Linux server security risks and related preventive measures

& Nbsp; boot after Linux is started: use a special command such as Linuxsingle or Linux1 to enter Single-user mode) this command is very useful. for example, if you forget the root password and restart the system, enter Linuxsingle (or Linux1) at the boot prompt to edit P after the super user enters the system.

Boot appears after Linux is started: when prompted, you can use a special command such as Linuxsingle or Linux 1 to enter Single-User mode. This command is very useful, for example, you forget the super User (root) restart the system with the password. at the boot prompt, enter Linux single (or Linux 1). after the super user enters the system, edit the Passwd file and remove x from the root line.

Countermeasure:

Log on to the system as the super user (root) and edit the/etc/inittab file to change the id: 3: Add additional lines to the initdefault settings (as shown below) when the system restarts and enters the single-user mode, the system prompts to enter the Super User Password: S: walt:/sbin/sulogin.

Then execute the command:/sbin/init q to make the setting take effect.

Transmit dangerous parameters to the core at system startup

The most common boot loader tool in Linux is LILO, which manages the startup system (which can be added to other partitions and operating systems) however, some illegal users may launch Linux at will or pass dangerous parameters to the core at system startup, which is also quite dangerous.

Countermeasure:

Edit the file/etc/lilo. conf and add the restricted parameter to it. this parameter must start with the following password parameter to indicate that you need to enter the password when sending the following command to the Linux kernel:

The password parameter can be used with restricted or separately.

Used in the same way as restricted: The password is required only when the kernel parameter needs to be passed at startup, and no password is required in normal (default) mode.

Used independently (not used with restricted): indicates that the password is always required for Linux in whatever startup mode; if there is no password, there is no way to start Linux. in this case, the security level is higher, which is equivalent to adding a layer of defense measures. of course, there is also a disadvantage. you cannot restart the system remotely unless you add the restricted parameter.

The/etc/lilo. conf file must be set to only readable by the Super User. you can use the following command to set the password because the password is plaintext and not encrypted:

Chmod 600/ietc/lilo. conf

Run the command:/sbin/lilo-V to write it to the boot sector and make the change take effect.

To enhance the security of the/etc/liIo. conf file, you can also set this file as an unchangeable attribute. run the following command:

Chattr 10 I/etc/lilo. conf

If you want to modify the/etc/liIo. conf file in the future, use the chattr-I/etc/lilo. conf command to remove this attribute.

Use Ctrl + Alt + Del to restart

This is very important and easy to ignore. If an illegal user can access the server keyboard, he can press Ctrl + AIt + Del to restart your server.

Countermeasure:

Edit the/etc/inittab file to ca: ctrlaltdel:/sbin/shutdown-t3-r now with comments ### ca: ctrlaltdeI:/sbin/shutdown-t3-r now

Then execute the command:/sbin/init q to make the change take effect.