Linux Engineer Study Notes 13: common system security analysis tools

Scanner nmap (FC5 is not installed by default), rpm package in the first five plate
# nmap 192.168.0.22 default TCP port scan
# nmap-sU-sR-sS 192.168.0.22
-sU UDP scan
-sR RPC scan
-sS TCP SYN scan
Can scan a single host or IP segment 192.168.0.0/24
# grep syslog / etc / services file contains the search string syslog line, the search string in the document.

Tcpdump sniffer
# tcpdump-i eth0-X dst 192.168.0.22
specify-i eth0 interface monitor
-X in order to show the header information in hexadecimal
dst specify the target host address or port
# tcpdump-I eth0-X dst 192.168.0.22 and dst port 21
Monitor target packet to 192.168.0.22 port 21 and the data

Log syslog server
Configuration file / etc / syslog.conf
The right side of the left side of the specified message type specified location information records
*. info; mail.none; authpriv.none; cron.none / var / log / messages
Any program, as long as it is more than info level recorded in the / var / log / messages, but does not record mail, authpriv, cron news
mail .* / var / log / maillog
E-mail messages are all recorded in / var / log / maillog file
Any change in the configuration file required to start services from the new
# service syslog restart
# vi / etc / syslog.conf
*.* @ 192.168.0.22
All procedures 192.168.0.22 all messages sent to the host, but at the same time allow remote 192.168.0.22 to open source
# vi / etc / sysconfig / syslog to amend
SYSLOGD_OPTIONS = "-m 0-r-x"
# service syslog restart
Log default service port 514/udp
# netstat-unl | grep: 514 show the log service is running
-u UDP protocol
-t TCP protocol
-n with values that the host address, port number
-l Display only monitor the process of being
-p show the process name and PID

Log system
1. Edit / etc / syslog.conf
2. Restart Log Server
# service syslog restart
3. To check the log / var / log / *
Safety information on the / var / log / secure in
E-mail messages on / var / log / maillog
Plan task information / var / log / cron
Most of the information on the / var / log / messages
# tail-f messages of the changes in information monitoring system
Recommended Log analysis software SWATCH