安全运维之：Linux后门入侵检测工具的使用
|
1
2
3
|
[root@server ~]
# yum -y install gcc
[root@server ~]
# yum -y install gcc-c++
[root@server ~]
# yum -y install make
|
|
1
2
3
|
[root@server ~]
# tar zxvf chkrootkit.tar.gz
[root@server ~]
# cd chkrootkit-*
[root@server ~]
# make sense
|
|
1
2
3
|
[root@server ~]
# cd ..
[root@server ~]
# cp -r chkrootkit-* /usr/local/chkrootkit
[root@server ~]
# rm -rf chkrootkit-*
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
|
[root@server chkrootkit]
# /usr/local/chkrootkit/chkrootkit
Checking `
ifconfig
'... INFECTED
Checking `
ls
'... INFECTED
Checking `login'... INFECTED
Checking `
netstat
'... INFECTED
Checking `
ps
'... INFECTED
Checking `
top
'... INFECTED
Checking `sshd'... not infected
Checking `syslogd'... not tested
Checking `
tar
'... not infected
Checking `tcpd'... not infected
Checking `tcpdump'... not infected
Checking `telnetd'... not found
|
|
1
2
3
4
5
6
|
[root@server ~]
# mkdir /usr/share/.commands
[root@server ~]
# cp `which --skip-alias awk cut echo find egrep id head ls netstat ps strings sed uname` /usr/share/.commands
[root@server ~]
# /usr/local/chkrootkit/chkrootkit -p /usr/share/.commands/
[root@server share]
# cd /usr/share/
[root@server share]
# tar zcvf commands.tar.gz .commands
[root@server share]
# rm -rf commands.tar.gz
|
|
1
2
3
4
5
6
7
|
[root@server ~]
# ls
rkhunter-1.4.0.
tar
.gz
[root@server ~]
# pwd
/root
[root@server ~]
# tar -zxvf rkhunter-1.4.0.tar.gz
[root@server ~]
# cd rkhunter-1.4.0
[root@server rkhunter-1.4.0]
# ./installer.sh --layout default --install
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
|
[root@server rkhunter-1.4.0]
# /usr/local/bin/rkhunter -c
[ Rootkit Hunter version 1.4.0 ]
#下面是第一部分，先进行系统命令的检查，主要是检测系统的二进制文件，因为这些文件最容易被rootkit攻击。显示OK字样表示正常，显示Warning表示有异常，需要引起注意，而显示“Not found”字样，一般无需理会
Checking system commands...
Performing
'strings'
command
checks
Checking
'strings'
command
[ OK ]
Performing
'shared libraries'
checks
Checking
for
preloading variables [ None found ]
Checking
for
preloaded libraries [ None found ]
Checking LD_LIBRARY_PATH variable [ Not found ]
Performing
file
properties checks
Checking
for
prerequisites [ Warning ]
/usr/local/bin/rkhunter
[ OK ]
/sbin/chkconfig
[ OK ]
....(略)....
[Press
continue
]
#下面是第二部分，主要检测常见的rootkit程序，显示“Not found”表示系统未感染此rootkit
Checking
for
rootkits...
Performing check of known rootkit files and directories
55808 Trojan - Variant A [ Not found ]
ADM Worm [ Not found ]
AjaKit Rootkit [ Not found ]
Adore Rootkit [ Not found ]
aPa Kit [ Not found ]
Apache Worm [ Not found ]
Ambient (ark) Rootkit [ Not found ]
Balaur Rootkit [ Not found ]
BeastKit Rootkit [ Not found ]
beX2 Rootkit [ Not found ]
BOBKit Rootkit [ Not found ]
....(略)....
[Press
continue
]
#下面是第三部分，主要是一些特殊或附加的检测，例如对rootkit文件或目录检测、对恶意软件检测以及对指定的内核模块检测
Performing additional rootkit checks
Suckit Rookit additional checks [ OK ]
Checking
for
possible rootkit files and directories [ None found ]
Checking
for
possible rootkit strings [ None found ]
Performing malware checks
Checking running processes
for
suspicious files [ None found ]
Checking
for
login backdoors [ None found ]
Checking
for
suspicious directories [ None found ]
Checking
for
sniffer log files [ None found ]
Performing Linux specific checks
Checking loaded kernel modules [ OK ]
Checking kernel module names [ OK ]
[Press
continue
]
#下面是第四部分，主要对网络、系统端口、系统启动文件、系统用户和组配置、SSH配置、文件系统等进行检测
Checking the network...
Performing checks on the network ports
Checking
for
backdoor ports [ None found ]
Performing checks on the network interfaces
Checking
for
promiscuous interfaces [ None found ]
Checking the
local
host...
Performing system boot checks
Checking
for
local
host name [ Found ]
Checking
for
system startup files [ Found ]
Checking system startup files
for
malware [ None found ]
Performing group and account checks
Checking
for
passwd
file
[ Found ]
Checking
for
root equivalent (UID 0) accounts [ None found ]
Checking
for
passwordless accounts [ None found ]
....(略)....
[Press
continue
]
#下面是第五部分，主要是对应用程序版本进行检测
Checking application versions...
Checking version of GnuPG[ OK ]
Checking version of OpenSSL [ Warning ]
Checking version of OpenSSH [ OK ]
#下面是最后一部分，这个部分其实是上面输出的一个总结，通过这个总结，可以大概了解服务器目录的安全状态。
System checks summary
=====================
File properties checks...
Required commands check failed
Files checked: 137
Suspect files: 4
Rootkit checks...
Rootkits checked : 311
Possible rootkits: 0
Applications checks...
Applications checked: 3
Suspect applications: 1
The system checks took: 6 minutes and 41 seconds
|