复制代码代码如下: Checking system commands… Performing ‘strings’ command checks Checking ‘strings’ command [ OK ] Performing ‘shared libraries’ checks Checking for preloading variables[ None found ] Checking for preloaded libraries [ None found ] Checking LD_LIBRARY_PATH variable [ Not found ] Performing file properties checks Checking for prerequisites[ Warning ] /usr/local/bin/rkhunter[ OK ] /sbin/chkconfig [ OK ] ….（略）…. [Press <ENTER> to continue] #下面是第二部分，主要检测常见的rootkit程序，显示“Not found”表示系统未感染此
复制代码代码如下: rootkitChecking for rootkits… Performing check of known rootkit files and directories55808 Trojan – Variant A [ Not found ] ADM Worm [ Not found ] AjaKit Rootkit [ Not found ] Adore Rootkit[ Not found ] aPa Kit [ Not found ] Apache Worm[ Not found ] Ambient （ark） Rootkit[ Not found ] Balaur Rootkit [ Not found ] BeastKit Rootkit [ Not found ] beX2 Rootkit [ Not found ] BOBKit Rootkit[ Not found ] ….（略）…. [Press <ENTER> to continue] #下面是第三部分，主要是一些特殊或附加的检测，例如对rootkit文件或目录检测、对恶意软件检测以及对指定的内核模块检测
复制代码代码如下: Performing additional rootkit checks Suckit Rookit additional checks[ OK ] Checking for possible rootkit files and directories[ None found ] Checking for possible rootkit strings[ None found ] Performing malware checks Checking running processes for suspicious files[ None found ] Checking for login backdoors[ None found ] Checking for suspicious directories [ None found ] Checking for sniffer log files[ None found ] Performing Linux specific checks Checking loaded kernel modules [ OK ] Checking kernel module names [ OK ] [Press <ENTER> to continue] #下面是第四部分，主要对网络、系统端口、系统启动文件、系统用户和组配置、SSH配置、文件系统等进行检测
复制代码代码如下: Checking the network… Performing checks on the network ports Checking for backdoor ports [ None found ] Performing checks on the network interfacesChecking for promiscuous interfaces[ None found ] Checking the local host… Performing system boot checks Checking for local host name [ Found ] Checking for system startup files[ Found ] Checking system startup files for malware[ None found ] Performing group and account checks Checking for passwd file [ Found ] Checking for root equivalent （UID 0） accounts[ None found ] Checking for passwordless accounts [ None found ] ….（略）…. [Press <ENTER> to continue] #下面是第五部分，主要是对应用程序版本进行检测
复制代码代码如下: Checking application versions… Checking version of GnuPG[ OK ] Checking version of OpenSSL[ Warning ] Checking version of OpenSSH[ OK ] #下面是最后一部分，这个部分其实是上面输出的一个总结，通过这个总结，可以大概了解服务器目录的安全状态。
复制代码代码如下: System checks summary ===================== File properties checks… Required commands check failed Files checked: 137 Suspect files: 4 Rootkit checks… Rootkits checked : 311 Possible rootkits: 0 Applications checks… Applications checked: 3 Suspect applications: 1 The system checks took: 6 minutes and 41 seconds 在Linux终端使用rkhunter来检测，最大的好处在于每项的检测结果都有不同的颜色显示，如果是绿色的表示没有问题，如果是红色的，那就要引起关注了。另外，在上面执行检测的过程中，在每个部分检测完成后，需要以Enter键来继续。如果要让程序自动运行，可以执行如下命令： [root@server ~]# /usr/local/bin/rkhunter –check –skip-keypress同时，如果想让检测程序每天定时运行，那么可以在/etc/crontab中加入如下内容： 30 09 * * * root /usr/local/bin/rkhunter –check –cronjob这样，rkhunter检测程序就会在每天的9:30分运行一次。 安全更新： 今天刚刚爆出Bash安全漏洞，SSH bash紧急安全补丁！重要！ 测试是否存在漏洞，执行以下命令： $ env x=’（） { :;}; echo vulnerable’ bash -c “echo this is a test” vulnerable this is a test 如果显示如上，那么，很遗憾，必须立即打上安全补丁修复，临时解决办法为： yum -y update bash 升级bash后，执行测试：
复制代码代码如下: $ env x=’（） { :;}; echo vulnerable’ bash -c “echo this is a test” bash: warning: x: ignoring function definition attemptbash: error importing function definition for `x’ this is a test 如果显示如上，表示已经修补了漏洞。 以上就是Linux后门入侵检测工具以及最新bash漏洞解决方法，谢谢阅读，希望能帮到大家，请继续关注脚本之家，我们会努力分享更多优秀的文章。
易网时代-编程资源站