系统维护总集

系统维护总集

AIX系统

1. 9090端口信息泄露

描述

通过telnet x.x.x.x 9090的方式会获取一些系统信息，不利于系统安全。信息如下：

+ find /var/websm/data/wservers/ -type f -print -name [0-9]*[0-9]
+ 2> /dev/null
+ head -1
+ read portFile
+ + basename
+ 2> /dev/null
pid=
+ portFileInUse=.in_use
+ mv .in_use
+ 2> /dev/null
+ renice -n -15
+ 1> /dev/null 2>& 1
+ true
+ grep -sq -E useWaitingServer=t|useWaitingServer=T /var/websm/config/user_settings/websm.cfg
+ grep -sq WServer
+ ps -o args -p
+ 2> /dev/null
+ ((  1 == 0  ))
+ rm -fr .in_use
+ startNewWServer
Language received from client: C
Setlocale: C C C C C C
WServer.HANDSHAKING 4097 WServer.HANDSHAKING

处理

1. 获取使用9090端口的服务；
   # netstat -Aan|grep 9090

f1000e00033ff3b8 tcp4       0      0  *.9090                *.*                   LISTEN

# rmsock f1000e00033ff3b8 tcpcb

The socket 0xf1000e00033ff008 is being held by proccess  3932286 (inetd).

可以获取到使用该端口的是进程号3932286的inetd服务。
查看服务，可以看到inetd的子进程有两个，导致信息泄露的是其中的wsmserver服务。因此需要关闭该服务
# ps -ef |grep 3932286

    root  3932286  5177546   0   May 23      -  0:36 /usr/sbin/inetd
    root 19464196  3932286   0   Jul 06      -  0:00 cmsd 100068 2-5
    root 23986330  3932286   0 16:01:45      -  0:00 /bin/ksh /usr/websm/bin/wsmserver -start 
    root 31522972 19660930   0 16:02:19  pts/1  0:00 grep 3932286

2. 手动关闭wsmserver服务
   # /usr/websm/bin/wsmserver -disable
3. 编辑inetd.conf文件，使该服务重启后不自动启动。
   # vi /etc/inetd.conf

ftp     stream  tcp6    nowait  root    /usr/sbin/ftpd         ftpd

#telnet  stream  tcp6    nowait  root    /usr/sbin/telnetd      telnetd -a

shell   stream  tcp6    nowait  root    /usr/sbin/rshd         rshd

#kshell  stream  tcp     nowait  root    /usr/sbin/krshd        krshd

#login   stream  tcp6    nowait  root    /usr/sbin/rlogind      rlogind

#klogin  stream  tcp     nowait  root    /usr/sbin/krlogind     krlogind

#exec    stream  tcp6    nowait  root    /usr/sbin/rexecd       rexecd

#comsat dgram   udp     wait    root    /usr/sbin/comsat       comsat

#uucp   stream  tcp     nowait  root    /usr/sbin/uucpd        uucpd

#bootps dgram   udp     wait    root    /usr/sbin/bootpd       bootpd /etc/bootptab

##

## Finger, systat and netstat give out user information which may be

## valuable to potential "system crackers."  Many sites choose to disable

## some or all of these services to improve security.

##

#finger stream  tcp     nowait  nobody  /usr/sbin/fingerd     fingerd

#systat stream  tcp     nowait  nobody  /usr/bin/ps           ps -ef

#netstat stream tcp     nowait  nobody  /usr/bin/netstat      netstat -f inet

#

#tftp    dgram  udp6    SRC     nobody  /usr/sbin/tftpd         tftpd -n

#talk   dgram   udp     wait    root    /usr/sbin/talkd         talkd

ntalk   dgram   udp     wait    root    /usr/sbin/talkd         talkd

#

# rexd uses very minimal authentication and many sites choose to disable

# this service to improve security.

#

#rquotad  sunrpc_udp     udp     wait    root    /usr/sbin/rpc.rquotad rquotad 100011 1

#rexd    sunrpc_tcp     tcp     wait    root    /usr/sbin/rpc.rexd rexd 100017 1

#rstatd  sunrpc_udp     udp     wait    root    /usr/sbin/rpc.rstatd rstatd 100001 1-3

#rusersd sunrpc_udp     udp     wait    root    /usr/lib/netsvc/rusers/rpc.rusersd rusersd 100002 1-2

#rwalld  sunrpc_udp     udp     wait    root    /usr/lib/netsvc/rwall/rpc.rwalld rwalld 100008 1

#sprayd  sunrpc_udp     udp     wait    root    /usr/lib/netsvc/spray/rpc.sprayd sprayd 100012 1

#pcnfsd  sunrpc_udp     udp     wait    root    /usr/sbin/rpc.pcnfsd pcnfsd 150001 1-2

#echo   stream  tcp     nowait  root    internal

#discard        stream  tcp     nowait  root    internal

#chargen        stream  tcp     nowait  root    internal

daytime stream  tcp     nowait  root    internal

time    stream  tcp     nowait  root    internal

#echo   dgram   udp     wait    root    internal

#discard        dgram   udp     wait    root    internal

#chargen        dgram   udp     wait    root    internal

daytime dgram   udp     wait    root    internal

time    dgram   udp     wait    root    internal

## The following line is for installing over the network.

#instsrv stream tcp     nowait  netinst /u/netinst/bin/instsrv instsrv -r /tmp/netinstalllog /u/netinst/scripts

#imap2  stream  tcp     nowait  root    /usr/sbin/imapd imapd

#pop3   stream  tcp     nowait  root    /usr/sbin/pop3d pop3d

caa_cfg stream  tcp6    nowait  root    /usr/sbin/clusterconf clusterconf >>/var/adm/ras/clusterconf.log 2>&1

dtspcd  stream  tcp     nowait  root    /usr/dt/bin/dtspcd /usr/dt/bin/dtspcd

cmsd    sunrpc_udp      udp     wait    root    /usr/dt/bin/rpc.cmsd cmsd 100068 2-5

#ttdbserver     sunrpc_tcp      tcp     wait    root    /usr/dt/bin/rpc.ttdbserver rpc.ttdbserver 100083 1

 #wsmserver      stream  tcp     nowait  root    /usr/websm/bin/wsmserver wsmserver -start  

xmquery dgram   udp6    wait    root    /usr/bin/xmtopas xmtopas -p3

Linux系统

1. passwd命令没有反应

描述

在登入系统后，输入passwd命令没有响应

[root@bea02 ~]# passwd
[root@bea02 root]#

处理

经查该现象是由于没有关闭selinux造成的。可以临时关闭或者永久关闭selinux。
临时关闭

[root@bea02]#setenforce 0          #临时关闭selinux
setenforce: SELinux is disabled
[root@bea02]#passwd
Changing password for user root.
New UNIX password:

永久关闭，修改/etc/sysconfig/selinux文件，将SELINUX=enforcing修改为SELINUX=disabled。

# more selinux
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#	enforcing - SELinux security policy is enforced.
#	permissive - SELinux prints warnings instead of enforcing.
#	disabled - SELinux is fully disabled.
SELINUX=enforcing     #将其修改为disabled
# SELINUXTYPE= type of policy in use. Possible values are:
#	targeted - Only targeted network daemons are protected.
#	strict - Full SELinux protection.
SELINUXTYPE=targeted