[\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n

\u6df1\u5ea6\u5206\u6790\u6280\u8853<\/strong><\/h2>\n

\u4f7f\u7528\u4ee5\u4e0b\u65b9\u6cd5\u9032\u884c\u5fb9\u5e95\u7684\u53d6\u8b49\u5206\u6790\uff1a<\/p>\n

\n
• \u7a0b\u5e8f\u5206\u6790\uff1a\n
  \n
  • \u6aa2\u67e5\u96b1\u85cf\u7a0b\u5e8f\uff1a`ps aux | grep -i ‘[h]idden’`<\/li>\n
  • \u5206\u6790\u7a0b\u5e8f\u6a39\uff1a`pstree -p`<\/li>\n
  • \u6aa2\u67e5\u7a0b\u5e8f\u5957\u63a5\u5b57\u9023\u63a5\uff1a`lsof -i`<\/li>\n<\/ul>\n<\/li>\n
  • \u6587\u4ef6\u7cfb\u7d71\u8abf\u67e5\uff1a\n
    \n
    • \u641c\u7d22\u6700\u8fd1\u4fee\u6539\u7684\u6587\u4ef6\uff1a`find \/ -mtime -2 -ls`<\/li>\n
    • \u6aa2\u67e5\u6587\u4ef6\u5b8c\u6574\u6027\uff1a`tripwire`\u6216`aide`<\/li>\n
    • \u6aa2\u67e5\u96b1\u85cf\u76ee\u9304\uff1a`find \/ -name “.*” -ls`<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

      [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n

      \u60e1\u610f\u8edf\u9ad4\u6e05\u9664\u548c\u7cfb\u7d71\u6e05\u7406<\/strong><\/h2>\n

      \u7cfb\u7d71\u5730\u57f7\u884c\u9019\u4e9b\u6e05\u7406\u7a0b\u5e8f\uff1a<\/p>\n

      \n
      • \u7d42\u6b62\u53ef\u7591\u7a0b\u5e8f\n
        \n
        • \u8b58\u5225PID\uff1a`ps aux | grep -i ‘[suspicious_name]’`<\/li>\n
        • \u7d42\u6b62\u7a0b\u5e8f\uff1a`kill -9 [PID]`<\/li>\n<\/ul>\n<\/li>\n
        • \u522a\u9664\u60e1\u610f\u6587\u4ef6\n
          \n
          • \u6aa2\u67e5\u5e38\u898b\u96b1\u85cf\u4f4d\u7f6e\uff1a`\/tmp`\u3001`\/var\/tmp`\u3001`\/dev\/shm`<\/li>\n
          • \u522a\u9664\u5b9a\u6642\u4efb\u52d9\uff1a`crontab -r`<\/li>\n
          • \u6e05\u7406SSH\u6388\u6b0a\u5bc6\u9470\uff1a`truncate -s 0 ~\/.ssh\/authorized_keys`<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

            \u5728\u8655\u7406\u65e5\u672c\u4f3a\u670d\u5668\u79df\u7528\u74b0\u5883\u6642\uff0c\u8acb\u7279\u5225\u6ce8\u610f\uff1a<\/p>\n

            \n
            • \u91dd\u5c0d\u4e9e\u6d32\u57fa\u790e\u8a2d\u65bd\u7684\u5340\u57df\u7279\u5b9a\u60e1\u610f\u8edf\u9ad4\u8b8a\u9ad4<\/li>\n
            • \u507d\u88dd\u6210\u5408\u6cd5\u65e5\u672c\u7cfb\u7d71\u5de5\u5177\u7684\u5f8c\u9580<\/li>\n
            • \u6839\u64da\u65e5\u672c\u6a19\u6e96\u6642\u9593\u8a2d\u5b9a\u7684\u5b9a\u6642\u89f8\u767c\u8173\u672c<\/li>\n<\/ul>\n

              [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n

              \u7cfb\u7d71\u5f37\u5316\u548c\u5fa9\u539f<\/strong><\/h2>\n

              \u6e05\u7406\u7cfb\u7d71\u5f8c\uff0c\u5be6\u65bd\u4ee5\u4e0b\u5f37\u5316\u63aa\u65bd\uff1a<\/p>\n

              \n
              • \u66f4\u65b0\u548c\u88dc\u4e01\u7ba1\u7406\uff1a\n
                \n
                • \u7cfb\u7d71\u66f4\u65b0\uff1a`apt update && apt upgrade -y`\u6216`yum update -y`<\/li>\n
                • \u5167\u6838\u88dc\u4e01\uff1a`apt dist-upgrade`\u6216`yum kernel-update`<\/li>\n
                • \u5b89\u5168\u8edf\u9ad4\u5305\uff1a`apt install rkhunter chkrootkit`<\/li>\n<\/ul>\n<\/li>\n
                • \u8a2a\u554f\u63a7\u5236\u5f37\u5316\uff1a\n
                  \n
                  • \u5bc6\u78bc\u91cd\u7f6e\uff1a`passwd [username]`<\/li>\n
                  • SSH\u5bc6\u9470\u8f2a\u63db\uff1a`ssh-keygen -t ed25519`<\/li>\n
                  • PAM\u914d\u7f6e\uff1a`vim \/etc\/pam.d\/sshd`<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

                    [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n

                    \u65e5\u672c\u5b89\u5168\u5de5\u5177\u6574\u5408<\/strong><\/h2>\n

                    \u5229\u7528\u9019\u4e9b\u65e5\u672c\u7279\u5b9a\u7684\u5b89\u5168\u5de5\u5177\u52a0\u5f37\u4fdd\u8b77\uff1a<\/p>\n

                    \n
                    • JPCERT\/CC\u5b89\u5168\u5de5\u5177\uff1a\n
                      \n
                      • \u7528\u65bcWindows\u4e8b\u4ef6\u5206\u6790\u7684LogonTracer<\/li>\n
                      • \u7528\u65bc\u5373\u6642\u5a01\u8105\u76e3\u63a7\u7684nicter<\/li>\n
                      • \u7528\u65bc\u7db2\u8def\u7570\u5e38\u6aa2\u6e2c\u7684TSUBAME<\/li>\n<\/ul>\n<\/li>\n
                      • \u5340\u57df\u5b89\u5168\u8cc7\u6e90\uff1a\n
                        \n
                        • IPA\u5b89\u5168\u516c\u544a\u8cc7\u6599\u5eab<\/li>\n
                        • JNSA\u6700\u4f73\u5be6\u8e10\u6307\u5357<\/li>\n
                        • CERT-JP\u5a01\u8105\u60c5\u5831\u6e90<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

                          [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n

                          \u9810\u9632\u63aa\u65bd\u5be6\u65bd<\/strong><\/h2>\n

                          \u90e8\u7f72\u9019\u4e9b\u4e3b\u52d5\u5b89\u5168\u63a7\u5236\uff1a<\/p>\n

                          \n
                          • \u81ea\u52d5\u5316\u76e3\u63a7\uff1a\n
                            \n
                            • \u914d\u7f6e\u652f\u63f4\u65e5\u8a9e\u74b0\u5883\u7684Nagios<\/li>\n
                            • \u8a2d\u7f6e\u57fa\u65bc\u65e5\u672c\u6a19\u6e96\u6642\u9593\u7684Zabbix\u8b66\u5831<\/li>\n
                            • \u4f7f\u7528\u81ea\u5b9a\u7fa9\u898f\u5247\u5be6\u65bdfail2ban<\/li>\n<\/ul>\n<\/li>\n
                            • \u5099\u4efd\u7b56\u7565\uff1a\n
                              \n
                              • \u6bcf\u65e5\u589e\u91cf\u5099\u4efd\uff1a`rdiff-backup \/var\/www \/backup`<\/li>\n
                              • \u6bcf\u9031\u5b8c\u6574\u5099\u4efd\uff1a`tar czf \/backup\/full-$(date +%Y%m%d).tar.gz \/var\/www`<\/li>\n
                              • \u8907\u88fd\u5230\u65e5\u672c\u6578\u64da\u4e2d\u5fc3\u7684\u7570\u5730\u5099\u4efd<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

                                [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n

                                \u61c9\u6025\u97ff\u61c9\u6aa2\u67e5\u6e05\u55ae<\/strong><\/h2>\n

                                \u96a8\u6642\u6e96\u5099\u6b64\u4e8b\u4ef6\u97ff\u61c9\u6aa2\u67e5\u6e05\u55ae\u4ee5\u4f9b\u5feb\u901f\u53c3\u8003\uff1a<\/p>\n

                                \n
                                • \u521d\u59cb\u97ff\u61c9\uff1a\n
                                  \n
                                  • \u8a18\u9304\u4e8b\u4ef6\u6642\u9593\u548c\u6aa2\u6e2c\u65b9\u6cd5<\/li>\n
                                  • \u9694\u96e2\u53d7\u5f71\u97ff\u7684\u7cfb\u7d71<\/li>\n
                                  • \u901a\u77e5\u5b89\u5168\u5718\u968a\u548c\u5229\u76ca\u76f8\u95dc\u8005<\/li>\n<\/ul>\n<\/li>\n
                                  • \u8abf\u67e5\uff1a\n
                                    \n
                                    • \u6355\u7372\u6613\u5931\u6578\u64da<\/li>\n
                                    • \u5275\u5efa\u7cfb\u7d71\u5feb\u7167<\/li>\n
                                    • \u8a18\u9304\u6240\u6709\u767c\u73fe<\/li>\n<\/ul>\n<\/li>\n
                                    • \u5fa9\u539f\uff1a\n
                                      \n
                                      • \u79fb\u9664\u60e1\u610f\u7d44\u4ef6<\/li>\n
                                      • \u4fee\u88dc\u6f0f\u6d1e<\/li>\n
                                      • \u5f9e\u6e05\u6f54\u5099\u4efd\u5fa9\u539f<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

                                        [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n

                                        \u91cd\u8981\u806f\u7d61\u8cc7\u8a0a<\/strong><\/h2>\n

                                        \u4fdd\u5b58\u9019\u4e9b\u65e5\u672c\u4f3a\u670d\u5668\u79df\u7528\u74b0\u5883\u7684\u7dca\u6025\u806f\u7d61\u65b9\u5f0f\uff1a<\/p>\n

                                        \n
                                        • JPCERT\/CC\uff1a\u4e8b\u4ef6\u5831\u544a\u71b1\u7dda<\/li>\n
                                        • \u672c\u5730\u4f3a\u670d\u5668\u79df\u7528\u63d0\u4f9b\u5546\u7684\u5b89\u5168\u5718\u968a<\/li>\n
                                        • \u5340\u57dfCSIRT\u806f\u7d61\u4eba<\/li>\n
                                        • \u65e5\u672c\u6578\u4f4d\u9451\u8b58\u5c08\u5bb6<\/li>\n<\/ul>\n

                                          [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n

                                          \u7d50\u8ad6<\/strong><\/h2>\n

                                          \u5728\u4e0d\u65b7\u767c\u5c55\u7684\u65e5\u672c\u4f3a\u670d\u5668\u79df\u7528\u5b89\u5168\u74b0\u5883\u4e2d\uff0c\u4e8b\u4ef6\u97ff\u61c9\u9700\u8981\u6280\u8853\u5c08\u9577\u548c\u5340\u57df\u610f\u8b58\u7684\u7d50\u5408\u3002\u96d6\u7136\u4f3a\u670d\u5668\u5165\u4fb5\u53ef\u80fd\u9020\u6210\u56b4\u91cd\u7834\u58de\uff0c\u4f46\u9075\u5faa\u9019\u7a2e\u7d50\u69cb\u5316\u65b9\u6cd5\u53ef\u4ee5\u78ba\u4fdd\u9ad8\u6548\u5fa9\u539f\u4e26\u52a0\u5f37\u60a8\u7684\u5b89\u5168\u614b\u52e2\u3002\u5b9a\u671f\u6f14\u7df4\u548c\u66f4\u65b0\u60a8\u7684\u4e8b\u4ef6\u97ff\u61c9\u8a08\u5283\uff0c\u7279\u5225\u662f\u91dd\u5c0d\u65e5\u672c\u4f3a\u670d\u5668\u79df\u7528\u74b0\u5883\u7684\u90e8\u5206\uff0c\u5c07\u6709\u52a9\u65bc\u4fdd\u6301\u5c0d\u672a\u4f86\u5b89\u5168\u6311\u6230\u7684\u6e96\u5099\u3002<\/p>\n

                                          \n

                                          \u5feb\u901f\u53c3\u8003<\/h3>\n

                                          \n
                                          • \u4fdd\u5b58\u672c\u6307\u5357\u4ee5\u4f9b\u96e2\u7dda\u53c3\u8003<\/li>\n
                                          • \u6bcf\u5b63\u5ea6\u5be9\u67e5\u548c\u66f4\u65b0\u7a0b\u5e8f<\/li>\n
                                          • \u5728\u6e2c\u8a66\u74b0\u5883\u4e2d\u6e2c\u8a66\u5fa9\u539f\u7a0b\u5e8f<\/li>\n
                                          • \u4fdd\u6301\u76e3\u63a7\u5de5\u5177\u6821\u6e96\u5230\u65e5\u672c\u6a19\u6e96\u6642\u9593<\/li>\n<\/ul>\n<\/div>\n

                                            \u8acb\u8a18\u4f4f\uff0c\u5728\u4f3a\u670d\u5668\u5165\u4fb5\u6848\u4f8b\u4e2d\uff0c\u6210\u529f\u7684\u4e8b\u4ef6\u97ff\u61c9\u53d6\u6c7a\u65bc\u901f\u5ea6\u3001\u7cbe\u78ba\u6027\u548c\u7cfb\u7d71\u5316\u57f7\u884c\u3002\u901a\u904e\u9075\u5faa\u9019\u4e9b\u91dd\u5c0d\u65e5\u672c\u4f3a\u670d\u5668\u79df\u7528\u74b0\u5883\u7684\u5177\u9ad4\u6307\u5357\uff0c\u60a8\u5c07\u505a\u597d\u5145\u5206\u6e96\u5099\uff0c\u80fd\u5920\u6709\u6548\u8655\u7406\u5b89\u5168\u4e8b\u4ef6\uff0c\u540c\u6642\u4fdd\u6301\u7b26\u5408\u7576\u5730\u6cd5\u898f\u3002<\/p>\n

                                            [\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"

                                            [vc_row el_class=”blog-detail-section”][vc_ […]<\/p>\n

                                            Read More…<\/a><\/p>\n","protected":false},"author":1,"featured_media":27657,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[8116],"tags":[9012,9013,9014,9015,578],"class_list":["post-27659","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-japan-dedicated-server-tc","tag-server-intrusion","tag-incident-response","tag-japan-hosting-security","tag-server-recovery","tag-network-security-tc"],"acf":[],"yoast_head":"\n