mirror of
https://github.com/LCTT/TranslateProject.git
synced 2025-01-25 23:11:02 +08:00
Wenxuan Zhao
commit
87fa103754
@ -1,156 +0,0 @@
|
||||
translating by lujun9972
|
||||
How To Tell If Your Linux Server Has Been Compromised
|
||||
--------------
|
||||
|
||||
A server being compromised or hacked for the purpose of this guide is an unauthorized person or bot logging into the server in order to use it for their own, usually negative ends.
|
||||
|
||||
Disclaimer: If your server has been compromised by a state organization like the NSA or a serious criminal group then you will not notice any problems and the following techniques will not register their presence.
|
||||
|
||||
However, the majority of compromised servers are carried out by bots i.e. automated attack programs, in-experienced attackers e.g. “script kiddies”, or dumb criminals.
|
||||
|
||||
These sorts of attackers will abuse the server for all it’s worth whilst they have access to it and take few precautions to hide what they are doing.
|
||||
|
||||
### Symptoms of a compromised server
|
||||
|
||||
When a server has been compromised by an in-experienced or automated attacker they will usually do something with it that consumes 100% of a resource. This resource will usually be either the CPU for something like crypt-currency mining or email spamming, or bandwidth for launching a DOS attack.
|
||||
|
||||
This means that the first indication that something is amiss is that the server is “going slow”. This could manifest in the website serving pages much slower than usual, or email taking many minutes to deliver or send.
|
||||
|
||||
So what should you look for?
|
||||
|
||||
### Check 1 - Who’s currently logged in?
|
||||
|
||||
The first thing you should look for is who is currently logged into the server. It is not uncommon to find the attacker actually logged into the server and working on it.
|
||||
|
||||
The shell command to do this is w. Running w gives the following output:
|
||||
|
||||
```
|
||||
08:32:55 up 98 days, 5:43, 2 users, load average: 0.05, 0.03, 0.00
|
||||
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
|
||||
root pts/0 113.174.161.1 08:26 0.00s 0.03s 0.02s ssh root@coopeaa12
|
||||
root pts/1 78.31.109.1 08:26 0.00s 0.01s 0.00s w
|
||||
|
||||
```
|
||||
|
||||
One of those IP’s is a UK IP and the second is Vietnamese. That’s probably not a good thing.
|
||||
|
||||
Stop and take a breath, don’t panic and simply kill their SSH connection. Unless you can stop then re-entering the server they will do so quickly and quite likely kick you off and stop you getting back in.
|
||||
|
||||
Please see the What should I do if I’ve been compromised section at the end of this guide no how to proceed if you do find evidence of compromise.
|
||||
|
||||
The whois command can be run on IP addresses and will tell you what all the information about the organization that the IP is registered to, including the country.
|
||||
|
||||
### Check 2 - Who has logged in?
|
||||
|
||||
Linux servers keep a record of which users logged in, from what IP, when and for how long. This information is accessed with the last command.
|
||||
|
||||
The output looks like this:
|
||||
|
||||
```
|
||||
root pts/1 78.31.109.1 Thu Nov 30 08:26 still logged in
|
||||
root pts/0 113.174.161.1 Thu Nov 30 08:26 still logged in
|
||||
root pts/1 78.31.109.1 Thu Nov 30 08:24 - 08:26 (00:01)
|
||||
root pts/0 113.174.161.1 Wed Nov 29 12:34 - 12:52 (00:18)
|
||||
root pts/0 14.176.196.1 Mon Nov 27 13:32 - 13:53 (00:21)
|
||||
|
||||
```
|
||||
|
||||
There is a mix of my UK IP’s and some Vietnamese ones, with the top two still logged in. If you see any IP’s that are not authorized then refer to the final section.
|
||||
|
||||
The login history is contained in a text file at ~/.bash_history and is therefore easily removable. Often, attackers will simply delete this file to try to cover their tracks. Consequently, if you run last and only see your current login, this is a Bad Sign.
|
||||
|
||||
If there is no login history be very, very suspicious and continue looking for indications of compromise.
|
||||
|
||||
### Check 3 - Review the command history
|
||||
|
||||
This level of attacker will frequently take no precautions to leave no command history so running the history command will show you everything they have done. Be on the lookout for wget or curl commands to download out-of-repo software such as spam bots or crypto miners.
|
||||
|
||||
The command history is contained in the ~/.bash_history file so some attackers will delete this file to cover what they have done. Just as with the login history, if you run history and don’t see anything then the history file has been deleted. Again this is a Bad Sign and you should review the server very carefully.
|
||||
|
||||
### Check 4 - What’s using all the CPU?
|
||||
|
||||
The sorts of attackers that you will encounter usually don’t take too many precautions to hide what they are doing. So they will run processes that consume all the CPU. This generally makes it pretty easy to spot them. Simply run top and look at the highest process.
|
||||
|
||||
This will also show people exploiting your server without having logged in. This could be, for example, someone using an unprotected form-mail script to relay spam.
|
||||
|
||||
If you don’t recognize the top process then either Google its name or investigate what it’s doing with losf or strace.
|
||||
|
||||
To use these tools first copy its PID from top and run:
|
||||
|
||||
```
|
||||
strace -p PID
|
||||
|
||||
```
|
||||
|
||||
This will display all the system calls the process is making. It’s a lot of information but looking through it will give you a good idea what’s going on.
|
||||
|
||||
```
|
||||
lsof -p PID
|
||||
|
||||
```
|
||||
|
||||
This program will list the open files that the process has. Again, this will give you a good idea what it’s doing by showing you what files it is accessing.
|
||||
|
||||
### Check 5 - Review the all the system processes
|
||||
|
||||
If an unauthorized process is not consuming enough CPU to get listed noticeably on top it will still get displayed in a full process listing with ps. My proffered command is ps auxf for providing the most information clearly.
|
||||
|
||||
You should be looking for any processes that you don’t recognize. The more times you run ps on your servers (which is a good habit to get into) the more obvious an alien process will stand out.
|
||||
|
||||
### Check 6 - Review network usage by process
|
||||
|
||||
The command iftop functions like top to show a ranked list of processes that are sending and receiving network data along with their source and destination. A process like a DOS attack or spam bot will immediately show itself at the top of the list.
|
||||
|
||||
### Check 7 - What processes are listening for network connections?
|
||||
|
||||
Often an attacker will install a program that doesn’t do anything except listen on the network port for instructions. This does not consume CPU or bandwidth whilst it is waiting so can get overlooked in the top type commands.
|
||||
|
||||
The commands lsof and netstat will both list all networked processes. I use them with the following options:
|
||||
|
||||
```
|
||||
lsof -i
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
netstat -plunt
|
||||
|
||||
```
|
||||
|
||||
You should look for any process that is listed as in the LISTEN or ESTABLISHED status as these processes are either waiting for a connection (LISTEN) or have a connection open (ESTABLISHED). If you don’t recognize these processes use strace or lsof to try to see what they are doing.
|
||||
|
||||
### What should I do if I’ve been compromised?
|
||||
|
||||
The first thing to do is not to panic, especially if the attacker is currently logged in. You need to be able to take back control of the machine before the attacker is aware that you know about them. If they realize you know about them they may well lock you out of your server and start destroying any assets out of spite.
|
||||
|
||||
If you are not very technical then simply shut down the server. Either from the server itself with shutdown -h now or systemctl poweroff. Or log into your hosting provider’s control panel and shut down the server. Once it’s powered off you can work on the needed firewall rules and consult with your provider in your own time.
|
||||
|
||||
If you’re feeling a bit more confident and your hosting provider has an upstream firewall then create and enable the following two rules in this order:
|
||||
|
||||
1. Allow SSH traffic from only your IP address.
|
||||
|
||||
2. Block everything else, not just SSH but every protocol on every port.
|
||||
|
||||
This will immediately kill their SSH session and give only you access to the server.
|
||||
|
||||
If you don’t have access to an upstream firewall then you will have to create and enable these firewall rules on the server itself and then, when they are in place kill the attacker’s ssh session with the kill command.
|
||||
|
||||
A final method, where available, is to log into the server via an out-of-band connection such as the serial console and stop networking with systemctl stop network.service. This will completely stop any network access so you can now enable the firewall rules in your own time.
|
||||
|
||||
Once you have regained control of the server do not trust it.
|
||||
|
||||
Do not attempt to fix things up and continue using the server. You can never be sure what the attacker did and so you can never sure the server is secure.
|
||||
|
||||
The only sensible course of action is to copy off all the data that you need and start again from a fresh install.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://bash-prompt.net/guides/server-hacked/
|
||||
|
||||
作者：[Elliot Cooper][a]
|
||||
译者：[lujun9972](https://github.com/lujun9972)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:https://bash-prompt.net
|
||||
@ -0,0 +1,163 @@
|
||||
如何判断Linux服务器是否被入侵
|
||||
--------------
|
||||
|
||||
本指南中所谓的服务器被入侵或者说被黑了的意思是指未经认证的人或程序为了自己的目的登录到服务器上去并使用其计算资源, 通常会产生不好的影响。
|
||||
|
||||
免责声明: 若你的服务器被类似NSA这样的国家机关或者某个犯罪集团如请，那么你并不会发现有任何问题，这些技术也无法发觉他们的存在。
|
||||
|
||||
然而, 大多数被攻破的服务器都是被类似自动攻击程序这样的程序或者类似“脚本小子”这样的廉价攻击者，以及蠢蛋犯罪所入侵的。
|
||||
|
||||
这类攻击者会在访问服务器的同时滥用服务器资源，并且不怎么会采取措施来隐藏他们正在做的事情。
|
||||
|
||||
### 入侵服务器的症状
|
||||
|
||||
当服务器被没有经验攻击者或者自动攻击程序入侵了的话，他们往往会消耗100%的资源. 他们可能消耗CPU资源来进行数字货币的采矿或者发送垃圾邮件,也可能消耗带宽来发动 `DoS` 攻击。
|
||||
|
||||
因此出现问题的第一个表现就是服务器 “变慢了”. 这可能表现在网站的页面打开的很慢, 或者电子邮件要花很长时间才能发送出去。
|
||||
|
||||
那么你应该查看那些东西呢?
|
||||
|
||||
#### 检查 1 - 当前都有谁在登录?
|
||||
|
||||
你首先要查看当前都有谁登录在服务器上. 发现攻击者登录到服务器上进行操作并不罕见。
|
||||
|
||||
其对应的命令是 `w`. 运行 `w` 会输出如下结果:
|
||||
|
||||
```
|
||||
08:32:55 up 98 days, 5:43, 2 users, load average: 0.05, 0.03, 0.00
|
||||
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
|
||||
root pts/0 113.174.161.1 08:26 0.00s 0.03s 0.02s ssh root@coopeaa12
|
||||
root pts/1 78.31.109.1 08:26 0.00s 0.01s 0.00s w
|
||||
|
||||
```
|
||||
|
||||
第一个IP是英国IP，而第二个IP是越南IP. 这个不是个好兆头。
|
||||
|
||||
停下来做个深呼吸, 不要紧，只需要杀掉他们的SSH连接就好了. Unless you can stop then re-entering the server they will do so quickly and quite likely kick you off and stop you getting back in。
|
||||
|
||||
请参阅本文最后的 `入侵之后怎么办` 这一章节来看发现被入侵的证据后应该怎么办。
|
||||
|
||||
`whois` 命令可以接一个IP地址然后告诉你IP注册的组织的所有信息, 当然就包括所在国家的信息。
|
||||
|
||||
#### 检查 2 - 谁曾经登录过?
|
||||
|
||||
Linux 服务器会记录下哪些用户，从哪个IP，在什么时候登录的以及登陆了多长时间这些信息. 使用 `last` 命令可以查看这些信息。
|
||||
|
||||
输出类似这样:
|
||||
|
||||
```
|
||||
root pts/1 78.31.109.1 Thu Nov 30 08:26 still logged in
|
||||
root pts/0 113.174.161.1 Thu Nov 30 08:26 still logged in
|
||||
root pts/1 78.31.109.1 Thu Nov 30 08:24 - 08:26 (00:01)
|
||||
root pts/0 113.174.161.1 Wed Nov 29 12:34 - 12:52 (00:18)
|
||||
root pts/0 14.176.196.1 Mon Nov 27 13:32 - 13:53 (00:21)
|
||||
|
||||
```
|
||||
|
||||
这里可以看到英国IP和越南IP交替出现, 而且最上面两个IP现在还处于登录状态. 如果你看到任何未经授权的IP，那么请参阅最后章节。
|
||||
|
||||
登录历史记录会以文本格式记录到 `~/.bash_history`(注：这里作者应该写错了)中，因此很容易被删除。
|
||||
通常攻击者会直接把这个文件删掉，以掩盖他们的攻击行为. 因此, 若你运行了 `last` 命令却只看得见你的当前登录，那么这就是个不妙的信号。
|
||||
|
||||
如果没有登录历史的话，请一定小心，继续留意入侵的其他线索。
|
||||
|
||||
#### 检查 3 - 回顾命令历史
|
||||
|
||||
这个层次的攻击者通常不会注意掩盖命令的历史记录,因此运行 `history` 命令会显示出他们曾经做过的所有事情。
|
||||
一定留意有没有用 `wget` 或 `curl` 命令来下载类似垃圾邮件机器人或者挖矿程序之类的软件。
|
||||
|
||||
命令历史存储在 `~/.bash_history` 文件中，因此有些攻击者会删除该文件以掩盖他们的所作所为。
|
||||
跟登录历史一样, 若你运行 `history` 命令却没有输出任何东西那就表示历史文件被删掉了. 这也是个不妙的信号，你需要很小心地检查一下服务器了。
|
||||
|
||||
#### 检查 4 - 哪些进程在消耗CPU?
|
||||
|
||||
你常遇到的这类攻击者通常不怎么会去掩盖他们做的事情. 他们会运行一些特别消耗CPU的进程. 这就很容易发着这些进程了. 只需要运行 `top` 然后看最前的那几个进程就行了。
|
||||
|
||||
这也能显示出那些未登录的攻击者来. 比如，可能有人在用未受保护的邮件脚本来发送垃圾邮件。
|
||||
|
||||
如果你最上面的进程对不了解，那么你可以google一下进程名称,或者通过 `losf` 和 `strace` 来看看它做的事情是什么。
|
||||
|
||||
使用这些工具，第一步从 `top` 中拷贝出进程的 PID，然后运行:
|
||||
|
||||
```shell
|
||||
strace -p PID
|
||||
|
||||
```
|
||||
|
||||
这会显示出进程调用的所有系统调用. 它产生的内容会很多,但这些信息能告诉你这个进程在做什么。
|
||||
|
||||
```
|
||||
lsof -p PID
|
||||
|
||||
```
|
||||
|
||||
这个程序会列出进程打开的文件. 通过查看它访问的文件可以很好的理解它在做的事情。
|
||||
|
||||
#### 检查 5 - 检查所有的系统进程
|
||||
|
||||
消耗CPU不严重的未认证进程可能不会在 `top` 中显露出来,不过它依然可以通过 `ps` 列出来. 命令 `ps auxf` 就能显示足够清晰的信息了。
|
||||
|
||||
你需要检查一下每个不认识的进程. 经常运行 `ps` (这是个好习惯) 能帮助你发现奇怪的进程。
|
||||
|
||||
#### 检查 6 - 检查进程的网络使用情况
|
||||
|
||||
`iftop` 的功能类似 `top`，他会显示一系列收发网络数据的进程以及他们的源地址和目的地址。
|
||||
类似 `DoS` 攻击或垃圾制造器这样的进程很容易显示在列表的最顶端。
|
||||
|
||||
#### 检查 7 - 哪些进程在监听网络连接?
|
||||
|
||||
通常攻击者会安装一个后门程序专门监听网络端口接受指令. 该进程等待期间是不会消耗CPU和带宽的,因此也就不容易通过 `top` 之类的命令发现。
|
||||
|
||||
`lsof` 和 `netstat` 命令都会列出所有的联网进程. 我通常会让他们带上下面这些参数:
|
||||
|
||||
```
|
||||
lsof -i
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
netstat -plunt
|
||||
|
||||
```
|
||||
|
||||
你需要留意那些处于 `LISTEN` 和 `ESTABLISHED` 状态的进程,这些进程要么正在等待连接(LISTEN),要么已经连接(ESTABLISHED)。
|
||||
如果遇到不认识的进程，使用 `strace` 和 `lsof` 来看看它们在做什么东西。
|
||||
|
||||
### 被入侵之后该怎么办呢?
|
||||
|
||||
首先，不要紧张, 尤其当攻击者正处于登陆状态时更不能紧张. 你需要在攻击者警觉到你已经发现他之前夺回机器的控制权。
|
||||
如果他发现你已经发觉到他了，那么他可能会锁死你不让你登陆服务器，然后开始毁尸灭迹。
|
||||
|
||||
如果你技术不太好那么就直接关机吧. 你可以在服务器上运行 `shutdown -h now` 或者 `systemctl poweroff` 这两条命令. 也可以登陆主机提供商的控制面板中关闭服务器。
|
||||
关机后，你就可以开始配置防火墙或者咨询一下供应商的意见。
|
||||
|
||||
如果你对自己颇有自信，而你的主机提供商也有提供上游防火墙，那么你只需要以此创建并启用下面两条规则就行了:
|
||||
|
||||
1. 只允许从你的IP地址登陆SSH
|
||||
|
||||
2. 封禁除此之外的任何东西，不仅仅是SSH，还包括任何端口上的任何协议。
|
||||
|
||||
这样会立即关闭攻击者的SSH会话，而只留下你访问服务器。
|
||||
|
||||
如果你无法访问上游防火墙，那么你就需要在服务器本身创建并启用这些防火墙策略,然后在防火墙规则起效后使用 `kill` 命令关闭攻击者的ssh会话。
|
||||
|
||||
最后还有一种方法, 就是通过诸如串行控制台之类的带外连接登陆服务器，然后通过 `systemctl stop network.service` 停止网络功能。
|
||||
这会关闭所有服务器上的网络连接，这样你就可以慢慢的配置那些防火墙规则了。
|
||||
|
||||
重夺服务器的控制权后，也不要以为就万事大吉了。
|
||||
|
||||
不要试着修复这台服务器，让后接着用. 你永远不知道攻击者做过什么因此你也永远无法保证这台服务器还是安全的。
|
||||
|
||||
最好的方法就是拷贝出所有的资料，然后重装系统。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://bash-prompt.net/guides/server-hacked/
|
||||
|
||||
作者：[Elliot Cooper][a]
|
||||
译者：[lujun9972](https://github.com/lujun9972)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:https://bash-prompt.net
|
||||
Loading…
Reference in New Issue
Block a user