Server security warning handling (methods to find mining viruses)

Server security warning handling (methods to find mining viruses)

Method 1

Find the process and force kill the corresponding process

ps -aux | grep kinsing



ps -aux | grep kdevtmpfsi

AI writing code

Find virus files kinsing kdevtmpfsi

1. 
   
   
   find / -name kinsing
   
   
   
   find / -name kdevtmpfsi
   
   AI writing code

   View cycle task cron, not necessarily under root user, may be postgres (database), docker (container), PHPTest (PHP unit test)

   cd /var/spool/cron //Enter the directory of the cycle task. If there are cycles that are not written by yourself, delete them.
   AI writing code

   Set a password with a certain strength for postgres users

   passwd postgres
   AI writing code

   Update system patches in a timely manner to make up for vulnerabilities

   
   
   
   yum -y update (CentOS)
   
   
   
   apt -y update (Debian)
   
   AI writing code

   Method 2 (Open the firewall)

Turn on the firewall

systemctl start firewalld
AI writing code

Check the status of the firewall

systemctl status firewalld
AI writing code

Turn off the firewall

systemctl stop firewalld
AI writing code

Turn off the power-on and start up

systemctl disable firewalld
AI writing code

Turn on and start up

systemctl enable firewalld
AI writing code

firewalld firewall open port

Check the firewalld status: systemctlstatus firewalld



 



Turn on firewalld:systemctlstart firewalld



 



If an error is reported during startup: Failedto start :Unit is masked.



 



Because it is locked, firewalld is cancelled: systemctl unmask firewalld, and start it again (it cannot be enabled after opening the firewall.80port, so you cannot access your own website)



 



Open a port: firewall-cmd --zone=public --add-port=80/tcp --permanent(Open80port)



 



Reload: firewalld-cmd --reload



systemctl restart firewalld

AI writing code

Replenish

View all open temporary ports (default is empty)

firewall-cmd --list-ports
AI writing code

View all permanently open ports (default is empty)

firewall-cmd --list-ports --permanent
AI writing code

Add a temporary open port (for example: I want to modify the ssh remote connection port to be 223, so I have to open this port)

firewall-cmd --add-port=223/tcp
AI writing code

Add permanently open ports (for example: port 223)

firewall-cmd --add-port=223/tcp --permanent
AI writing code

Close temporary port

firewall-cmd --remove-port=80/tcp
AI writing code

Close permanent port

firewall-cmd --remove-port=80/tcp --permanent
AI writing code

After these configurations are finished, you need to enter a reload command and restart the firewall to take effect