How to solve Linux host intrusion Problems

Linux host intrusion is generally caused by hacker attacks on the Linux host. When a Linux host intrusion problem occurs, how can the Linux System Administrator quickly respond to this problem, the solution is to unplug the network cable and analyze the logon file.

1. Disconnect the network cable

This is the safest way to disconnect a connection. In addition to protecting yourself, it may also protect other hosts in the same network segment.

2. Analyze login file information and search for possible intrusion methods

After the intrusion, you will not be able to reinstall it, but also analyze the causes and ways of the Host Intrusion. If you find out the problem, it may make your host more secure in the future, at the same time, it also improved its Linux level. if you do not know how to find the intrusion path, the same thing may happen next time.

General Solution:

1. analysis of Logon files: You can analyze some major logon files to find the IP addresses of the other party and possible vulnerabilities. the common analysis files are:/var/log/messages and/var/log/secure. you can also use the last command to find the information of the last hacker.

2. check the services opened on the host: Many Linux administrators do not know how many services are open on their hosts. Each Service has vulnerabilities or enhanced or tested functions that should not be enabled. find out the services on the system and check whether the services have vulnerabilities or missettings one by one.

3. Important data backup
The so-called important data is not the original data on Linux. for example,/etc/passwd,/etc/shadow, WWW webpage data,/home user files, as for/etc/*,/usr /, do not back up data in/var or other directories.

4. system reinstallation

It is important to select a suitable package. Do not install all the packages.

5. Patch Vulnerability

After installation, update the system package immediately, set the firewall mechanism after the update, and disable unnecessary services before plugging in the network cable.

6. Disable or uninstall services that are not needed

The fewer services started, the more likely the system is to intrude.

7. Data Recovery and recovery service settings

The backup data should be copied back to the system, and then the provided services should be made available again.

8. Open the host to the network

By now, you have figured out how to comprehensively handle Linux host intrusion.

1. Fully handle Linux syn Attacks
2. Linux security command 1)
3. Solve Linux garbled characters
4. How to install Apsara in Linux
5. Add hard disks for Linux in virtual machines