Hacker attack and Defense: website Common Backdoor Summary

Intermediary transaction http://www.aliyun.com/zixun/aggregation/6858.html ">seo diagnose Taobao guest cloud host technology Hall

Although it is said that the backdoor damage to the Trojan can be minimized, the best way is obviously to prevent it.

1. Back door to prevent basic skills

You must first turn off ports that are not in use on this machine or allow only specified port access; Second, to use the software to kill Trojans, in order to effectively prevent the backdoor; the third is to learn to process operations, always pay attention to the operation of the system, to see if there are some unknown process is running and in a timely manner to terminate the unknown process.

2. Security Configuration Web Server

If a company or enterprise has a home page, how do you secure your Web server?

The first is to turn off unnecessary services, the second is to establish security account policies and security logs, and the third is to set up secure IIS, remove unnecessary IIS components, and perform IIS security configuration.

In the IIS security configuration, be careful to modify the default "Inetpub" directory path. You can delete the "inetpub" directory in C disk, then rebuild a "inetpub" in D disk, and then point the home directory to the newly established "Inetpub" path in IIS Manager. In addition, you need to delete the default "scripts", "print" and other virtual directories, and then delete the unnecessary mappings in IIS Manager, in general, you can keep ASP, ASA.

By right-clicking the host name in the IIS Information Services Manager, selecting the "Properties" → "Home directory" tab, clicking the "Advanced" button, you can delete the unnecessary mappings in the "Mapping" tab. Also, in the Properties window, select the Web Site tab, then check "Enable Log" and select the "Use the expanded log file format" item to record the client IP address, user name, server port, method, Uri root, HTTP status, user agent, and so on, and review the log daily.

After working on the basics above, you also need to set the access rights for the Web site directory.

In general, do not give directories to write and allow directory browsing permissions, only given. The ASP file directory is scripted for permissions, not for execution permissions. In the IIS Information Services Manager, expand the Web site's virtual directory, and then right-click a virtual directory, select the "Properties" → "virtual directory" tab, under "Local Path" to set permissions for this directory to read or directory browsing. You can also set user directory permissions strictly by using the NTFS partition format.

And for the core of the enterprise data, but also to strengthen the Access database download protection.

When you use Access as a background database, it is dangerous to download the Access database file if someone knows or guesses the path and database name of the server's Access database in various ways. Therefore, in general, to change the default database file name, for your database file names a complex unconventional name, and put it in a relatively deep file directory. Alternatively, you can add an open password to the Access database file.

Open the IIS Web Site Properties Settings dialog window, select the Home Directory tab, and click the Configure button to open the Application Configuration dialog window. Then, click the "Add" button, enter "Asp.dll" in "Executable", enter ". mdb" in "extension", tick "limit to", and enter "Prohibit" to make sure the setup is complete after application. Later, when an intruder attempts to download data, it is prompted to prohibit access.

Finally, configure a secure SQL Server

SQL Server is the most frequently used database system in a variety of web site systems, and the consequences are very serious once they are compromised. Although the default SA user has full permissions for SQL Server database operations, the SA account is 黩 to a blank password, so be sure to set a complex password for the SA account. Moreover, to strictly control the permissions of the database users, it is easy not to give users direct query, change, insert, delete permissions, you can only give users access to views and execute stored procedures permissions.

Be sure to be aware of security when choosing a Web program to build a Web site. Many web site systems, although powerful, but because of the security awareness of programmers, there are some very serious security vulnerabilities, such as common SQL injection vulnerabilities, Bauku, etc., are likely to be exploited by hackers. At the same time, we should also do a good job in the Web server data backup, in case of accidents, timely data recovery.