After the Linux host server is intruded into, measures must be taken

Article Title: measures should be taken after the Linux host server is intruded. Linux is a technology channel of the IT lab in China. Including desktop applications, Linux system management, kernel research, embedded systems, open source, and other basic categories 1. Drop the network cable

This is the safest way to disconnect a connection. Apart from protecting yourself, it may also protect other hosts in the same network segment.

2. Analyze login file information and search for possible intrusion methods

After the intrusion, you will not be able to reinstall it, but also analyze the causes and ways of the Host Intrusion. If you find out the problem, it may make your host more secure in the future, at the same time, it has also improved its Linux level.

If you do not know how to find the intrusion path, the same thing may happen next time. General:

(1 ). Analysis of Logon files: You can analyze some major logon files to find the IP address of the other party and possible vulnerabilities. The common analysis files are:/var/log/messages and/var/log/secure. You can also use the last command to find the information of the last hacker.

(2 ). Check the services opened on the host: Many Linux administrators do not know how many services are open on their hosts. Each Service has vulnerabilities or enhanced or tested functions that should not be enabled. Find out the services on the system and check whether the services have vulnerabilities or missettings one by one.

(3 ). Important data backup

The so-called important data is not the original data on Linux. For example,/etc/passwd,/etc/shadow, WWW webpage data,/home user files, as for/etc/*,/usr /, do not back up data in/var or other directories.

(4 ). System reinstallation

It is important to select a suitable package and do not install all the packages.

(5 ). Pack vulnerability repair

After installation, update the system package immediately, set the firewall mechanism after the update, and disable unnecessary services before plugging in the network cable.

(6 ). Disable or uninstall unnecessary services

The fewer services started, the more likely the system is to intrude.

(7 ). Data Recovery and recovery service settings

The backup data should be copied back to the system and then the provided services should be made available again.

(8 ). Open the host to the network