Whether the Linux system is hacked How to judge

The common name is "The script devil" is a very bad hacker, because basically many of them and most people are so skillless. It can be said that if you install all the correct patches, have a tested firewall, and activate advanced intrusion detection systems at multiple levels, then in only one case you will be hacked, that is, you Too lazy to do what to do, for example, to install the latest patch for BIND.

It’s really embarrassing to be stunned. It’s more serious that some scripting demons will also download some well-known “root kits” or popular spying tools, which take up your CPU. , memory, data and bandwidth. Where did these bad guys start from there? This starts with the root kit.

A root kit is actually a package that hackers use to provide themselves with root-level access to your machine. Once the hacker can access your machine as root, everything is done. The only thing you can do is back up your data with the fastest efficiency, clean the hard drive, and reinstall the operating system. In any case, once your machine is taken over by someone, recovery is not an easy task.

Can you trust your ps command?

The first trick to find out the root kit is to run the ps command. It may be normal for you to see everything. The illustration is an example of a ps command output. The real question is, “Is everything really normal?” & rdquo; One trick that hackers often use is to replace the ps command, and the ps on this replacement will not display the illegal programs that are running on your machine. In order to test, you should check the size of your ps file, which is usually located in /bin/ps. It is about 60kB on our Linux machine. I recently encountered a ps program replaced by the root kit, which is only about 12kB. the size of.

Another obvious scam is to link the root command history file to /dev/null. This command history file is used to track and record a user's login to a Linux machine. Commanded. The purpose of hackers redirecting your history files to /dev/null is that you can't see the commands they have entered.

You can access your history file by typing history at the shell prompt. If you find yourself using the history command and it does not appear in the list of commands you have used before, you should take a look at your ~/.bash_history file. If the file is empty, execute an ls -l ~/.bash_history command. After you execute the above command you will see output similar to the following:

-rw—— 1 jd jd 13829 Oct 10 17:06 /home/jd/.bash_history

Or, you might see output similar to the following:

lrwxrwxrwx 1 jd jd 9 Oct 10 19:40 /home/jd/.bash_history -> /dev/null

What you see is the second, which indicates that the .bash_history file has been redirected to /dev/null. This is a fatal message. Immediately disconnect your machine from the Internet and back up your files as much as possible. Data and start reinstalling the system.

Finding Unknown User Accounts

When you're going to do a test on your Linux machine, it's wise to first check for unknown user accounts. The next time you log in to your Linux machine, type the following command:

grep :x:0: /etc/passwd

There is only one line, I emphasize it again, in a standard In a Linux installation, the grep command should only return one line, similar to the following:

root:x:0:0:root:/root:/bin/bash

If you typed before After the grep command, your system returns more than one line, which may be a problem. There should be only one user whose UID is 0, and if the grep command returns more than one line, it means more than one user.

Seriously, although these are good basic methods for discovering hacking. But these techniques alone do not constitute sufficient security, and their depth and breadth are far worse than the intrusion detection systems mentioned in the article.

Youth Network's suggestion is, if you suspect that your system is really a problem, call a Linux security expert and refer to his opinion. After all, Linux security can be done right away.