chkrootkit

 


보안툴의 첫번째로 chkrootkit을 설치하고 실행하는 방법을 설명한다.
프로그램은 http://www.chkrootkit.org에서 받을 수 있다.
chkrootkit는 로컬시스템에 루트킷이 설치되어 있는지 단순히 체크만 해주는 기능을 한다
현재 최신 버전은 0.33이다.

[root@ns sec]# tar xvzf chkrootkit.tar.gz
chkrootkit-0.33/
chkrootkit-0.33/COPYRIGHT
chkrootkit-0.33/Makefile
chkrootkit-0.33/README.chklastlog
chkrootkit-0.33/README.chkwtmp
chkrootkit-0.33/chklastlog.c
chkrootkit-0.33/chkproc.c
chkrootkit-0.33/chkrootkit
chkrootkit-0.33/chkrootkit.lsm
chkrootkit-0.33/chkwtmp.c
chkrootkit-0.33/ifpromisc.c
[root@ns sec]# cd chkrootkit-0.33/

chklastlog.c의 다음과 같이 로그위치 부분에 리눅스를 추가한다.
[root@ns chkrootkit-0.33]# vi chklastlog.c

#ifdef __FreeBSD__
#define LASTLOG_FILENAME "/var/log/lastlog"
#endif
#ifdef __OpenBSD__
#define LASTLOG_FILENAME "/var/log/lastlog"
#endif
#ifdef __linux__
#define LASTLOG_FILENAME "/var/log/lastlog"
#endif
#ifndef LASTLOG_FILENAME
#define LASTLOG_FILENAME "/var/adm/lastlog"
#endif

[root@ns chkrootkit-0.33]# make
*** stoping make sense ***
make[1]: Entering directory `/root/sec/chkrootkit-0.33'
gcc -DHAVE_LASTLOG_H   -o chklastlog chklastlog.c
gcc -DHAVE_LASTLOG_H   -o chkwtmp chkwtmp.c
gcc -DHAVE_LASTLOG_H    -o ifpromisc ifpromisc.c
*** ATTENTION chkproc is for Linux systems ONLY ***
*** FAILURES HERE ARE OK IF YOUR SYSTEM IS NOT LINUX ***
gcc  -o chkproc chkproc.c
make[1]: Leaving directory `/root/sec/chkrootkit-0.33'

[root@ns chkrootkit-0.33]# ls -l
total 93
-r--r--r--    1 root     root         1344 May 31 09:00 COPYRIGHT
-r--r--r--    1 root     root         1236 Jun  3 03:16 Makefile
-r--r--r--    1 root     root         1323 May 31 09:00 README.chklastlog
-r--r--r--    1 root     root         1292 May 31 09:00 README.chkwtmp
-rwxr-xr-x    1 root     root         6580 Aug  1 13:25 chklastlog*
-r--r--r--    1 root     root         6533 Aug  1 13:25 chklastlog.c
-rwxr-xr-x    1 root     root         5428 Aug  1 13:17 chkproc*
-r--r--r--    1 root     root         2069 May 31 09:00 chkproc.c
-rwxr--r--    1 netsaint users       44787 Jun  3 13:46 chkrootkit*
-r--r--r--    1 root     root          514 Jun  3 02:34 chkrootkit.lsm
-rwxr-xr-x    1 root     root         4284 Aug  1 13:17 chkwtmp*
-r--r--r--    1 root     root         1945 May 31 09:00 chkwtmp.c
-rwxr-xr-x    1 root     root         4544 Aug  1 13:17 ifpromisc*
-r--r--r--    1 root     root         3356 May 31 09:00 ifpromisc.c

[root@ns chkrootkit-0.33]# ./chkrootkit
ROOTDIR is `/'
Checking `amd'... NOT TESTED
Checking `basename'... Not vulnerable
Checking `biff'... NOT TESTED
Checking `chfn'... Not vulnerable
Checking `chsh'... Not vulnerable
Checking `cron'... Not vulnerable
Checking `date'... Not vulnerable
Checking `du'... Not vulnerable
Checking `dirname'... Not vulnerable
Checking `echo'... Not vulnerable
Checking `egrep'... Not vulnerable
Checking `env'... Not vulnerable
Checking `find'... Not vulnerable
Checking `fingerd'... Not vulnerable
Checking `gpm'... Not vulnerable
Checking `grep'... Not vulnerable
Checking `su'... Not vulnerable
Checking `ifconfig'... Not vulnerable
Checking `inetd'... Not vulnerable
Checking `identd'... NOT TESTED
Checking `killall'... Not vulnerable
Checking `login'... Not vulnerable
Checking `ls'... Not vulnerable
Checking `mail'... Not vulnerable
Checking `mingetty'... Not vulnerable
Checking `netstat'... Not vulnerable
Checking `named'... Not vulnerable
Checking `passwd'... Not vulnerable
Checking `pidof'... Not vulnerable
Checking `pop2'... NOT TESTED
Checking `pop3'... NOT TESTED
Checking `ps'... Not vulnerable
Checking `pstree'... Not vulnerable
Checking `rpcinfo'... Not vulnerable
Checking `rlogind'... NOT TESTED
Checking `rshd'... NOT TESTED
Checking `slogin'... Not vulnerable
Checking `sendmail'... Not vulnerable
Checking `sshd'... Not vulnerable
Checking `syslogd'... Not vulnerable
Checking `tar'... Not vulnerable
Checking `tcpd'... Not vulnerable
Checking `top'... Not vulnerable
Checking `telnetd'... Not vulnerable
Checking `timed'... NOT TESTED
Checking `traceroute'... Not vulnerable
Checking `write'... Not vulnerable
Checking `asp'... Not vulnerable
Checking `bindshell'... Not vulnerable
Checking `z2'... Not Tested: can't exec ./chklastlog
Checking `wted'... Not Tested: can't exec ./chkwtmp
Checking `rexedcs'... Not vulnerable
Checking `sniffer'... Not Tested: can't exec ./ifpromisc
Checking `aliens'... No suspect files
Searching for sniffer's logs, it may take a while... Nothing found
Searching for t0rn's default files and dirs... Nothing found
Searching for t0rn's v8 defaults... Nothing found
Searching for Lion Worm default files and dirs... Nothing found
Searching for RSHA's default files and dir... Nothing found
Searching for RH-Sharpe's default files... Nothing found
Searching for Ambient's rootkit (ark) default files and dirs... Nothing found
Searching for suspicious files and dirs, it may take a while...
/usr/lib/perl5/5.00503/i386-linux/.packlist /usr/lib/perl5/5.00503/i386-linux/auto/File/Spec/.packlist /usr/lib/perl5/5.00503/i386-linux/auto/CPAN/.packlist /usr/lib/perl5/site_perl/5.005/i386-linux/auto/SNMP/.packlist /usr/lib/perl5/site_perl/5.005/i386-linux/auto/Compress/Zlib/.packlist /usr/lib/perl5/site_perl/5.005/i386-linux/auto/Archive/Tar/.packlist /usr/lib/perl5/site_perl/5.005/i386-linux/auto/Term/ReadKey/.packlist /usr/lib/perl5/site_perl/5.005/i386-linux/auto/Term/ReadLine/.packlist /lib/modules/2.2.14/.rhkmvtag

Searching for LPD Worm files and dirs... Nothing found
Searching for Ramen Worm files and dirs... Nothing found
Searching for Maniac files and dirs... Nothing found
Searching for RK17 files and dirs... Nothing found
Searching for Adore Worm... Nothing found
Searching for ShitC Worm... Nothing found
Searching for Omega Worm... Nothing found
Searching for anomalies in shell history files... Warning: `//root/.cpan/build/perl-5.6.1/pod/perlaix.pod
//root/.cpan/build/perl-5.6.1/pod/perlamiga.pod
//root/.cpan/build/perl-5.6.1/pod/perlbs2000.pod
//root/.cpan/build/perl-5.6.1/pod/perlcygwin.pod
//root/.cpan/build/perl-5.6.1/pod/perldos.pod
//root/.cpan/build/perl-5.6.1/pod/perlepoc.pod
//root/.cpan/build/perl-5.6.1/pod/perlhpux.pod
//root/.cpan/build/perl-5.6.1/pod/perlmachten.pod
//root/.cpan/build/perl-5.6.1/pod/perlmacos.pod
//root/.cpan/build/perl-5.6.1/pod/perlmpeix.pod
//root/.cpan/build/perl-5.6.1/pod/perlos2.pod
//root/.cpan/build/perl-5.6.1/pod/perlos390.pod
//root/.cpan/build/perl-5.6.1/pod/perlsolaris.pod
//root/.cpan/build/perl-5.6.1/pod/perlvmesa.pod
//root/.cpan/build/perl-5.6.1/pod/perlvos.pod
//root/.cpan/build/perl-5.6.1/pod/perlwin32.pod
//root/.cpan/build/perl-5.6.1/pod/perlvms.pod
//root/.cpan/build/perl-5.6.1/t/perl
//root/.netscape/lock' is linked to another file
Checking `lkm'... Not Tested: can't exec ./chkproc

This article comes from dbakorea.pe.kr (Leave this line as is)

'서버' 카테고리의 다른 글

chown  (0) 2014.01.01
chmod 폴더만 or 파일만 권한변경  (0) 2014.01.01
CentOS 네트워크 설치  (0) 2014.01.01
CentOS setup ntsysv 설치  (0) 2014.01.01
CentOS 네임서버(Bind) 설치  (0) 2014.01.01
Posted by 주말소프트
,

1. 부팅 CD 만들 이미지 다운로드

http://ftp.daum.net/centos/5.2/

다운로드 : http://ftp.daum.net/centos/5.2/isos/i386/CentOS-5.2-i386-netinstall.iso

2.CD 굽기

3.CD 로 부팅하기

4. linux askmethods 로 부팅

5. 네트워크 설정

6. 다운로드 방식 http

7. http경로 : ftp.daum.net

8. os 경로 : centos/5.2/os/i386/

9. 설치

Posted by 주말소프트
,

yum install setuptool

yum install system-config-network-tui

yum install ntsysv

'서버' 카테고리의 다른 글

chkrootkit (루트킷 점검툴)  (0) 2014.01.01
CentOS 네트워크 설치  (0) 2014.01.01
CentOS 네임서버(Bind) 설치  (0) 2014.01.01
Cannot start session without errors phpMyadmin-오류  (0) 2014.01.01
APM rpm으로 설치시 경로  (0) 2013.12.30
Posted by 주말소프트
,

<!--StartFragment-->1. 네임서버 설치



    1.1 yum을 이용한 bind 인스톨

[root@localhost ~]# yum install -y bind bind-utils bind-libs bind-chroot caching-nameserver
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* addons: centos.tt.co.kr
* base: centos.tt.co.kr
* extras: centos.tt.co.kr
* updates: centos.tt.co.kr
Setting up Install Process
Package 30:bind-utils-9.3.6-4.P1.el5_4.2.x86_64 already installed and latest version
Package 30:bind-libs-9.3.6-4.P1.el5_4.2.x86_64 already installed and latest version
Resolving Dependencies
--> Running transaction check
---> Package bind.x86_64 30:9.3.6-4.P1.el5_4.2 set to be updated
---> Package bind-chroot.x86_64 30:9.3.6-4.P1.el5_4.2 set to be updated
---> Package bind-libs.i386 30:9.3.6-4.P1.el5_4.2 set to be updated
---> Package caching-nameserver.x86_64 30:9.3.6-4.P1.el5_4.2 set to be updated
--> Finished Dependency Resolution

Dependencies Resolved

==========================================================================================
Package                      Arch                   Version                    Repository            Size
==========================================================================================
Installing:
bind                            x86_64      30:9.3.6-4.P1.el5_4.2                base                 986 k
bind-chroot                  x86_64      30:9.3.6-4.P1.el5_4.2                base                  44 k
bind-libs                      i386          30:9.3.6-4.P1.el5_4.2                base                 857 k
caching-nameserver     x86_64       30:9.3.6-4.P1.el5_4.2               base                  61 k

Transaction Summary
==========================================================================================
Install       4 Package(s)
Upgrade       0 Package(s)

Total download size: 1.9 M
Downloading Packages:
(1/4): bind-chroot-9.3.6-4.P1.el5_4.2.x86_64.rpm                                    |  44 kB     00:00    
(2/4): caching-nameserver-9.3.6-4.P1.el5_4.2.x86_64.rpm                       |  61 kB     00:00    
(3/4): bind-libs-9.3.6-4.P1.el5_4.2.i386.rpm                                           | 857 kB     00:00    
(4/4): bind-9.3.6-4.P1.el5_4.2.x86_64.rpm                                              | 986 kB     00:00    
-------------------------------------------------------------------------------------------------------------------------------
Total                                                                                          5.3 MB/s | 1.9 MB     00:00    
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing     : bind-libs                                                                                       1/4
  Installing     : bind                                                                                              2/4
  Installing     : caching-nameserver                                                                       3/4
  Installing     : bind-chroot                                                                                    4/4

Installed:
  bind.x86_64 30:9.3.6-4.P1.el5_4.2                   bind-chroot.x86_64 30:9.3.6-4.P1.el5_4.2
  bind-libs.i386 30:9.3.6-4.P1.el5_4.2                caching-nameserver.x86_64 30:9.3.6-4.P1.el5_4.2

Complete!




    1.2 심볼릭 링크 연결
ln -s /var/named/chroot/etc/named.caching-nameserver.conf



    1.3 named.caching-nameserver.conf 설정 변경
# vi /var/named/chroot/etc/named.caching-nameserver.conf
//
// named.caching-nameserver.conf
//
// Provided by Red Hat caching-nameserver package to configure the
// ISC BIND named(8) DNS server as a caching only nameserver
// (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// DO NOT EDIT THIS FILE - use system-config-bind or an editor
// to create named.conf - edits to this file will be lost on
// caching-nameserver package upgrade.
//
options {
        listen-on port 53 { 127.0.0.1; };
        listen-on port 53 { 111.222.333.444; }; # Add

//      listen-on-v6 port 53 { ::1; };    # Comment
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    query-source    port 53;         # Add
    allow-query     { any; };         # Add

        // Those options should be used carefully because they disable port
        // randomization
        // query-source    port 53;
        // query-source-v6 port 53;


    version "unknown";            # Add
    dnssec-enable yes;            # Add

//      allow-query     { localhost; };    # Comment

};
logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
    category lame-servers { null; };     # Add
    category notify { null; };        # Add
};
view localhost_resolver {
//      match-clients      { localhost; };  # Comment
//      match-destinations { localhost; };  # Comment
        recursion yes;
        include "/etc/named.rfc1912.zones";
};






   1.4 named.rfc1912.zones 설정 변경
# vi /var/named/chroot/etc/named.rfc1912.zones
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
zone "." IN {
        type hint;
        file "named.ca";
};

zone "localdomain" IN {
        type master;
        file "localdomain.zone";
        allow-update { none; };
};

zone "localhost" IN {
        type master;
        file "localhost.zone";
        allow-update { none; };
};

zone "0.0.127.in-addr.arpa" IN {
        type master;
        file "named.local";
        allow-update { none; };
};

zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
        type master;
        file "named.ip6.local";
        allow-update { none; };
};

zone "255.in-addr.arpa" IN {
        type master;
        file "named.broadcast";
        allow-update { none; };
};

zone "0.in-addr.arpa" IN {
        type master;
        file "named.zero";
        allow-update { none; };
};

zone "webpride.net" IN {
        type master;
        file "webpride.net.zone";
        allow-update { none; };
};

zone "tradefree.co.kr" IN {
        type master;
        file "tradefree.co.kr.zone";
        allow-update { none; };
};

zone "luckypark.co.kr" IN {
        type master;
        file "luckypark.co.kr.zone";
        allow-update { none; };
};

AOUCTIONB2B.COM
aouctionb2b.com

1.5 각각의 도메인에 대한 zone 파일 생성
# vi /var/named/chroot/var/named/webpride.net.zone
$TTL    0
@               IN SOA  ns.webpride.net.       webmaster.webpride.net. (
                                1               ; serial
                                3H              ; refresh
                                15M             ; retry
                                1W              ; expire
                                0 )            ; minimum(TTL)

                IN NS           ns.webpride.net.
                IN MX   10      mail.webpride.net.
@               IN A            220.76.204.194
www             IN A            220.76.204.194



# vi /var/named/chroot/var/named/tradefree.co.kr.zone
$TTL    0
@               IN SOA  ns.webpride.net.       webmaster.tradefree.co.kr. (
                                1               ; serial
                                3H              ; refresh
                                15M             ; retry
                                1W              ; expire
                                0 )            ; minimum(TTL)

                IN NS           ns.webpride.net.
                IN MX   10      mail.tradefree.co.kr.
@               IN A            220.76.204.194
www             IN A            220.76.204.194


# vi /var/named/chroot/var/named/luckypark.co.kr.zone
$TTL    0
@               IN SOA  ns.webpride.net.       webmaster.luckypark.co.kr. (
                                1               ; serial
                                3H              ; refresh
                                15M             ; retry
                                1W              ; expire
                                0 )            ; minimum(TTL)

                IN NS           ns.webpride.net.
                IN MX   10      mail.luckypark.co.kr.
@               IN A            220.76.204.194
www             IN A            220.76.204.194



1.6 네임서버 실행
# /etc/rc.d/init.d/named start

'서버' 카테고리의 다른 글

chkrootkit (루트킷 점검툴)  (0) 2014.01.01
CentOS 네트워크 설치  (0) 2014.01.01
CentOS setup ntsysv 설치  (0) 2014.01.01
Cannot start session without errors phpMyadmin-오류  (0) 2014.01.01
APM rpm으로 설치시 경로  (0) 2013.12.30
Posted by 주말소프트
,
phpMyadmin-오류

Cannot start session without errors, please check errors given in your PHP and/or webserver log file and configure your PHP installation properly.

phpinfo에서 session.save_path 를 확인한다.
rpm설치의 경우 session.save_path = "/var/lib/php/session" 로 잡혀있을 수 있다.
session.save_path = "/tmp" 로 변경하거나 session.save_path 의 경로의 퍼미션을 777 로 변경한다.

#service httpd restart

 

'서버' 카테고리의 다른 글

chkrootkit (루트킷 점검툴)  (0) 2014.01.01
CentOS 네트워크 설치  (0) 2014.01.01
CentOS setup ntsysv 설치  (0) 2014.01.01
CentOS 네임서버(Bind) 설치  (0) 2014.01.01
APM rpm으로 설치시 경로  (0) 2013.12.30
Posted by 주말소프트
,

rc.local
/usr/bin/mysqld_safe --user=root &
/usr/sbin/apachectl start

# mysql
/etc/init.d/mysqld start
/usr/bin/mysqladmin -u root password  '********'

mysql 접속
/usr/bin/mysql -p mysql

데이터저장
/var/lib/mysql

# apache
rpm -ql httpd | more
cp /etc/httpd/conf/httpd.conf  /etc/httpd/conf/httpd.back
/usr/sbin/apachectl start

log 저장경로 : /var/log/httpd
rotatelogs 경로 : /usr/sbin/rotatelogs

# php
php.ini 경로 : /etc/php.ini

'서버' 카테고리의 다른 글

chkrootkit (루트킷 점검툴)  (0) 2014.01.01
CentOS 네트워크 설치  (0) 2014.01.01
CentOS setup ntsysv 설치  (0) 2014.01.01
CentOS 네임서버(Bind) 설치  (0) 2014.01.01
Cannot start session without errors phpMyadmin-오류  (0) 2014.01.01
Posted by 주말소프트
,