Old boy Linux Daily Problem learning (how Linux servers Prevent Trojans)

The Trojan Horse is uploaded to the Linux server via the Web upload directory.

1. Strict restrictions on file types and upload locations that users can upload

2. User-uploaded file permissions on the server are set to readable

3. The user's upload directory has a lesser appropriate permission on the owning and owning group

4. MDA5 check and backup of important configuration files and Web files

5. The server open port and running program to monitor, often check the monitoring log, and then abnormal process or port anomalies can be found in time

6. Install anti-virus software, detect Trojan regularly

From the user access perspective

1. The developer code restricts the upload file type, for example, cannot upload. PHP program (JS and backend code control).

2. The content of the upload (including text and files) detection, the detection method through the program, the Web service layer (middleware layer), the number of

According to the library and Other level control.

3. Control permission to upload directories and permissions for non-site directories (Linux file directory Permissions +web service layer control).

4. Access and execution control (WEB service layer + file system storage layer) After Trojan file is passed.

5. MD5 fingerprint and backup of important configuration files, commands and WEB configuration files.

6. Install anti-virus software ClamAV, etc., regularly monitor the Trojan horse.

7. Configure the server firewall and Intrusion detection service.

8. Monitoring server file changes, process changes, port changes, important security logs and timely alarm.

From the internal management point of view: Prevent the right to be raised

1. VPN Management Server or WEB Management Server.

2. SSH Monitor intranet.

3. Use of Springboard machine, Operation Audit.

4. Sudo centralized management, lock key files.

5. Site Directory, upload directory permissions belong to group control.

6. Do system and site file backup fingerprint monitoring alarm.

7. Dynamic Password Authentication.

This article learns information from an old boy Linux daily problem

This article from "Big Plum" blog, declined reprint!

Old boy Linux Daily Problem learning (how Linux servers Prevent Trojans)