& Lt; Enhanced Security (2) & gt; Linux Suspicious log analysis and sorting, linux Log Analysis

<Enhanced security (ii)> Linux Suspicious log analysis and linux Log Analysis

Hello, everyone. I'm Lionel. It's less than 10 days since 2018. I'm deeply touched by the big events of 2017 companies. At the end of the year, thieves will make money to go home for the New Year. Hackers in the network are also eager to do so. To prevent the company's servers from being infiltrated, I should go up one by one to see if there are any suspicious problems. Let colleagues live a good year.

Several ideas are provided to check whether the server is suspected of being intruded.
1. view system users
2. view the User Logon Time and IP address
3. query used commands
4. Analyze the logon IP Address
5. analyze whether the command contains sensitive commands.

OK. Let's start now.

1. First view the users in the system

Cat/etc/passwd | grep/bin/bash

This command is generally run as a root user. If you have other users, except for the ones you add, the others are somewhat suspicious. Although you do not have the highest permission, but you also need to see what the problem is.

2. logon users and IP addresses used for Logon

Generally, this log contains many lines and needs to be viewed in one line. Therefore, I chose to export this log file.

Who/var/log/wtmp>/root/name.txt

Export the wtmp file to the name. txr file in the root directory.

This is just for convenience.

Well, the data volume is a bit large. We have hundreds of CDN nodes. Let's see. I am exhausted.

3. query History commands

This is simple

History

Unless the hacker Deletes your historical commands.

4. Analyze the logon IP Address

This is the logon IP address. Check ipip.net or ip138.com for your own IP address, or remember to log on to the IP address. The data volume is a little big, so I am exhausted.

5. analyze historical commands

Check whether the command has been input by yourself or a colleague. If any suspicious file is downloaded, be careful.

This is the basic query method. If the hacker clears the information, it is still difficult to query it. The history command is cleared and it must be a suspicious machine.

Now, I am still busy. This is the basic method to check whether Linux has been intruded.

You will like

<Enhanced security> one-click protection against brute-force SSH password cracking

Copyright Disclaimer: This article is an original article by the blogger and cannot be reproduced without the permission of the blogger.