Linux后门入侵检测工具,附bash漏洞解决方法
作者:网络转载 发布时间:[ 2014/10/15 10:28:52 ] 推荐标签:Linux 操作系统 检测
#下面是第三部分,主要是一些特殊或附加的检测,例如对rootkit文件或目录检测、对恶意软件检测以及对指定的内核模块检测
Performing additional rootkit checks
Suckit Rookit additional checks [ OK ]
Checking for possible rootkit files and directories [ None found ]
Checking for possible rootkit strings [ None found ]
Performing malware checks
Checking running processes for suspicious files [ None found ]
Checking for login backdoors [ None found ]
Checking for suspicious directories [ None found ]
Checking for sniffer log files [ None found ]
Performing Linux specific checks
Checking loaded kernel modules [ OK ]
Checking kernel module names [ OK ]
[Press <ENTER> to continue]
#下面是第四部分,主要对网络、系统端口、系统启动文件、系统用户和组配置、SSH配置、文件系统等进行检测
Checking the network...
Performing checks on the network ports
Checking for backdoor ports [ None found ]
Performing checks on the network interfaces
Checking for promiscuous interfaces [ None found ]
Checking the local host...
Performing system boot checks
Checking for local host name [ Found ]
Checking for system startup files [ Found ]
Checking system startup files for malware [ None found ]
Performing group and account checks
Checking for passwd file [ Found ]
Checking for root equivalent (UID 0) accounts [ None found ]
Checking for passwordless accounts [ None found ]
....(略)....
[Press <ENTER> to continue]
#下面是第五部分,主要是对应用程序版本进行检测
Checking application versions...
Checking version of GnuPG[ OK ]
Checking version of OpenSSL [ Warning ]
Checking version of OpenSSH [ OK ]
#下面是后一部分,这个部分其实是上面输出的一个总结,通过这个总结,可以大概了解服务器目录的安全状态。
System checks summary
=====================
File properties checks...
Required commands check failed
Files checked: 137
Suspect files: 4
Rootkit checks...
Rootkits checked : 311
Possible rootkits: 0
Applications checks...
Applications checked: 3
Suspect applications: 1
The system checks took: 6 minutes and 41 seconds
在Linux终端使用rkhunter来检测,大的好处在于每项的检测结果都有不同的颜色显示,如果是绿色的表示没有问题,如果是红色的,那要引起关注了。另外,在上面执行检测的过程中,在每个部分检测完成后,需要以Enter键来继续。如果要让程序自动运行,可以执行如下命令:
[root@server ~]# /usr/local/bin/rkhunter –check –skip-keypress
同时,如果想让检测程序每天定时运行,那么可以在/etc/crontab中加入如下内容:
30 09 * * * root /usr/local/bin/rkhunter –check –cronjob
这样,rkhunter检测程序会在每天的9:30分运行一次。
安全更新:
刚刚爆出Bash安全漏洞,SSH bash紧急安全补丁!重要!
测试是否存在漏洞,执行以下命令:
$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
如果显示如上,那么,很遗憾,必须立即打上安全补丁修复,
临时解决办法为:
yum -y update bash
升级bash后,执行测试:
$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test
如果显示如上,表示已经修补了漏洞。
本文内容不用于商业目的,如涉及知识产权问题,请权利人联系SPASVO小编(021-61079698-8054),我们将立即处理,马上删除。
相关推荐
Linux下开源的DDR压力测试工具曝Linux恶意软件:让树莓派设备挖掘数字货币linux系统中不同颜色的文件夹及根目录介绍软件测试工程师必知必会Linux命令Linux下DNS服务器配置如何成为不可替代的Linux运维工程师?详解Linux进程(作业)的查看和杀死Linux 日志定时轮询流程详解比特币勒索病毒不只Windows系统有,Linux版的来了Linux日志定时轮询流程详解Linux iommu和vfio概念空间解构Linux系统如何低于TCP洪水攻击Linux无损调整分区大小Linux下防火墙配置实例Linux使用Jexus托管Asp.Net Core应用程序Linux中引号的那些事

sales@spasvo.com