rootkitChecking for rootkits…
Performing check of known rootkit files and directories55808 Trojan – Variant A [ Not found ]
ADM Worm [ Not found ]
AjaKit Rootkit [ Not found ]
Adore Rootkit [ Not found ]
aPa Kit [ Not found ]
Apache Worm [ Not found ]
Ambient (ark) Rootkit [ Not found ]
Balaur Rootkit [ Not found ]
BeastKit Rootkit [ Not found ]
beX2 Rootkit [ Not found ]
BOBKit Rootkit [ Not found ]
….(略)….
[Press <ENTER> to continue]
Performing additional rootkit checks
Suckit Rookit additional checks [ OK ]
Checking for possible rootkit files and directories [ None found ]
Checking for possible rootkit strings [ None found ]
Performing malware checks
Checking running processes for suspicious files [ None found ]
Checking for login backdoors [ None found ]
Checking for suspicious directories [ None found ]
Checking for sniffer log files [ None found ]
Performing Linux specific checks
Checking loaded kernel modules [ OK ]
Checking kernel module names [ OK ]
[Press <ENTER> to continue]
Checking the network…
Performing checks on the network ports
Checking for backdoor ports [ None found ]
Performing checks on the network interfacesChecking for promiscuous interfaces [ None found ]
Checking the local host…
Performing system boot checks
Checking for local host name [ Found ]
Checking for system startup files [ Found ]
Checking system startup files for malware [ None found ]
Performing group and account checks
Checking for passwd file [ Found ]
Checking for root equivalent (UID 0) accounts [ None found ]
Checking for passwordless accounts [ None found ]
….(略)….
[Press <ENTER> to continue]
#下面是第五部分，主要是对应用程序版本进行检测
代码如下:
Checking application versions…
Checking version of GnuPG[ OK ]
Checking version of OpenSSL [ Warning ]
Checking version of OpenSSH [ OK ]
System checks summary
=====================
File properties checks…
Required commands check failed
Files checked: 137
Suspect files: 4
Rootkit checks…
Rootkits checked : 311
Possible rootkits: 0
Applications checks…
Applications checked: 3
Suspect applications: 1
The system checks took: 6 minutes and 41 seconds
在Linux终端使用rkhunter来检测，最大的好处在于每项的检测结果都有不同的颜色显示，如果是绿色的表示没有问题，如果是红色的，那就要引起关注了。另外，在上面执行检测的过程中，在每个部分检测完成后，需要以Enter键来继续。如果要让程序自动运行，可以执行如下命令：
[root@server ~]# /usr/local/bin/rkhunter –check –skip-keypress同时，如果想让检测程序每天定时运行，那么可以在/etc/crontab中加入如下内容：
30 09 * * * root /usr/local/bin/rkhunter –check –cronjob这样，rkhunter检测程序就会在每天的9:30分运行一次。
安全更新：
今天刚刚爆出Bash安全漏洞，SSH bash紧急安全补丁！重要！
测试是否存在漏洞，执行以下命令：
$ env x=’() { :;}; echo vulnerable’ bash -c “echo this is a test”
vulnerable
this is a test
如果显示如上，那么，很遗憾，必须立即打上安全补丁修复，临时解决办法为：
yum -y update bash
升级bash后，执行测试：
代码如下:
$ env x=’() { :;}; echo vulnerable’ bash -c “echo this is a test”
bash: warning: x: ignoring function definition attemptbash: error importing function definition for `x’
this is a test
服务系统
发布于：2021-10-04 12:25
|
阅读数：217
|
评论：0
QQ好友和群
QQ空间
