{"id":4408,"date":"2025-07-03T02:22:19","date_gmt":"2025-07-02T17:22:19","guid":{"rendered":"https:\/\/eternalsphere.net\/echoes\/?p=4408"},"modified":"2026-06-06T09:12:59","modified_gmt":"2026-06-06T00:12:59","slug":"0p9rr56cqkkcno6","status":"publish","type":"post","link":"https:\/\/eternalsphere.net\/echoes\/index.php\/2025\/07\/03\/0p9rr56cqkkcno6\/","title":{"rendered":"\u4f7f\u7528 rkhunter \u6267\u884c\u7cfb\u7edf Rootkit \u68c0\u67e5\u53ca\u914d\u7f6e SSH \u5b89\u5168"},"content":{"rendered":"\n

\u8fd1\u671f\u5728\u5bf9 Linux \u7cfb\u7edf\u8fdb\u884c\u5b89\u5168\u52a0\u56fa\u65f6\uff0c\u6267\u884c\u4e86 rootkit \u68c0\u67e5\u5de5\u5177 rkhunter<\/strong>\uff0c\u5e76\u540c\u6b65\u5b8c\u5584\u4e86 SSH \u914d\u7f6e\u3002\u4ee5\u4e0b\u4e3a\u8be6\u7ec6\u6d41\u7a0b\u603b\u7ed3\u3002<\/p>\n\n\n\n

\n\n\n\n

\ud83d\udd75\ufe0f rkhunter \u68c0\u67e5\u6d41\u7a0b<\/h2>\n\n\n\n

\u5728\u6267\u884c rkhunter --check<\/code> \u65f6\uff0c\u9ed8\u8ba4\u4f1a\u5728\u6bcf\u4e2a\u9636\u6bb5\u63d0\u793a\u300c\u6309 Enter \u7ee7\u7eed\u300d\uff0c\u9700\u8981\u624b\u52a8\u64cd\u4f5c\uff0c\u65e0\u6cd5\u4e00\u6b21\u6027\u8dd1\u5b8c\u3002\u4e3a\u5b9e\u73b0\u81ea\u52a8\u5316\uff0c\u53ef\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\uff1a<\/p>\n\n\n\n

sudo rkhunter --check --skip-keypress
<\/code><\/pre>\n\n\n\n
    \n
  • --check<\/code>\uff1a\u6267\u884c\u6240\u6709\u9884\u8bbe\u68c0\u6d4b<\/li>\n\n\n\n
  • --skip-keypress<\/code>\uff1a\u8df3\u8fc7\u6309\u952e\u786e\u8ba4\uff0c\u81ea\u52a8\u8fdb\u884c\u4e0b\u4e00\u6b65<\/li>\n<\/ul>\n\n\n\n
    \u5982\u679c\u9700\u8981\u5c06\u8f93\u51fa\u4fdd\u5b58\u4e3a\u65e5\u5fd7\u6587\u4ef6\uff0c\u53ef\u8ffd\u52a0 tee<\/code>\uff1a<\/p>\n\n\n\n
    sudo rkhunter --check --skip-keypress | tee \/root\/rkhunter_check_$(date +%Y%m%d_%H%M%S).log
    <\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \ud83d\udcbe \u66f4\u65b0\u6587\u4ef6\u5c5e\u6027\u6570\u636e\u5e93<\/h2>\n\n\n\n
    \u6267\u884c\u5c5e\u6027\u6587\u4ef6\u6570\u636e\u5e93\u66f4\u65b0\u65f6\uff0c\u5e38\u7528\u547d\u4ee4\u5982\u4e0b\uff1a<\/p>\n\n\n\n
    udo rkhunter --propupd
    <\/code><\/pre>\n\n\n\n
    \u9ed8\u8ba4\u4f1a\u63d0\u793a\u786e\u8ba4\uff0c\u53ef\u4f7f\u7528 -y<\/code> \u53c2\u6570\u81ea\u52a8\u540c\u610f\uff1a<\/p>\n\n\n\n
    sudo rkhunter --propupd -y
    <\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \ud83d\udd12 SSH \u914d\u7f6e\u5b89\u5168\u6027\u8c03\u6574<\/h2>\n\n\n\n
    rkhunter \u5728\u68c0\u6d4b SSH \u914d\u7f6e\u65f6\uff0c\u4f1a\u63d0\u793a\u4ee5\u4e0b\u8b66\u544a\uff1a<\/p>\n\n\n\n
    Warning: The SSH configuration option 'Protocol' has not been set. The default value may be '2,1', to allow the use of protocol version 1.
    <\/code><\/pre>\n\n\n\n
    \u6b64\u63d0\u793a\u8868\u660e\uff0c\u82e5\u672a\u660e\u786e\u58f0\u660e Protocol<\/code>\uff0c\u67d0\u4e9b\u8001\u65e7\u7cfb\u7edf\u53ef\u80fd\u9ed8\u8ba4\u652f\u6301\u534f\u8bae\u7248\u672c 1\uff0c\u5b58\u5728\u5b89\u5168\u9690\u60a3\u3002<\/p>\n\n\n\n
    \u89e3\u51b3\u65b9\u6848\uff1a\u7f16\u8f91 \/etc\/ssh\/sshd_config<\/code> \u6587\u4ef6\uff0c\u660e\u786e\u8bbe\u7f6e\u4ec5\u5141\u8bb8\u7248\u672c 2\uff1a<\/p>\n\n\n\n
    Protocol 2
    <\/code><\/pre>\n\n\n\n
    \u5728\u5927\u591a\u6570\u8f83\u65b0\u7684\u7cfb\u7edf\u4e2d\uff0c\u5df2\u9ed8\u8ba4\u53ea\u542f\u7528\u534f\u8bae\u7248\u672c 2\uff0c\u56e0\u6b64\u5b9e\u9645\u914d\u7f6e\u6587\u4ef6\u4e2d\u672a\u51fa\u73b0 Protocol<\/code> \u5b57\u6bb5\u3002\u5982\u679c\u9700\u8981\u624b\u52a8\u6dfb\u52a0\uff0c\u53ef\u76f4\u63a5\u5728\u6587\u4ef6\u672b\u5c3e\u65b0\u589e\uff1a<\/p>\n\n\n\n
    # Only allow SSH Protocol 2
    Protocol 2
    <\/code><\/pre>\n\n\n\n
    \u4fee\u6539\u5b8c\u6210\u540e\uff0c\u91cd\u65b0\u52a0\u8f7d\u6216\u91cd\u542f SSH \u670d\u52a1\u5373\u53ef\u751f\u6548\uff1a<\/p>\n\n\n\n
    sudo systemctl reload sshd
    # \u6216
    sudo systemctl restart sshd
    <\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \ud83e\uddf9 \u603b\u7ed3<\/h2>\n\n\n\n
      \n
    • \u4f7f\u7528 --skip-keypress<\/code> \u53c2\u6570\u53ef\u8ba9 rkhunter \u68c0\u67e5\u5168\u81ea\u52a8\u5316\uff0c\u65e0\u9700\u624b\u52a8\u6309\u952e\u3002<\/li>\n\n\n\n
    • \u66f4\u65b0\u5c5e\u6027\u6570\u636e\u5e93\u65f6\uff0c\u53ef\u7528 -y<\/code> \u81ea\u52a8\u8df3\u8fc7\u786e\u8ba4\u3002<\/li>\n\n\n\n
    • \u4e3a\u63d0\u9ad8 SSH \u5b89\u5168\u6027\uff0c\u5efa\u8bae\u5728\u914d\u7f6e\u6587\u4ef6\u4e2d\u660e\u786e\u58f0\u660e Protocol 2<\/code>\uff0c\u9632\u6b62\u6f5c\u5728\u6f0f\u6d1e\u3002<\/li>\n<\/ul>\n\n\n\n
      \n\n\n\n
      \u2705 \u5b9a\u671f\u6267\u884c rootkit \u68c0\u67e5\u3001\u53ca\u65f6\u66f4\u65b0\u6570\u636e\u5e93\uff0c\u5e76\u5bf9 SSH \u914d\u7f6e\u8fdb\u884c\u52a0\u56fa\uff0c\u662f\u4fdd\u969c\u670d\u52a1\u5668\u5b89\u5168\u7684\u91cd\u8981\u6b65\u9aa4\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
      \u8fd1\u671f\u5728\u5bf9 Linux \u7cfb\u7edf\u8fdb\u884c\u5b89\u5168\u52a0\u56fa\u65f6\uff0c\u6267\u884c\u4e86 rootkit \u68c0\u67e5\u5de5\u5177 rkhunter\uff0c\u5e76\u540c\u6b65\u5b8c\u5584\u4e86 SSH \u914d\u7f6e\u3002\u4ee5\u4e0b\u4e3a\u8be6\u7ec6\u6d41\u7a0b\u603b\u7ed3\u3002 \ud83d\udd75\ufe0f rkhunter \u68c0\u67e5\u6d41\u7a0b \u5728\u6267\u884c rkhunter –check \u65f6\uff0c\u9ed8\u8ba4\u4f1a\u5728\u6bcf\u4e2a\u9636\u6bb5\u63d0\u793a\u300c\u6309 Enter \u7ee7\u7eed\u300d\uff0c\u9700\u8981\u624b\u52a8\u64cd\u4f5c\uff0c\u65e0\u6cd5\u4e00\u6b21\u6027\u8dd1\u5b8c\u3002\u4e3a\u5b9e\u73b0\u81ea\u52a8\u5316\uff0c\u53ef\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\uff1a sudo rkhunter –check –skip-keypress \u5982\u679c\u9700\u8981\u5c06\u8f93\u51fa\u4fdd\u5b58\u4e3a\u65e5\u5fd7\u6587\u4ef6\uff0c\u53ef\u8ffd\u52a0 tee\uff1a sudo rkhunter –check –skip-keypress | tee \/root\/rkhunter_check_$(date +%Y%m%d_%H%M%S).log \ud83d\udcbe \u66f4\u65b0\u6587\u4ef6\u5c5e\u6027\u6570\u636e\u5e93 \u6267\u884c\u5c5e\u6027\u6587\u4ef6\u6570\u636e\u5e93\u66f4\u65b0\u65f6\uff0c\u5e38\u7528\u547d\u4ee4\u5982\u4e0b\uff1a udo rkhunter –propupd \u9ed8\u8ba4\u4f1a\u63d0\u793a\u786e\u8ba4\uff0c\u53ef\u4f7f\u7528 -y \u53c2\u6570\u81ea\u52a8\u540c\u610f\uff1a sudo rkhunter –propupd -y \ud83d\udd12 SSH \u914d\u7f6e\u5b89\u5168\u6027\u8c03\u6574 rkhunter \u5728\u68c0\u6d4b SSH …<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[191],"tags":[],"class_list":["post-4408","post","type-post","status-publish","format-standard","hentry","category-kxy5oby825mc63x"],"_links":{"self":[{"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/posts\/4408","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/comments?post=4408"}],"version-history":[{"count":2,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/posts\/4408\/revisions"}],"predecessor-version":[{"id":5024,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/posts\/4408\/revisions\/5024"}],"wp:attachment":[{"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/media?parent=4408"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/categories?post=4408"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/tags?post=4408"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}