Linux server hacking problems and countermeasures

This article explains to everyone about the hacking of Linux servers. It's about "root kits" or popular spying tools that take up your CPU, memory, data and bandwidth issues.

There will be some friends who have encountered the problem of the server being hacked. After collecting and sorting out relevant related materials, I have found a solution for the hacking of the Linux server here. I hope everyone will see it later. Less harvest. If you install all the right patches, have a tested firewall, and activate advanced intrusion detection systems at multiple levels, then you will only be hacked in one situation, that is, you are too lazy Didn't do what you need to do, for example, install the latest patch for BIND.

It’s really embarrassing to be stunned. It’s more serious that some scripting demons will also download some well-known “root kits” or popular spying tools, which take up your CPU. , memory, data and bandwidth. These bad guys started from there? This starts with the root kit.

A root kit is actually a package that hackers use to provide themselves with root-level access to your machine. Once the hacker can access your machine as root, everything is done. The only thing you can do is back up your data with the fastest efficiency, clean the hard drive, and reinstall the operating system. In any case, once your machine is taken over by someone, recovery is not an easy task.

Can you trust your ps command?
The first trick to find out the root kit is to run the ps command. It may be normal for you to see everything. The illustration is an example of a ps command output. The real question is, “Is everything really normal?” A common trick used by hackers is to replace the ps command, and the ps on this replacement will not display the illegal programs that are running on your machine. To test this, you should check the size of your ps file, which is usually located at /bin/ps. It has about 60kB on our Linux machine. I recently encountered a ps program that was replaced by a root kit. This thing is only about 12kB in size.

Another obvious scam is to link the root command history file to /dev/null. This command history file is used to track and record the commands used by a user after logging in to a Linux machine. The purpose of hackers redirecting your history files to /dev/null is that you can't see the commands they have entered.

You can access your history file by typing history at the shell prompt. If you find yourself using the history command and it does not appear in the list of commands you have used before, you should take a look at your ~/.bash_history file. If the file is empty, execute an ls -l ~/.bash_history command. After you execute the above command you will see output similar to the following:

-rw------- 1 jd jd 13829 Oct 10 17:06 /home/jd/.bash_history

Or, you may see output similar to the following: lrwxrwxrwx 1 jd jd 9 Oct 10 19:40 /home/jd/.bash_history -> /dev/null

If you look The second is to indicate that the .bash_history file has been redirected to /dev/null. This is a fatal message, immediately disconnect your machine from the Internet, back up your data as much as possible, and start reinstalling the system.

Resolve Linux servers being hacked and need to find unknown user accounts:
When you are going to do a test on your Linux machine, it is wise to first check if there is an unknown user account. of. The next time you log in to your Linux server, type the following command:

grep :x:0: /etc/passwd

There is only one line, I will emphasize it again, in a standard In a Linux installation, the grep command should only return one line, similar to the following:

root:x:0:0:root:/root:/bin/bash

If you typed before After the grep command, your system returns more than one line, which may be a problem. There should be only one user whose UID is 0, and if the grep command returns more than one line, it means more than one user. Seriously, although these are some good basic methods for discovering hacking behavior. But these techniques alone do not constitute sufficient security, and their depth and breadth are far worse than the intrusion detection systems mentioned in the article.

The above is a small knowledge point, about the solution to the hacked Linux server.