解决阿里云主机受到攻击的问题 2

解决阿里云主机受到攻击的问题

详细解决方案

在/etc/profile 文件中添加:

sed -i 's/^\([^#].*scrypt\)/# \1/' /etc/rc.local

sed -i 's/^\(\/mnt\/linsx\)/# \1/' /etc/rc.local

sed -i 's/^\(\/tmp\/\)/# \1/' /etc/rc.local

rm -fr /mnt/linsx

rm -fr /tmp/minerd

rm -fr /tmp/1.sh

ps -ef |grep "/usr/bin/acpid" |grep -v grep |awk -F" "  {'print $2'}|xargs -i kill -9 {}

ps -ef |grep "/usr/bin/bsd-port/agent" |grep -v grep |awk -F" "  {'print $2'}|xargs -i kill -9 {}

ps -ef |grep "/usr/bin/.sshd" |grep -v grep|awk -F" "  {'print $2'}|xargs -i kill -9 {}

ps -ef |grep "/root/.l" |grep -v grep|awk -F" "  {'print $2'}|xargs -i kill -9 {}

ps -ef |grep "/mnt/linsx" |grep -v grep|awk -F" "  {'print $2'}|xargs -i kill -9 {}

在 /root/.bash_profile 添加相同的代码

定时器执行的脚本:

Java代码  

1. #!/bin/sh  
2. $grep_result  
3. grep_result=`ps -ef |grep tomcat|grep "/home/whuang/software/apache/apache-tomcat-7.0.53"|grep -v "grep"`  
4. if [ x"$grep_result" = x"" ];then  
5.   
6.         catalina_home2=/home/whuang/software/apache/apache-tomcat-7.0.53  
7.         CATALINA_HOME=$catalina_home2  
8.         cd $catalina_home2/bin  
9.         ./startup.sh  
10.     else  
11.         echo "tomcat is running..."    
12.     fi  
13. rm -fr /usr/bin/acpid 2>/dev/null  
14. rm -fr /usr/bin/bsd-port/agent  
15. rm -fr /usr/bin/.sshd  
16. rm -fr /mnt/linsx  

rm -fr /tmp/minerd

rm -fr /tmp/1.sh

Java代码  

1. ps -ef |grep "/usr/bin/acpid" |grep -v grep |awk -F" "  {'print $2'}|xargs -i kill -9 {}  
2. ps -ef |grep "/usr/bin/bsd-port/agent" |grep -v grep |awk -F" "  {'print $2'}|xargs -i kill -9 {}  
3. ps -ef |grep "/usr/bin/.sshd" |grep -v grep|awk -F" "  {'print $2'}|xargs -i kill -9 {}  
4. ps -ef |grep "/root/.l" |grep -v grep|awk -F" "  {'print $2'}|xargs -i kill -9 {}  
5. ps -ef |grep "/mnt/linsx" |grep -v grep|awk -F" "  {'print $2'}|xargs -i kill -9 {}  
6.   
7.   
8. sed -i 's/^\([^#].*scrypt\)/# \1/' /etc/rc.local  
9. sed -i 's/^\(\/mnt\/linsx\)/# \1/' /etc/rc.local  
10. sed -i 's/^\(\/tmp\/\)/# \1/' /etc/rc.local