What are you going to do after the Linux system is compromised?

The Linux system server was hacked and summed up the following basic methods

First Use Iptraf check, if not installed run Yum install Iptraf installed, look inside is not a lot of UDP packet hair, if it is, basic people have been installed back door

1. Check your account

# LESS/ETC/PASSWD

# grep:0:/etc/passwd (check if new user is generated, and UID, GID is 0 users)

# ls-l/etc/passwd (view file modified date)

# awk-f: ' $3= =0 {print '} '/etc/passwd (see if privileged users exist)

# awk-f: ' Length ($ = $) = =0 {print '} '/etc/shadow (see if there is a blank password account)

2. Check the log

# Last (View the history of all users who normally log on to this computer)

Note "entered promiscuous mode"

Note the error message

Note Remote Procedure call (RPC) programs with a log entry that includes a large number (>) Strange characters (-^pm-^p M-^PM-^PM-^PM-^PM-^PM-^PM)

3. Check the process

# Ps-aux (Note that the UID is 0)

# lsof-p PID (see the opening and file of the process)

# Cat/etc/inetd.conf | Grep-v "^#" (check daemon)

Check hidden processes

# Ps-ef|awk ' {print} ' |sort-n|uniq >1

# LS/PORC |sort-n|uniq >2

# diff 1 2

4. Check the file

# Find/-uid 0–perm-4000–print

# Find/-size +10000k–print

# Find/-name "..." –print

# Find/-name "..." –print

# Find/-name "." –print

# Find/-name "" –print

Note suid files, suspicious larger than 10M and space files

# Find/-name core-exec ls-l {}; (check the core file in the system)

Check System file Integrity

# Rpm–qf/bin/ls

# Rpm-qf/bin/login

# md5sum–b file name

# md5sum–t file name

5. Check rpm

# Rpm–va

Output format:

S–file size differs

M–mode differs (permissions)

5–MD5 sum differs

D–device number mismatch

L–readlink path mismatch

U–user ownership differs

G–group ownership differs

T–modification time differs

Note the related/sbin,/bin,/usr/sbin, And/usr/bin

6. Check the network

# IP Link | grep Promisc (normal NIC should not be in Promisc mode, there may be sniffer)

# Lsof–i

# NETSTAT–NAP (see TCP/UDP ports that are not properly open)

# Arp–a

7. Check the Scheduled Tasks

Note that the root and UID are 0 schedule

# Crontab–u Root–l

# Cat/etc/crontab

# ls/etc/cron.*

8. Check the back door

# Cat/etc/crontab

# ls/var/spool/cron/

# cat/etc/rc.d/rc.local

# LS/ETC/RC.D

# LS/ETC/RC3.D

# Find/-type f-perm 4000

9. Check the kernel module

# Lsmod

10. Check System Services

# chkconfig

# rpcinfo-p (view RPC service)

11. Check for rootkits

# rkhunter-c

# Chkrootkit-q

12. Check the Chkconfig list to prevent some programs from being added to boot

Chkconfig--list

This article is from the "xinsz08の parallel space-time" blog, be sure to keep this source http://xinsz08.blog.51cto.com/10565212/1915958

What are you going to do after the Linux system is compromised?