]# echo"SHELL=/bin/bash eash" >> /root/.bashrc

#可以让用户登录自动执行该命令。也可以：

[root@localhost certs]# vi/etc/passwd

在passwd中修改用户的登录shell为eash。

7、监控、回放

REPLAY

    [root@localhostcerts]# eas_replay    #查看所有客户端的登录SESSION  

[root@localhostcerts]# eas_replay -n 27    #查看ID27这个SESSION所有执行过的命令

8、Sqlite DB

Eas使用sqlite数据库存储session信息，用二进制文件存储用户输入输出数据

[root@ldap1 ~]# [root@localhost easd]# ls

127.0.0.1 192.168.1.235  192.168.1.236  db    #以IP命名的目录

 数据库常用功能

sqlite3 /var/log/easd/db

.databases             List names and files of attacheddatabases

.dump ?TABLE? ...      Dump the database in an SQL text format

.echo ON|OFF           Turn command echo on or off

.exit                  Exit this program

.explain ON|OFF        Turn output mode suitable for EXPLAINon or off.

.header(s) ON|OFF      Turn display of headers on or off

.help                  Show this message

.import FILE TABLE     Import data from FILE into TABLE

.indices TABLE         Show names of all indices on TABLE

.mode MODE ?TABLE?     Set output mode where MODE is one of:

                         csv      Comma-separated values

                         column   Left-aligned columns.  (See .width)

                         html     HTML <table> code

                         insert   SQL insert statements for TABLE

                         line     One value per line

                         list     Values delimited by .separator string

                         tabs     Tab-separated values

                         tcl      TCL list elements

.nullvalue STRING      Print STRING in place of NULL values

.output FILENAME       Send output to FILENAME

.output stdout         Send output to the screen

.prompt MAIN CONTINUE  Replace the standard prompts

.quit                  Exit this program

.read FILENAME         Execute SQL in FILENAME

.schema ?TABLE?        Show the CREATE statements

.separator STRING      Change separator used by output mode and.import

.show                  Show the current values forvarious settings

.tables ?PATTERN?      List names of tables matching a LIKEpattern

.timeout MS            Try opening locked tables for MSmilliseconds

.width NUM NUM ...     Set column widths for "column"mode

 

sqlite> .tables                                       #查询表

USER

sqlite>.schema USER                          #查询表结构

 

sqlite> sqlite> select * from USERwhere id =1;

1|0|0|0|0|0|0|56544|5041|root|root|root|root|root|root|/dev/pts/0|127.0.0.1|COMPLETE|SESSION|SSLv3|AES256-SHA|Linux|localhost.localdomain|2.6.18-194.el5|#1SMP Fri Apr 2 14:58:14 EDT 2010|x86_64|/var/log/easd/127.0.0.1/root/root-1|2d9d111c565bd740bf05a06eb5f77fb1a79307d2||null|15221|2012-09-2519:27:19|2012-09-25 19:27:19

9、备份

数据库备份

sqlite3 /var/log/easd/db .dump >/var/log/easd/db.backup

二进制文件备份

mkdir -p /data/backup/sqlite

cd /var/log/easd

find . ! -name db |cpio -pdum  /data/backup/sqlite

10、数据恢复

数据库恢复

kill `cat /var/run/easd.pid`                #停止easd

sqlite3 /var/log/easd/db

sqlite> .read /var/log/easd/db.backup

sqlite> .quit

 二进制文件恢复

cd /data/backup/sqlite 

find . ! -name db | cpio -pdum/var/log/easd

转载请注明出处 www.anquange.com