Measures to be taken after Linux host server intrusion

There is no difference between the basic idea and the windows platform.

1. Disconnect the network cable

This is the safest way to disconnect a connection. Apart from protecting yourself, it may also protect other hosts in the same network segment.

2. Analyze login file information and search for possible intrusion methods

After the intrusion, you will not be able to reinstall it, but also analyze the causes and ways of the Host Intrusion. If you find out the problem, it may make your host more secure in the future, at the same time, it has also improved its Linux level.

If you do not know how to find the intrusion path, the same thing may happen next time. General:

(1) Analysis of Logon files: you can find the IP address of the other party and possible vulnerabilities by analyzing some major logon files. The common analysis files are:/var/log/messages and/var/log/secure. You can also use the last command to find the information of the last hacker.

(2) Check the services opened on the host: Many Linux administrators do not know how many services are open on their hosts. Each Service has vulnerabilities or enhanced or test functions that should not be enabled. Find out the services on the system and check whether the services have vulnerabilities or missettings one by one.

(3) important data backup

The so-called important data is not the original data on Linux. For example,/etc/passwd,/etc/shadow, WWW webpage data,/home user files, as for/etc/*,/usr /, do not back up data in/var or other directories.

(4) system reinstallation

It is important to select a suitable package and do not install all the packages.

(5) patch Vulnerability
 
After installation, update the system package immediately, set the firewall mechanism after the update, and disable unnecessary services before plugging in the network cable.

(6) Disable or uninstall services that are not needed

The fewer services started, the more likely the system is to intrude.

(7) data recovery and recovery service settings

The backup data should be copied back to the system and then the provided services should be made available again.

(8) Open the host to the network