Linux服务器被黑以后的详细处理步骤-6ren

Linux服务器被黑以后的详细处理步骤

转载作者：qq735679552 更新时间：2022-09-28 22:32:09

CFSDN坚持开源创造价值，我们致力于搭建一个资源共享平台，让每一个IT人在这里找到属于你的精彩世界.

这篇CFSDN的博客文章Linux服务器被黑以后的详细处理步骤由作者收集整理，如果你对这篇文章有兴趣，记得点赞哟.

随着开源产品的越来越盛行，作为一个Linux运维工程师，能够清晰地鉴别异常机器是否已经被入侵了显得至关重要，个人结合自己的工作经历，整理了几种常见的机器被黑情况供参考。

背景信息：以下情况是在CentOS 6.9的系统中查看的，其它Linux发行版类似。

1.入侵者可能会删除机器的日志信息，可以查看日志信息是否还存在或者是否被清空，相关命令示例:

 
    ? 
   
 
     
       
       
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "98eaf7f7ecd8f0f4f5fbfdf6aea1f6ab" 
         >[email protected]< 
         /a 
         > ~] 
         # ll -h /var/log/* 
        
 
         -rw-------. 1 root root 2.6K Jul 7 18:31  
         /var/log/anaconda 
         .ifcfg.log 
        
 
         -rw-------. 1 root root 23K Jul 7 18:31  
         /var/log/anaconda 
         .log 
        
 
         -rw-------. 1 root root 26K Jul 7 18:31  
         /var/log/anaconda 
         .program.log 
        
 
         -rw-------. 1 root root 63K Jul 7 18:31  
         /var/log/anaconda 
         .storage.log 
        
 
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "493b26263d092125242a2c277f70277a" 
         >[email protected]< 
         /a 
         > ~] 
         # du -sh /var/log/* 
        
 
         8.0K  
         /var/log/anaconda 
        
 
         4.0K  
         /var/log/anaconda 
         .ifcfg.log 
        
 
         24K  
         /var/log/anaconda 
         .log 
        
 
         28K  
         /var/log/anaconda 
         .program.log 
        
 
         64K  
         /var/log/anaconda 
         .storage.log 
        
 
     
 
   

2.入侵者可能创建一个新的存放用户名及密码文件，可以查看/etc/passwd及/etc/shadow文件，相关命令示例:

 
    ? 
   
 
     
       
       
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "80f2efeff4c0e8ecede3e5eeb6b9eeb3" 
         >[email protected]< 
         /a 
         > ~] 
         # ll /etc/pass* 
        
 
         -rw-r--r--. 1 root root 1373 Sep 15 11:36  
         /etc/passwd 
        
 
         -rw-r--r--. 1 root root 1373 Sep 15 11:36  
         /etc/passwd- 
        
 
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "c8baa7a7bc88a0a4a5abada6fef1a6fb" 
         >[email protected]< 
         /a 
         > ~] 
         # ll /etc/sha* 
        
 
         ----------. 1 root root 816 Sep 15 11:36  
         /etc/shadow 
        
 
         ----------. 1 root root 718 Sep 15 11:36  
         /etc/shadow- 
        
 
     
 
   

3.入侵者可能修改用户名及密码文件，可以查看/etc/passwd及/etc/shadow文件内容进行鉴别，相关命令示例:

 
    ? 
   
 
     
       
       
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "9ceef3f3e8dcf4f0f1fff9f2aaa5f2af" 
         >[email protected]< 
         /a 
         > ~] 
         # more /etc/passwd 
        
 
         root:x:0:0:root: 
         /root 
         : 
         /bin/bash 
        
 
         bin:x:1:1:bin: 
         /bin 
         : 
         /sbin/nologin 
        
 
         daemon:x:2:2:daemon: 
         /sbin 
         : 
         /sbin/nologin 
        
 
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "20524f4f5460484c4d43454e16194e13" 
         >[email protected]< 
         /a 
         > ~] 
         # more /etc/shadow 
        
 
         root:*LOCK*:14600:::::: 
        
 
         bin:*:17246:0:99999:7::: 
        
 
         daemon:*:17246:0:99999:7::: 
        
 
     
 
   

4.查看机器最近成功登陆的事件和最后一次不成功的登陆事件，对应日志“/var/log/lastlog”，相关命令示例:

 
    ? 
   
 
     
       
       
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "4e3c21213a0e2622232d2b207877207d" 
         >[email protected]< 
         /a 
         > ~] 
         # lastlog 
        
 
         Username     Port   From       Latest 
        
 
         root                    **Never logged  
         in 
         ** 
        
 
         bin                    **Never logged  
         in 
         ** 
        
 
         daemon                   **Never logged  
         in 
         ** 
        
 
     
 
   

5.查看机器当前登录的全部用户，对应日志文件“/var/run/utmp”，相关命令示例:

 
    ? 
   
 
     
       
       
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "c3b1acacb783abafaea0a6adf5faadf0" 
         >[email protected]< 
         /a 
         > ~] 
         # who 
        
 
         stone  pts 
         /0    
         2017-09-20 16:17 (X.X.X.X) 
        
 
         test01  pts 
         /2    
         2017-09-20 16:47 (X.X.X.X) 
        
 
     
 
   

6.查看机器创建以来登陆过的用户，对应日志文件“/var/log/wtmp”，相关命令示例:

 
    ? 
   
 
     
       
       
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "ec9e838398ac8480818f8982dad582df" 
         >[email protected]< 
         /a 
         > ~] 
         # last 
        
 
         test01  pts 
         /1    
         X.X.X.X  Wed Sep 20 16:50  still logged  
         in 
        
 
         test01  pts 
         /2    
         X.X.X.X  Wed Sep 20 16:47 - 16:49 (00:02)   
        
 
         stone  pts 
         /1    
         X.X.X.X  Wed Sep 20 16:46 - 16:47 (00:01)   
        
 
         stone  pts 
         /0    
         X.X.X.X  Wed Sep 20 16:17  still logged  
         in 
        
 
     
 
   

7.查看机器所有用户的连接时间（小时），对应日志文件“/var/log/wtmp”，相关命令示例:

 
    ? 
   
 
     
       
       
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "03716c6c77436b6f6e60666d353a6d30" 
         >[email protected]< 
         /a 
         > ~] 
         # ac -dp 
        
 
               
         stone                11.98 
        
 
         Sep 15   total    11.98 
        
 
               
         stone                67.06 
        
 
         Sep 18   total    67.06 
        
 
               
         stone                1.27 
        
 
               
         test01                0.24 
        
 
         Today    total    1.50 
        
 
     
 
   

8.如果发现机器产生了异常流量，可以使用命令“tcpdump”抓取网络包查看流量情况或者使用工具”iperf”查看流量情况。

9.可以查看/var/log/secure日志文件，尝试发现入侵者的信息，相关命令示例:

 
    ? 
   
 
     
       
       
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "82f0ededf6c2eaeeefe1e7ecb4bbecb1" 
         >[email protected]< 
         /a 
         > ~] 
         # cat /var/log/secure | grep -i "accepted password" 
        
 
         Sep 20 12:47:20 hlmcen69n3 sshd[37193]: Accepted password  
         for 
         stone from X.X.X.X port 15898 ssh2 
        
 
         Sep 20 16:17:47 hlmcen69n3 sshd[38206]: Accepted password  
         for 
         stone from X.X.X.X port 9140 ssh2 
        
 
         Sep 20 16:46:00 hlmcen69n3 sshd[38511]: Accepted password  
         for 
         stone from X.X.X.X port 2540 ssh2 
        
 
         Sep 20 16:47:16 hlmcen69n3 sshd[38605]: Accepted password  
         for 
         test01 from X.X.X.X port 10790 ssh2 
        
 
         Sep 20 16:50:04 hlmcen69n3 sshd[38652]: Accepted password  
         for 
         test01 from X.X.X.X port 28956 ssh2 
        
 
     
 
   

10.查询异常进程所对应的执行脚本文件。

a.top命令查看异常进程对应的PID 。

b.在虚拟文件系统目录查找该进程的可执行文件。

 
    ? 
   
 
     
       
       
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "285a47475c684044454b4d461e11461b" 
         >[email protected]< 
         /a 
         > ~] 
         # ll /proc/1850/ | grep -i exe 
        
 
         lrwxrwxrwx. 1 root root 0 Sep 15 12:31 exe ->  
         /usr/bin/python 
        
 
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "1d6f7272695d7571707e78732b24732e" 
         >[email protected]< 
         /a 
         > ~] 
         # ll /usr/bin/python 
        
 
         -rwxr-xr-x. 2 root root 9032 Aug 18 2016  
         /usr/bin/python 
        
 
     
 
   

11.如果确认机器已经被入侵，重要文件已经被删除，可以尝试找回被删除的文件。

Note:

1>当进程打开了某个文件时，只要该进程保持打开该文件，即使将其删除，它依然存在于磁盘中。这意味着，进程并不知道文件已经被删除，它仍然可以向打开该文件时提供给它的文件描述符进行读取和写入。除了该进程之外，这个文件是不可见的，因为已经删除了其相应的目录索引节点.

2>在/proc 目录下，其中包含了反映内核和进程树的各种文件。/proc目录挂载的是在内存中所映射的一块区域，所以这些文件和目录并不存在于磁盘中，因此当我们对这些文件进行读取和写入时，实际上是在从内存中获取相关信息。大多数与 lsof 相关的信息都存储于以进程的 PID 命名的目录中，即 /proc/1234 中包含的是 PID 为 1234 的进程的信息。每个进程目录中存在着各种文件，它们可以使得应用程序简单地了解进程的内存空间、文件描述符列表、指向磁盘上的文件的符号链接和其他系统信息。lsof 程序使用该信息和其他关于内核内部状态的信息来产生其输出。所以lsof 可以显示进程的文件描述符和相关的文件名等信息。也就是我们通过访问进程的文件描述符可以找到该文件的相关信息.

3>当系统中的某个文件被意外地删除了，只要这个时候系统中还有进程正在访问该文件，那么我们就可以通过lsof从/proc目录下恢复该文件的内容.

假设入侵者将/var/log/secure文件删除掉了，尝试将/var/log/secure文件恢复的方法可以参考如下:

a.查看/var/log/secure文件，发现已经没有该文件。

 
    ? 
   
 
     
       
       
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "20524f4f5460484c4d43454e16194e13" 
         >[email protected]< 
         /a 
         > ~] 
         # ll /var/log/secure 
        
 
         ls 
         : cannot access  
         /var/log/secure 
         : No such  
         file 
         or directory 
        
 
     
 
   

b.使用lsof命令查看当前是否有进程打开/var/log/secure，。

 
    ? 
   
 
     
       
       
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "deacb1b1aa9eb6b2b3bdbbb0e8e7b0ed" 
         >[email protected]< 
         /a 
         > ~] 
         # lsof | grep /var/log/secure 
        
 
         rsyslogd  1264   root  4w   REG        8,1 3173904   263917  
         /var/log/secure 
         (deleted) 
        
 
     
 
   

c.从上面的信息可以看到 PID 1264（rsyslogd）打开文件的文件描述符为4。同时还可以看到/var/log/ secure已经标记为被删除了。因此我们可以在/proc/1264/fd/4（fd下的每个以数字命名的文件表示进程对应的文件描述符）中查看相应的信息，如下:

 
    ? 
   
 
     
       
       
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "9deff2f2e9ddf5f1f0fef8f3aba4f3ae" 
         >[email protected]< 
         /a 
         > ~] 
         # tail /proc/1264/fd/4 
        
 
         Sep 20 16:47:21 hlmcen69n3 sshd[38511]: pam_unix(sshd:session): session closed  
         for 
         user stone 
        
 
         Sep 20 16:47:21 hlmcen69n3  
         su 
         : pam_unix( 
         su 
         -l:session): session closed  
         for 
         user root 
        
 
         Sep 20 16:49:30 hlmcen69n3 sshd[38605]: pam_unix(sshd:session): session closed  
         for 
         user test01 
        
 
         Sep 20 16:50:04 hlmcen69n3 sshd[38652]: reverse mapping checking getaddrinfo  
         for 
         190.78.120.106.static.bjtelecom.net [106.120.78.190] failed - POSSIBLE BREAK-IN ATTEMPT! 
        
 
         Sep 20 16:50:04 hlmcen69n3 sshd[38652]: Accepted password  
         for 
         test01 from 106.120.78.190 port 28956 ssh2 
        
 
         Sep 20 16:50:05 hlmcen69n3 sshd[38652]: pam_unix(sshd:session): session opened  
         for 
         user test01 by (uid=0) 
        
 
         Sep 20 17:18:51 hlmcen69n3 unix_chkpwd[38793]: password check failed  
         for 
         user (root) 
        
 
         Sep 20 17:18:51 hlmcen69n3 sshd[38789]: pam_unix(sshd:auth): authentication failure;  
         logname 
         = uid=0 euid=0  
         tty 
         = 
         ssh 
         ruser= rhost=51.15.81.90 user=root 
        
 
         Sep 20 17:18:52 hlmcen69n3 sshd[38789]: Failed password  
         for 
         root from 51.15.81.90 port 47014 ssh2 
        
 
         Sep 20 17:18:52 hlmcen69n3 sshd[38790]: Connection closed by 51.15.81.90 
        
 
     
 
   

d.从上面的信息可以看出，查看/proc/1264/fd/4就可以得到所要恢复的数据。如果可以通过文件描述符查看相应的数据，那么就可以使用I/O重定向将其重定向到文件中，如

 
    ? 
   
 
     
       
       
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "8bf9e4e4ffcbe3e7e6e8eee5bdb2e5b8" 
         >[email protected]< 
         /a 
         > ~] 
         # cat /proc/1264/fd/4 > /var/log/secure 
        
 
     
 
   

e.再次查看/var/log/secure，发现该文件已经存在。对于许多应用程序，尤其是日志文件和数据库，这种恢复删除文件的方法非常有用.

 
    ? 
   
 
     
       
       
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "63110c0c17230b0f0e00060d555a0d50" 
         >[email protected]< 
         /a 
         > ~] 
         # ll /var/log/secure 
        
 
         -rw-r--r--. 1 root root 3173904 Sep 20 17:24  
         /var/log/secure 
        
 
         [<a href= 
         "/cdn-cgi/l/email-protection" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         rel= 
         "external nofollow" 
         data-cfemail= 
         "ec9e838398ac8480818f8982dad582df" 
         >[email protected]< 
         /a 
         > ~] 
         # head /var/log/secure 
        
 
         Sep 17 03:28:15 hlmcen69n3 sshd[13288]: reverse mapping checking getaddrinfo  
         for 
         137-64-15-51.rev.cloud.scaleway.com [51.15.64.137] failed - POSSIBLE BREAK-IN ATTEMPT! 
        
 
         Sep 17 03:28:15 hlmcen69n3 unix_chkpwd[13290]: password check failed  
         for 
         user (root) 
        
 
         Sep 17 03:28:15 hlmcen69n3 sshd[13288]: pam_unix(sshd:auth): authentication failure;  
         logname 
         = uid=0 euid=0  
         tty 
         = 
         ssh 
         ruser= rhost=51.15.64.137 user=root 
        
 
         Sep 17 03:28:17 hlmcen69n3 sshd[13288]: Failed password  
         for 
         root from 51.15.64.137 port 59498 ssh2 
        
 
         Sep 17 03:28:18 hlmcen69n3 sshd[13289]: Received disconnect from 51.15.64.137: 11: Bye Bye 
        
 
         Sep 17 03:28:22 hlmcen69n3 sshd[13291]: reverse mapping checking getaddrinfo  
         for 
         137-64-15-51.rev.cloud.scaleway.com [51.15.64.137] failed - POSSIBLE BREAK-IN ATTEMPT! 
        
 
         Sep 17 03:28:22 hlmcen69n3 unix_chkpwd[13293]: password check failed  
         for 
         user (root) 
        
 
         Sep 17 03:28:22 hlmcen69n3 sshd[13291]: pam_unix(sshd:auth): authentication failure;  
         logname 
         = uid=0 euid=0  
         tty 
         = 
         ssh 
         ruser= rhost=51.15.64.137 user=root 
        
 
         Sep 17 03:28:24 hlmcen69n3 sshd[13291]: Failed password  
         for 
         root from 51.15.64.137 port 37722 ssh2 
        
 
         Sep 17 03:28:25 hlmcen69n3 sshd[13292]: Received disconnect from 51.15.64.137: 11: Bye Bye 
        
 
     
 
   

总结。

以上所述是小编给大家介绍的Linux服务器被黑以后的详细处理步骤，希望对大家有所帮助，如果大家有任何疑问请给我留言，小编会及时回复大家的。在此也非常感谢大家对我网站的支持！。

原文链接：http://www.techug.com/post/after-linux-server-hacked.html?utm_source=tuicool&utm_medium=referral 。

最后此篇关于Linux服务器被黑以后的详细处理步骤的文章就讲到这里了,如果你想了解更多关于Linux服务器被黑以后的详细处理步骤的内容请搜索CFSDN的文章或继续浏览相关文章，希望大家以后支持我的博客！。

文章推荐： 10 个超级有趣的 Linux 终端游戏分享

文章推荐： Linux中利用sudo进行赋权的方法详解

文章推荐：浅谈Linux的编码及编码转换方法

文章推荐： Linux利用Sysctl命令调整内核参数

linux - 远程文本编辑 : Linux to Linux
关闭。这个问题不符合Stack Overflow guidelines .它目前不接受答案。要求我们推荐或查找工具、库或最喜欢的场外资源的问题对于 Stack Overflow 来说是偏离主题的，
linux - Linux 管道缓冲区有多少数据？ linux 管道缓冲区大小可以配置吗？
Linux 管道可以缓冲多少数据？这是可配置的吗？如果管道的两端在同一个进程中，但线程不同，这会有什么不同吗？请注意:这个“同一个进程，两个线程”的问题是理论上的边栏，真正的问题是关于缓冲的。最
linux - 用 Linux 启动 Linux？
我找到了here [最后一页] 一种有趣的通过 Linux 启动 Linux 的方法。不幸的是，它只是被提及，我在网上找不到任何有用的链接。那么有人听说过一种避免引导加载程序而使用 Linux 的方法
linux - linux 内核、linux 设备驱动程序或模块编写器程序员是否需要算法分析？
很难说出这里要问什么。这个问题模棱两可、含糊不清、不完整、过于宽泛或夸夸其谈，无法以目前的形式得到合理的回答。如需帮助澄清此问题以便重新打开，visit the help center . 关闭 1
linux - Linux ld-linux.so 的版本化符号
我试图了解 ld-linux.so 如何在 Linux 上解析对版本化符号的引用。我有以下文件: 测试.c: void f(); int main() { f(); } a.c 和 b.c:
linux - Linux 桌面应用程序可以用作 Linux 桌面吗？
与 RetroPie 的工作原理类似，我可以使用 Linux 应用程序作为我的桌面环境吗？我实际上并不需要像实际桌面和安装应用程序这样的东西。我只需要一种干净简单的方法来在 RaspberryPi 上
linux - linux 上用户和 linux 系统范围内的打开文件数是多少？
关闭。这个问题不符合Stack Overflow guidelines .它目前不接受答案。这个问题似乎不是关于 a specific programming problem, a softwar
linux - 亚马逊 Linux 与红帽 Linux
关闭。这个问题是off-topic .它目前不接受答案。想改进这个问题吗？ Update the question所以它是on-topic用于堆栈溢出。关闭 10 年前。 Improve thi
linux - 在 Linux (Linux mint) 中创建您自己的定制应用程序软件中心的最佳方法是什么？
有什么方法可以覆盖现有的源代码，我应该用 PyQt、PyGTK、Java 等从头开始构建吗？最佳答案如果您指的是软件本身而不是它所连接的存储库，那么自定义应用程序的方法就是 fork 项目。据我所
linux - 如何通过一个磁盘中的另一个 linux 系统更新一个 linux 系统？
我的情况是:我在一个磁盘上安装了两个 linux。我将第一个安装在/dev/sda1 中，然后在/dev/sda2 中安装第二个然后我运行第一个系统，我写了一个脚本来在第一个系统运行时更新它。
linux - 如何让 linux 驱动程序在 linux 内核加载后检测和使用设备？
我在 i2c-0 总线上使用地址为 0x3f 的系统监视器设备。该设备在设备树中配置有 pmbus 驱动程序。问题是，加载 linux 内核时，这个“Sysmon”设备没有供电。因此，当我在总线 0
linux - 在旧 Linux 版本中构建的应用程序可以在最新 Linux 中运行吗？
关闭。这个问题是off-topic .它目前不接受答案。想改进这个问题吗？ Update the question所以它是on-topic用于堆栈溢出。关闭 11 年前。 Improve thi
linux - 将 linux 内核中的函数导出到 linux 模块
我正试图在 linux 模块中分配一大块内存，而 kalloc 做不到。我知道唯一的方法是使用 alloc_bootmem(unsigned long size) 但我只能从 linux 内核而不是
linux - 我如何连接到一个简单的 linux 控制台来执行一些任何人都可以使用 linux 操作系统的基本命令？
关闭。这个问题不符合Stack Overflow guidelines .它目前不接受答案。这个问题似乎不是关于 a specific programming problem, a softwar
linux - "pwd"命令适用于所有 linux 类型的 linux？
我有 .sh 文件来运行应用程序。在该文件中，我想动态设置服务器名称，而不是每次都配置。我尝试了以下方法，它在 CentOS 中运行良好。 nohup /voip/java/jdk1.8.0_71/
linux - 将 Linux 应用程序复制到另一个 Linux 操作系统
我是在 Linux 上开发嵌入式 C++ 程序的新手。我有我的 Debian 操作系统，我在其中开发和编译了我的 C++ 项目(一个简单的控制台进程)。我想将我的应用程序放到另一个 Debian 操
linux - 如何从 Linux 向 Linux 机器发送数据或文件？
关闭。这个问题需要多问focused 。目前不接受答案。想要改进此问题吗？更新问题，使其仅关注一个问题 editing this post . 已关闭 4 年前。 Improve this ques
linux - 在 Linux 内核源代码树中哪里可以找到 Linux Logo ？
我使用4.19.78版本的稳定内核，我想找到带有企鹅二进制数据的C数组。系统启动时显示。我需要在哪里搜索该内容？我在 include/linux/linux_logo.h 文件中只找到了一些 Log
linux - 是否可以从非 linux 系统远程调试 linux 代码？
我知道可以使用 gdb 的服务器模式远程调试代码，我知道可以调试针对另一种架构交叉编译的代码，但是是否可以更进一步，从远程调试 Linux 应用程序OS X 使用 gdbserver？最佳答案当然
linux - 从一个 linux 到另一个 linux 的二进制文件
是否有任何可能的方法来运行在另一个 Linux 上编译的二进制文件？我知道当然最简单的是在另一台机器上重建它，但假设我们唯一能得到的是一个二进制文件，那么这可能与否？ (我知道这可能并不容易，但我只是

qq735679552

个人简介

我是一名优秀的程序员,十分优秀！

作者热门文章

滴滴打车优惠券免费领取

全站热门文章

首页

博学

6Ren·AI

商城

Linux服务器被黑以后的详细处理步骤