Shulou(Shulou.com)06/01 Report--

Through this study, I found that I was too fast to pursue the effect, and some details were not grasped.

He consulted the train of thought of a teacher on the black cloud. Thank you very much.

ssh -T root@ target IP /bin/sh -i

ssh parameters

-T Allocation of dummy terminals is prohibited.

Command:

ssh -T root@192.168.0.105-issh -T root@192.168.0.105/bin/bash-i After logging in to 192.168.0.105. No matter w or who, the logged in end could not see the login. Below is the top picture.

In fact, logins can be audited by other methods, but we also have ways to avoid being logged, so personal feelings, protect our devices, cut off from transmission or use firewalls to isolate, especially critical servers. This does not conflict with regular customer access because we protect devices that are important and only accessible to a few people.

The following is a transcript of a local experiment that simulates *** and ***.

Environment (special default environment):

A technician does a fix on a remote server.

The server is in the IDC room, and the computer room personnel see that legitimate users log in within the authorized time.

Soon, the operation was completed. After work at night, the login was logged off.

However, some *** people want to log on to the server during unauthorized hours. But I don't want to be seen by the IDC room supervisor with w on the terminal.

Successfully logged in and verified his permissions, and began to find what he wanted to secretly see.

IDC found no personnel login.

*** The user still logged into IDC equipment room at unauthorized time and did some operations.

Audit and prevention:

tail -f /var/log/secure

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.