https://anTtutu.github.io/tags/%E6%9C%A8%E9%A9%AC/ Recent content in 木马 on Anttu's Blog Hugo zh-CN Sat, 05 Mar 2022 08:00:00 +0800 https://anTtutu.github.io/post/2022-03-05-linux-trojan-check/ Sat, 05 Mar 2022 08:00:00 +0800 https://anTtutu.github.io/post/2022-03-05-linux-trojan-check/ <h2 id="前言">前言</h2> <p>在日常繁琐的运维工作中，对 linux 服务器进行安全检查是一个非常重要的环节。这篇整理如何检查 linux 系统是否遭受了入侵，以及几次真实的入侵处置过程。与<a href="https://anTtutu.github.io/post/2026-09-27-linux-emergency-response/">应急响应手册</a>配合食用更佳。</p> <h2 id="一是否入侵检查排查清单">一、是否入侵检查（排查清单）</h2> <p><strong>1）检查系统日志</strong></p> <div class="highlight"><div style="background-color:#f7f7f7;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"> <table style="border-spacing:0;padding:0;margin:0;border:0;"><tr><td style="vertical-align:top;padding:0;margin:0;border:0;"> <pre tabindex="0" style="background-color:#f7f7f7;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">1 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">2 </span></code></pre></td> <td style="vertical-align:top;padding:0;margin:0;border:0;;width:100%"> <pre tabindex="0" style="background-color:#f7f7f7;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#57606a"># 检查系统错误登录日志，统计IP重试次数（last 查看系统登录日志，比如系统被 reboot 或登录情况）</span> </span></span><span style="display:flex;"><span>last </span></span></code></pre></td></tr></table> </div> </div><p><strong>2）检查系统用户</strong></p>