建站
咨詢
售后
建站咨詢
新聞中心
Recently, I was informed by MY production administrator that one of my linux systems was subjected to a malicious attack on port 80. By carefully analyzing my system logs, I was able to infer that someone was attempting to gain access to this Linux system and that the attack had been ongoing for some time.
When I first discovered the attack, I took immediate action to protect and secure my system. I verified that the firewall was up-to-date and was properly configured to lock down port 80 on the affected Linux system. Next, I used the following iptables command to drop all traffic coming from sources other than my trusted networks:
iptables -A INPUT -p tcp --dport 80 -s ! xx.xx.xx.xx -j DROP
At this point, I also disabled external access to port 80 on the Linux system by using the following UFW command:
ufw deny 80/tcp
However, I was still concerned that someone may have been able to gain access to the system before I had taken these precautions. To determine if any objects or files had been tampered with, I ran a series of integrity scans using the AIDE tool. The scans uncovered some suspicious behavior, indicating that the attacker may have been attempting to exploit a known vulnerability in the system.
To prevent the attacker from further infiltrating my system, I patched the system with the latest security updates and also performed a malware scan, using an updated and trusted anti-malware program. Additionally, I changed all user credentials to ensure that the attacker would no longer have access to the system.
Finally, to ensure that there are no further attacks, I implemented a comprehensive intrusion detection system (IDS) on the affected Linux system. This will monitor all incoming and outgoing traffic and alert me whenever suspicious activity is detected. Additionally, I have set up regular system scans and vulnerability checks to help me detect any potential security threats in the future.
At this time, my Linux system appears to be safe and secure from any further malicious attacks on port 80. Through my knowledge of the system, swift action, and proper tools, I was able to mitigate and prevent serious damage to the system.
創(chuàng)新互聯服務器托管擁有成都T3+級標準機房資源，具備完善的安防設施、三線及BGP網絡接入帶寬達10T，機柜接入千兆交換機，能夠有效保證服務器托管業(yè)務安全、可靠、穩(wěn)定、高效運行；創(chuàng)新互聯專注于成都服務器托管租用十余年，得到成都等地區(qū)行業(yè)客戶的一致認可。
文章名稱：被攻擊Linux80端口遭受惡意攻擊.（linux80端口）
文章鏈接：http://www.dlmjj.cn/article/cohsoci.html
