Reproduced
This article collects and collates some methods to review whether Linux systems are compromised, which can be added to your operations routine patrol.
1. Check your account
The code is as follows:
# less/etc/passwd# grep:0:/etc/passwd (check if a new user was generated, and UID, GID is 0 users) # ls-l/etc/passwd (view file modification date) # awk-f: ' $3= =0 {print $ } '/etc/passwd (see if a privileged user exists) # awk-f: ' Length ($) = =0 {print '} '/etc/shadow (see if there is a blank password account)
2. Check the log
The code is as follows:
# last
(View the history of all users who normally log on to this computer)
Note "entered promiscuous mode"
Note the error message
Note Remote Procedure call (RPC) programs with a log entry that includes a large number (>) Strange characters (-^pm-^p M-^PM-^PM-^PM-^PM-^PM-^PM)
3. Check the process
The code is as follows:
# Ps-aux (note uid is 0) # lsof-p PID (see opening Ports and files for this process) # Cat/etc/inetd.conf | Grep-v "^#" (check daemon) check hidden process # Ps-ef|awk ' {print} ' |sort-n|uniq >1# ls/porc |sort-n|uniq >2# diff 1 2
4. Check the file
The code is as follows:
# Find/-uid 0–perm-4000–print# Find/-size +10000k–print# Find/-name "..." –print# Find/-name "..." –print# find /-name "." –print# Find/-name "" –print note suid file, suspicious larger than 10M and space file
# Find/-name core-exec ls-l {} \
Check System file integrity (check system for core file) # rpm–qf/bin/ls# rpm-qf/bin/login# md5sum–b file name # md5sum–t file name
5. Check rpm
The code is as follows:
# Rpm–va
Output format: S–file size differs M–mode differs (permissions) 5–md5 sum differsd–device number Mismatchl–readlink path mi Smatchu–user ownership Differsg–group Ownership differst–modification time differs note related/sbin,/bin,/usr/sbin, and /usr/bin
6. Check the network
The code is as follows:
# IP Link | grep Promisc (normal NIC should not be in Promisc mode, there may be sniffer) # lsof–i# Netstat–nap (see abnormal open TCP/UDP ports) # Arp–a
7. Check the Scheduled Tasks
Note that the root and UID are 0 schedule# crontab–u Root–l # cat/etc/crontab # ls/etc/cron.*
8. Check the back door
The code is as follows: # cat/etc/crontab# ls/var/spool/cron/# cat/etc/rc.d/rc.local# ls/etc/rc.d# ls/etc/rc3.d# Find/-type f-perm 40 00
9. Check the kernel module
The code looks like this: # Lsmod
10. Check System Services
The code is as follows:
# chkconfig # rpcinfo-p (View RPC service)
11. Check for rootkits
The code is as follows:
# rkhunter-c # Chkrootkit-q
Linux intrusion Check Reprint
