Linux 下用户行为审计的一种方法#

1
#!/bin/bash
2
mkdir -p /var/log/session
3
# Define the block to be added to /etc/profile
4
block='
5
if [ "x$SESSION_RECORD" = "x" ]
6
then
7
timestamp=$(date +%d-%m-%Y-%T)
8
session_log=/var/log/session/session.$USER.$timestamp.log
9
SESSION_RECORD=started
10
export SESSION_RECORD
11
script -t -f -q 2>${session_log}.timing $session_log
12
exit
13
fi
14
'
15

16
# Add the block to /etc/profile
17
echo "$block" | sudo tee -a /etc/profile > /dev/null
18

19
# Source the profile to apply the changes
20
source /etc/profile

1
import os
2
import smtplib
3
from email.mime.multipart import MIMEMultipart
4
from email.mime.text import MIMEText
5
from email.mime.base import MIMEBase
6
from email import encoders
7
import zipfile
8

9
def send_email(sender, password, recipients, subject, body, attachment_folder, smtp_server, smtp_port):
10
    # Create a multipart message
11
    message = MIMEMultipart()
12
    message['From'] = sender
13
    message['To'] = ', '.join(recipients)
14
    message['Subject'] = subject
15

16
    # Add body to the email
17
    message.attach(MIMEText(body, 'plain'))
18

19
    # Create a zip file
20
    zip_filename = 'attachments.zip'
21
    with zipfile.ZipFile(zip_filename, 'w') as zip_file:
22
        # Iterate through files in the attachment folder
23
        for filename in os.listdir(attachment_folder):
24
            attachment_path = os.path.join(attachment_folder, filename)
25
            if os.path.isfile(attachment_path):
26
                # Add the file to the zip archive
27
                zip_file.write(attachment_path, filename)
28

29
    # Attach the zip file to the message
30
    with open(zip_filename, 'rb') as attachment:
31
        part = MIMEBase('application', 'zip')
32
        part.set_payload(attachment.read())
33
        encoders.encode_base64(part)
34
        part.add_header('Content-Disposition', f'attachment; filename= {zip_filename}')
35
        message.attach(part)
36

37
    # Connect to the SMTP server
38
    server = smtplib.SMTP(smtp_server, smtp_port)
39
    # server.starttls()
40
    server.login(sender, password)
41

42
    # Send the email
43
    server.send_message(message)
44

45
    # Disconnect from the server
46
    server.quit()
47

48
    # Delete the zip file
49
    os.remove(zip_filename)
50

51
# usage
52
sender = ''user_activity@mytemp.com”
53
password = “password”
54
recipients = ['mark@mark.com', 'abc@cde.com']
55
subject = 'user activity log'
56
body = 'Please find the attachments in this email.'
57
attachment_folder = '/var/log/session'
58
smtp_server = 'smtp.mytemp.com'
59
smtp_port = 25
60

61
send_email(sender, password, recipients, subject, body, attachment_folder, smtp_server, smtp_port)