질문&답변
클라우드/리눅스에 관한 질문과 답변을 주고 받는 곳입니다.
리눅스 분류

점검 부분확인 부탁드립니다.

작성자 정보

  • 사루쭌 작성
  • 작성일

컨텐츠 정보

본문

안녕하십니까?
시스템 초짜입니다.

현재 서버에 해킹의심이 들고 있는데 이것저것 확인은 했는데
어떤식으로 해결해야 될지 몰라 문의 드립니다.

-증상-
1.종종 syslog가 restart 되어있음
2.해외쪽에서의 접근시도가 많음
3. rkhunter정보

[17:09:44] Warning: Checking for prerequisites               [ Warning ]
[17:09:44]          The file of stored file properties (rkhunter.dat) does not exist, and should be created. To do this type in 'rkhunter --prop

[17:11:23]   /sbin/ifdown                                    [ Warning ]
[17:11:24] Warning: The command '/sbin/ifdown' has been replaced by a script: /sbin/ifdown: Bourne-Again shell script text executable

[17:11:26]   /sbin/ifup                                      [ Warning ]
[17:11:31] Warning: The command '/sbin/ifup' has been replaced by a script: /sbin/ifup: Bourne-Again shell script text executable

[17:17:58]   /usr/bin/GET                                    [ Warning ]
[17:17:59] Warning: The command '/usr/bin/GET' has been replaced by a script: /usr/bin/GET: perl script text executable

[17:18:01]   /usr/bin/groups                                 [ Warning ]
[17:18:02] Warning: The command '/usr/bin/groups' has been replaced by a script: /usr/bin/groups: Bourne shell script text executable

17:18:26]   /usr/bin/ldd                                    [ Warning ]
[17:18:27] Warning: The command '/usr/bin/ldd' has been replaced by a script: /usr/bin/ldd: Bourne shell script text executable

[17:20:41]   /usr/bin/whatis                                 [ Warning ]
[17:20:43] Warning: The command '/usr/bin/whatis' has been replaced by a script: /usr/bin/whatis: Bourne shell script text executable

[18:27:52]   Checking if SSH root access is allowed          [ Warning ]
[18:27:54] Warning: The SSH configuration option 'PermitRootLogin' has not been set.
           The default value may be 'yes', to allow root access.
[18:27:58]   Checking if SSH protocol v1 is allowed          [ Warning ]

[18:31:58]   Checking version of GnuPG                       [ Warning ]
[18:31:59] Warning: Application 'gpg', version '1.2.6', is out of date, and possibly a security risk

[18:32:02]   Checking version of OpenSSL                     [ Warning ]
[18:32:03] Warning: Application 'openssl', version '0.9.7a', is out of date, and possibly a security risk.

[18:32:09]   Checking version of OpenSSH                     [ Warning ]
[18:32:12] Warning: Application 'sshd', version '3.9p1', is out of date, and possibly a security risk.

[18:32:14] System checks summary
[18:32:14] =====================
[18:32:14]
[18:32:14] File properties checks...
[18:32:16] Required commands check failed
[18:32:16] Files checked: 138
[18:32:20] Suspect files: 6
[18:32:25]
[18:32:25] Rootkit checks...
[18:32:26] Rootkits checked : 390
[18:32:27] Possible rootkits: 0
[18:32:27]
[18:32:27] Applications checks...
[18:32:29] Applications checked: 4
[18:32:29] Suspect applications: 3
[18:32:30]
[18:32:30] The system checks took: 86 minutes and 59 seconds

고수님들 확인 부탁드립니다.

감사합니다.


관련자료

댓글 1

dslee님의 댓글

  • dslee
  • 작성일
secure 로그 및 xferlog , access_log 등을 살펴보신후, 특정 IP 에서 접근이 많다면,
해당 IP 유입경로 확인하신후에 해당 ip 차단 을 하는방법도 있겠네요.

해외에서 접근 시도가 많으시다면, 방화벽에서 국내만 접근가능하도록 설정하시면 됩니다.
서버가 복구 불가능한 상태가 되셨으면, os 재설치 방법을 시도해봐야겠네요.

공지사항


뉴스광장


  • 현재 회원수 :  60,138 명
  • 현재 강좌수 :  36,196 개
  • 현재 접속자 :  519 명