Linux主机简单判断CC攻击的命令

CC攻击很容易发起,并且几乎不需要成本,导致现在的CC攻击越来越多。
大部分搞CC攻击的人,都是用在网上下载的工具,这些工具很少去伪造特征,所以会留下一些痕迹。
使用下面的命令,可以分析下是否在被CC攻击。

第一条命令:
tcpdump -s0 -A -n -i any | grep -o -E '(GET|POST|HEAD) .*'

正常的输出结果类似于这样
POST /ajax/validator.php HTTP/1.1
POST /api_redirect.php HTTP/1.1
GET /team/57085.html HTTP/1.1
POST /order/pay.php HTTP/1.1
GET /static/goodsimg/20140324/1_47.jpg HTTP/1.1
GET /static/theme/qq/css/index.css HTTP/1.1
GET /static/js/index.js HTTP/1.1
GET /static/js/customize.js HTTP/1.1
GET /ajax/loginjs.php?type=topbar& HTTP/1.1
GET /static/js/jquery.js HTTP/1.1
GET /ajax/load_team_time.php?team_id=57085 HTTP/1.1
GET /static/theme/qq/css/index.css HTTP/1.1
GET /static/js/lazyload/jquery.lazyload.min.js HTTP/1.1
GET /static/js/MSIE.PNG.js HTTP/1.1
GET /static/js/index.js HTTP/1.1
GET /static/js/customize.js HTTP/1.1
GET /ajax/loginjs.php?type=topbar& HTTP/1.1
GET /static/theme/qq/css/i/logo.jpg HTTP/1.1
GET /static/theme/qq/css/i/logos.png HTTP/1.1
GET /static/theme/qq/css/i/hot.gif HTTP/1.1
GET /static/theme/qq/css/i/brand.gif HTTP/1.1
GET /static/theme/qq/css/i/new.gif HTTP/1.1
GET /static/js/jquery.js HTTP/1.1
GET /static/theme/qq/css/i/logo.jpg HTTP/1.1
正常命令结果以静态文件为主,比如css,js,各种图片。
如果是被攻击,会出现大量固定的地址,比如攻击的是首页,会有大量的“GET / HTTP/1.1”,或者有一定特征的地址,比如攻击的如果是Discuz论坛,那么可能会出现大量的“/thread-随机数字-1-1.html”这样的地址。

 

第二条命令:
tcpdump -s0 -A -n -i any | grep  ^User-Agent
输出结果类似于下面:
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; 360space)
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; 360space)
User-Agent: Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; InfoPath.2)
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

这个是查看客户端的useragent,正常的结果中,是各种各样的useragent。
大多数攻击使用的是固定的useragent,也就是会看到同一个useragent在刷屏。随机的useragent只见过一次,但是给搞成了类似于这样“axd5m8usy”,还是可以分辨出来。

 

 

第三条命令:
tcpdump -s0 -A -n -i any | grep ^Host
如果机器上的网站太多,可以用上面的命令找出是哪个网站在被大量请求
输出结果类似于下面这样
Host: www.server110.com
Host: www.server110.com
Host: www.server110.com
Host: upload.server110.com
Host: upload.server110.com
Host: upload.server110.com
Host: upload.server110.com
Host: upload.server110.com
Host: upload.server110.com
Host: upload.server110.com
Host: upload.server110.com
Host: upload.server110.com
Host: www.server110.com
Host: upload.server110.com
Host: upload.server110.com
Host: upload.server110.com
Host: www.server110.com
Host: www.server110.com
Host: upload.server110.com
Host: upload.server110.com
Host: upload.server110.com
Host: www.server110.com
Host: upload.server110.com
Host: upload.server110.com
Host: www.server110.com

一般系统不会默认安装tcpdump命令
centos安装方法:yum install -y tcpdump
debian/ubuntu安装方法:apt-get install -y tcpdump

很多小白用户不懂得如何设置日志,查看日志,使用上面的命令则简单的多,复制到命令行上运行即可。


http://www.server110.com/linux_sec/201406/10670.html

MySQL5.6下主从配置

未了数据安全,主从配置双机最好能在一个独立的lan里面,如果没有独立lan,就做VPN
关于MySQL5.6安装就不再重复了,直接开始配置部分
开始之前,必须保持两台机器的数据库内容版本一致,同时所有bin-log日志都已经清空,以免出错

1.修改主服务器/etc/my.cnf ,添加以下部分到[mysqld]段里面

bind_address=192.168.1.1
log-bin=mysql-bin
expire_logs_days=2
binlog_format=MIXED
server-id=1

2.启动主服务器MySQL,并且建立账户授权从服务器进行连接
mysql -uroot -p password
mysql>GRANT REPLICATION SLAVE ON *.* to "mysync"@"192.168.1.2" identified by "YYCCEEDLF";
表示授权给ip为192.168.1.2的客户端进行连接,用户名为mysync,密码为YYCCEEDLF

3.修改从服务器的/etc/my.cnf,添加一下部分到[mysqld]段里面
binlog_format=MIXED
log-bin=slave-bin
server-id=2
expire_logs_days=2
slave-skip-errors = 1062,1194,1032

4.启动从服务器MySQL,连接主服务器读取log进行复制
mysql>change master to master_host="192.168.1.1",master_user="mysync",master_password="YYCCEEDLF";
mysql>start slave;

5.检查一下复制是否成功
mysql> show slave status\G

*************************** 1. row ***************************

Slave_IO_State: Waiting for master to send event
Master_Host: 192.168.1.1 //主服务器地址
Master_User: mysync //授权帐户名,尽量避免使用root
Master_Port: 3306 //数据库端口,部分版本没有此行
Connect_Retry: 60
Master_Log_File: mysql-bin.000001
Read_Master_Log_Pos: 13055363 //#同步读取二进制日志的位置,大于等于Exec_Master_Log_Pos
Relay_Log_File: lc2-relay-bin.000002
Relay_Log_Pos: 251
Relay_Master_Log_File: mysql-bin.000001
Slave_IO_Running: Yes //此状态必须YES
Slave_SQL_Running: Yes //此状态必须YES
......

注:Slave_IO及Slave_SQL进程必须正常运行,即YES状态,否则都是错误的状态(如:其中一个NO均属错误)。

以上操作过程,主从服务器配置完成。