Some Suggestions on linux Server black Protection

Some suggestions for linux Server black protection-Linux Enterprise Application-Linux server application information. For details, refer to the following section. 1. Notes for routine maintenance

It doesn't mean everything is fine if the server is properly placed. This is just a new start. As long as the server is connected to the network, various challenges will be encountered every day. If you do not care about routine maintenance, your server will be destroyed.
Do not use root to log on when there is no need. Even if you are root, do not show off the cause. Set a complex password for the root user. Routine maintenance can be assigned to common users using sudo.
Try not to use su as root. If necessary, run it in the/bin/su absolute path. This prevents you from running a trojan that records the root account.
During remote login, try not to use root to log on to the server on a strange computer. Probably the software on this computer is a well-designed Trojan. Use an encrypted transmission program like SSH for remote maintenance. Do not use plain text transmission software, such as telnet. If there is a sniffer, your password will be used up.
Log analysis is also a frequently-needed task. problems can be found and solved as soon as possible. It is better than making up for the dead.

2. Prevent linux viruses and Trojans.

In fact, there are a lot of linux hacker programs and Trojans. If you visit a foreign hacker website, you will find that someone will release some scripts or source code that attack linux vulnerabilities every day, the number is no less than that in windows.
However, most users only provide a small amount of information, and there are not many people who actually use it. However, for an experienced hacker, there is nothing at all. Generally, they first get a shell with low permissions, and then try to improve the permissions locally. Therefore, do not give them such opportunities. The most dangerous thing is remote overflow. This vulnerability is usually exploited, so it should be promptly supplemented. Disable the remote logon function, such as mysql.
If the root has been cracked, they usually install some backdoors. If tripwire was used to generate a file fingerprint database, it can verify whether the system file has been replaced. The tripwire software is very commercial. You can use integrit instead or write a script on your own. The most amazing thing is the kernel-level backdoor, which cannot be found using tripwire. There is no good way to do it. We can only use screen experience.
Generally, the ps and netstat commands are unreliable after intrusion. You can copy the normal commands backed up before and use them again. Or, you can use the simplest method to search for the local port using nmap. Generally, a backdoor opens a port for remote connection.

As for viruses, you don't have to worry too much. Because linux Hosts are relatively few and scattered, they are not good for virus transmission, especially worms.

3. Software Version Selection

Many software in linux are open-source. There are two general cases: some of them are updated quickly, and they are all popular software. There are also some delayed updates, and it is likely that the author is ready to give up.
For the server, do not update the new version immediately after it is released. Although the new version improves its functionality and speed, new software has some new code, the security of these codes can be determined after a while. Therefore, it is not too late to update it after it is stable. But there are also exceptions. For example, many vulnerabilities have been found in the 2.6.17 series kernel, but no major vulnerabilities have been found in the new 2.6.18 series. Therefore, updating 2.6.18 is a good choice.
If the software is very important, don't rush to change it. You can wait. If the software is creative and influential, even if the author does not update it any more, soon a new development team will take over from him.