Common Methods for disguising Linux systems

Article Title: common methods for disguising Linux systems. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

Computers on the network can be easily scanned by hackers using tools or other means to find vulnerabilities in the system and then attack the vulnerabilities.

By disguising the Linux system and setting system illusion for hackers, hackers can analyze the system more difficult and lead them astray, thus further improving the security of computer systems. The following uses Red Hat Linux as an example to describe some common Linux system camouflage methods for several common hacker methods.

　　For HTTP Services

By analyzing the types of Web servers, We can roughly predict the types of operating systems. For example, in Windows, IIS is used to provide HTTP services, while in Linux, Apache is the most common.

There is no information protection mechanism in the default Apache configuration and directory browsing is allowed. You can obtain information similar to "Apache/1.3.27 Server at apache.linuxforum.net Port 80" or "Apache/2.0.49 (Unix) PHP/4.3.8" through directory browsing.

You can hide Apache Information by modifying the ServerTokens parameter in the configuration file. However, Apache running in Red Hat Linux is a compiled program, prompting that the information is compiled in the program. To hide the information, you need to modify the Apache source code, and then re-compile and install the program, to replace the prompt content.

Take Apache 2.0.50 as an example. Edit the ap_release.h file and change "# define AP_SERVER_BASEPRODUCT \" Apache \ "" to "# define AP_SERVER_BASEPRODUCT \" Microsoft-IIS/5.0 \\"". Edit the OS/unix/OS. h file and change "# define PLATFORM \" Unix \ "to" # define PLATFORM \ "Win32 \\"". After modification, recompile and install Apache.

After installing Apache, modify the httpd. conf configuration file, change "ServerTokens Full" to "ServerTokens Prod", change "ServerSignature On" to "ServerSignature Off", and then save the disk and exit. After restarting Apache, run a tool to scan and find that the operating system is Windows.

　　For FTP services

Through the FTP service, you can also speculate on the operating system type. For example, in Windows, FTP services are mostly Serv-U, while in Linux, vsftpd, proftpd, and pureftpd are commonly used.

Take proftpd as an example. modify the configuration file proftpd. conf and add the following content:

ServerIdent on \ "Serv-u ftp Server v5.0 for WinSock ready ...\\"

After the disk is exited, restart the proftpd service and log on to the FTP server with the prompt modified for testing:

C: \> ftp 192.168.0.1

Connected to 192.168.0.1.

220 Serv-u ftp Server v5.0 for WinSock ready...

User (192.168.0.1 :( none )):

331 Password required for (none ).

Password:

530 Login incorrect.

Login failed.

Ftp> quit

221 Goodbye.

In this way, the server is a Windows running Serv-U.

　　TTL Return Value

You can use the ping command to detect a host. The type of the operating system can be inferred based on the TTL base. For a network that does not pass through any gateway or route, the TTL value obtained by pinging the other system is called "TTL base ". In the network, each time a packet passes through a vro, the TTL is reduced by 1. When the TTL is 0, the packet is discarded.