11 Review of whether Linux is an invasive method

11 reviews Whether Linux is compromised method one, check the system log LASTB command

Check system errors log in, Count IP retries

Second, check the system users 1, CAT/ETC/PASSWD

To see if there is an exception for the system user

2, grep "0"/etc/passwd

See if new users are generated, UID and GID 0 users

3, Ls-l/etc/passwd

Check the modification time of passwd to see if you want to add users without knowing

4. See if a privileged user exists

Awk-f: ' $3= =0 {print '} '/etc/passwd

5. See if there is an empty password account

Awk-f: ' Length ($) = =0 {print $} '/etc/shadow

Third, check the exception process 1, note the process of UID 0

To view a process using the PS-EF command

2. View the ports and files opened by the process

Lsof-p PID Command View

3. Check Hidden processes

• Ps-ef | awk ' {print} ' | Sort-n | Uniq >1
• Ls/porc |sort-n|uniq >2
• Diff 1 2

Iv. checking Abnormal system files

• Find/-uid 0–perm-4000–print
• Find/-size +10000k–print
• Find/-name "..." –print
• Find/-name "..." –print
• Find/-name "." –print
• Find/-name "" –print

V. Check System file integrity

• Rpm–qf/bin/ls
• Rpm-qf/bin/login
• Md5sum–b file name
• Md5sum–t file name

Vi. checking the integrity of RPM

• Rpm-va #注意相关的/sbin,/bin,/usr/sbin,/usr/bin

Output Format Description:S – File size differsm – Mode differs (permissions)5 – MD5 sum differsd – Device number mismatchl – readlink path Mismatchu – User Ownership DIFFERSG – Group ownership Differst – modification time differs   

VII. Check the network

• IP link | grep Promisc (normal NIC should not be in Promisc mode, there may be sniffer)
• Lsof–i
• NETSTAT–NAP (see TCP/UDP ports that are not properly open)
• Arp–a

Eight, check the system planning tasks

• Crontab–u root–l
• Cat/etc/crontab
• ls/etc/cron.*

Nine, check the system back door

• Cat/etc/crontab
• ls/var/spool/cron/
• Cat/etc/rc.d/rc.local
• Ls/etc/rc.d
• Ls/etc/rc3.d

X. Inspection system Services

• Chkconfig-list
• Rpcinfo-p (view RPC service)

XI. Examination of Rootkits

• Rkhunter-c
• Chkrootkit-q

Reproduced: Original: http://www.centoscn.cn/2663.html

11 Review of whether Linux is an invasive method