RedHat介紹開嗰3款針對Linux惡意程式嘅掃描/消除工具

Okt04175

無論如何Linux的確係有機會畀惡意程式搞裝定防護工具程式冇壞嘅，但係起碼都好過Windows至少唔會有樹大招風嘅問題，Wanna Cry呢啲極品都係多得M$人為留低嘅Windows後門先有得玩到全球大規模奶野。
https://www.redhat.com/sysadmin/3-antimalware-solutions

chkrootkit
I've used good ol' chkrootkit for years. Simply put, it scans important files in your system for rootkits. Rootkits are collections of malicious programs designed to compromise the root user account and keep access for an extended period of time. Rootkits are hard to detect and difficult to remove from a system. I've heard many sysadmins say that if your system is the victim of a rootkit, you should reimage (format and reinstall from media) it and restore all data from a clean backup.
...

rkhunter
The RootKit Hunter (rkhunter)is a rootkit detection script that automates scanning for a lot of different rootkits and other local exploits. I love rkhunter. I've used it for years, too. Unlike chkrootkit, rkhunter provides a full log of its findings at /var/log/rkhunter/rkhunter.log. If you install and run only one malware scanning application, rkhunter should probably be it. I'm too paranoid to run just one.
...

ClamAV
From the ClamAV about page: ClamAV is an open source (GPL) anti-virus engine used in a variety of situations, including email scanning, web scanning, and endpoint security. It provides a number of utilities, including a flexible and scalable multi-threaded daemon, a command-line scanner, and an advanced tool for automatic database updates.
...

t61

Linux 因為有大量公司使用開源OS，已經超越Windows成為Hacker頭號攻擊目標。



回覆 1# Okt04175

Okt04175

Linux 因為有大量公司使用開源OS，已經超越Windows成為Hacker頭號攻擊目標。
t61 發表於 2020-4-18 14:52

啲公司行得Linux多數都係裝喺唔通街外網嘅電腦，會通街外網嘅電腦就算行Linux多數只係做網站伺服器，始終係Windows嘅入侵難度低啲同入侵收穫豐富啲，Linux每次程式碼更新都有公眾昅著一有漏洞好快有人提出到Hotfix方案堵塞漏洞好過M$閉門造車啦。

KinChungE

啲公司行得Linux多數都係裝喺唔通街外網嘅電腦，會通街外網嘅電腦就算行Linux多數只係做網站伺服器，始終 ...
Okt04175 發表於 2020-4-19 01:15

大把公司用Linux-based Email Server
淨係睇下web/email hosting公司就知, 10間有9間都係Linux

仲未計DNS, Cloudflare / Amazon等都係用Linux做DNS

Okt04175

大把公司用Linux-based Email Server
淨係睇下web/email hosting公司就知, 10間有9間都係Linux :fa ...
KinChungE 發表於 2020-4-19 02:05

搞人哋DNS收穫唔算多除非同一時間搞晒全球大多數DNS伺服器先至「河蟹」到大半個地球上唔到一啲網站或者間接引導人哋電腦順便Ping某啲網站被引導嘅機一多就Ping冧啲伺服器。
如果係搞Email伺服器都肯定有本事短期內解到郵件嘅加密，如果解唔到加密搞嚟冇意思。
SMB伺服器先多野喺入面，多數行SMB嘅都係WinServer。

不過要搞乜伺服器都好，解唔到人哋嘅加密內容就DUMP幾多野都冇用哂自己儲存空間，至少喺超高速量子電腦普及之前暫時係咁樣。
不過香港啲教育機構多數都係冇加密好重要嘅資料明文儲存，只係好數冇成為高技術駭客嘅目標啫。

Linux封漏洞封得好快要從網上入侵Linux機做手腳唔係國家級駭客都難做到，通常Linux機出事都係公司內部嘅人做手腳居多，如果真係咁樣出事咪就係間公司啲人嘅問題唔係Linux嘅問題。

samiux

搞人哋DNS收穫唔算多除非同一時間搞晒全球大多數DNS伺服器先至「河蟹」到大半個地球上唔到一啲網站或者間 ...
Okt04175 發表於 2020-4-19 04:43

你未免太神化了 Linux 吧！？

via HKEPC IR Pro 3.6.1 - Android(3.3.1)

sonichkhk

回覆 6# Okt04175


    Linux漏洞比你想像多得多

bongbong3481

回覆 1# Okt04175

用左５年幾，我只裝過 Clamtk　係ubuntu, 不過唔係實時，掃過一次半次，就沒用過

love98tai

第3個ClamAV 舊Linux系統EMAIL server 很多會用到。
123大家有沒有又新又好用tools介紹

via HKEPC Reader for Android