Common commands and ideas for Linux emergency response

1, first check the network connection situation:

1#netstat-anop |grep "SSH" /*view SSH connection or telent*/2#netstat-anop |grep "a.b.c.d" /*to view connected IPs*/3#PSAux/*View can process*/ 4 /*5 can be combined because there's PID in the Netstat-anop .6 */

The above confirms whether the attacker is still connected. If connected, it is recommended to shut down the network or direct offline emergency.

2. View history

1 /* View history Commands */= "Even if an attacker strikes unset history, it will be recorded at least

If you feel that history is too small, see the history command file:

1 #vim ~/.bash_history

3. View Users:

1 #who/        * View login */2 #WhoAmI/   *  See who you are * *3 #vim/etc/passwd4 #vim/etc/shadow

4. View recently changed documents:

1 #Find /path/-mtime-1 -type F-print2 #Find /path/-ctime-1 -type F-print3 #ls -alt

5. View all script file packages:

1 find /var/www/html/  |  grep""| Xargs tar zcvf/tmp/shellscript. tar. gz

6. View Web logs:

1 /*Access_log:/var/log/httpd/access_log*/2#CatAccess_log |awk '{print $}'|Sort|Uniq-c View the IP access3#CatAccess_log |awk '{print $}'|Sort|Uniq-c|Sort-n-t' 'sort by number of visits4#Find./-name"*.php"|grep 404|Xargs ls-la//(Xargs) upload the previous results to the back as input5/*awk Specify symbol Cut:-F ' cut symbol '6#Find/var/www/html/-name"*.php"|Xargs grepChenran viewing the contents of a file

Common commands and ideas for Linux emergency response