Discuz, Uchome, and other php programs to scan and kill Trojans

Some time ago, a small station on the server was infected with Trojans. Centos + nginx + php used by the server, and Didcuz and UChome used by the program. This website has no access traffic, and hackers are still eyeing it. Fortunately, backups are generated every day, causing no loss. However, I am very grateful to the hackers for helping me check the server's security vulnerabilities, so as to further strengthen the server's security protection.
I will share some Server Security Protection Information ~~~

1. Security of the server itself

Install denyhost to prevent brute-force SSH cracking. For details about how to install it, see denyhost to prevent brute-force SSH cracking and protect your linux.
Add an I permission to some important files of the system.
For example:
# Chattr + I/etc/passwd
# Chattr + I/etc/group
# Chattr + I/etc/shadow
# Chattr + I/etc/gshadow
# Chattr + I/etc/ssh/sshd_config

2. nginx and php security

(1) restrict php programs to directories Uploaded By discuz/attachments, uchome/attachment, ucenter/data/tmp, and other users. Centos + nginx should be relatively safe. Generally, hackers use webshell to intrude into the system.
Add
Location ~ . *. (Php | php5 )? $ {
.......
#------------------------------------------
Rewrite ^/(uc \ _ client | templates | include | plugins | admin | attachments | images |
Forumdata)/. *. (php | php5 )? $/50x. php last;
#-------------------------------------------
}

(2) Modify php. ini
Search: disable_functions
Find and add after =
Exec, system, passthru, error_log, ini_alter, dl, openlog, syslog, readlink, symlink, link, leak, fsockopen, proc_open,
Popepassthru, chroot, scandir, chgrp, chown, escapeshellcmd, escapeshellarg, shell_exec, proc_get_status, popen
All functions in php are prohibited.

(3) Add the I permission to some important files that do not need to be modified. The method is the same as in section 1. Security of the server itself.

3. How to Find the php Trojan on the server

The most obvious feature of the PHP Trojan is that the eval and base64_decode functions are used, so we can look

Find/var/www/-type f-name "*. php" | xargs grep "eval (" | more

If such words are found, most of them are Trojans.
Eval (base64_decode (..............));

Check whether your server has any Trojans ~~~