求助，公司linux系统可能中毒了，老板要我解决，在线等！

ssffzz1

原帖由 zhbl 于 2007-4-13 09:51 发表于 7楼  
admin:500:500::/home/admin:/bin/bash
这个用户是不是系统装好本身就存在的？

用户ID是500,应该是后来加上去的.

5iwww

贴贴看 tcpdump arp 的结果 :wink:

zhbl

这是secure的记录，帮我看看啊，222.73.236.51和88.52.113.164  IP都是外部的。
Feb 14 15:47:50 DnProxy sshd[5487]: Did not receive identification string from 67.15.8.76
Feb 14 15:51:35 DnProxy sshd[5489]: Failed password for root from 67.15.8.76 port 56921 ssh2
Feb 14 16:04:04 DnProxy sshd[5494]: Illegal user lpd from 88.52.113.164
Feb 14 16:04:06 DnProxy sshd[5494]: Failed password for illegal user lpd from 88.52.113.164 port 39600 ssh2
Feb 14 16:04:13 DnProxy sshd[5496]: Illegal user lpa from 88.52.113.164
Feb 14 16:04:15 DnProxy sshd[5496]: Failed password for illegal user lpa from 88.52.113.164 port 39787 ssh2
Feb 14 16:04:24 DnProxy sshd[5498]: Failed password for admin from 88.52.113.164 port 39971 ssh2
Feb 14 16:04:36 DnProxy sshd[5500]: Failed password for admin from 88.52.113.164 port 40152 ssh2
Feb 14 17:39:53 DnProxy sshd[6370]: Did not receive identification string from 211.189.50.94
Feb 14 17:42:08 DnProxy sshd[6371]: Failed password for root from 211.189.50.94 port 52781 ssh2
Feb 14 17:59:48 DnProxy sshd[6787]: Illegal user lpd from 222.73.236.51
Feb 14 17:59:50 DnProxy sshd[6787]: Failed password for illegal user lpd from 222.73.236.51 port 46675 ssh2
Feb 14 17:59:50 DnProxy sshd[6789]: Illegal user lpa from 222.73.236.51
Feb 14 17:59:53 DnProxy sshd[6789]: Failed password for illegal user lpa from 222.73.236.51 port 46900 ssh2
Feb 14 17:59:55 DnProxy sshd[6791]: Failed password for admin from 222.73.236.51 port 47130 ssh2
Feb 14 17:59:58 DnProxy sshd[6793]: Failed password for admin from 222.73.236.51 port 47362 ssh2
Feb 14 18:00:00 DnProxy sshd[6795]: Failed password for admin from 222.73.236.51 port 47601 ssh2
Feb 14 18:00:00 DnProxy sshd[6797]: Illegal user ftpuser from 222.73.236.51
Feb 14 18:00:03 DnProxy sshd[6797]: Failed password for illegal user ftpuser from 222.73.236.51 port 47855 ssh2
Feb 14 18:00:03 DnProxy sshd[6799]: Illegal user ftpuser from 222.73.236.51
Feb 14 18:00:05 DnProxy sshd[6799]: Failed password for illegal user ftpuser from 222.73.236.51 port 48103 ssh2
Feb 14 18:00:05 DnProxy sshd[6801]: Illegal user ftpuser from 222.73.236.51
Feb 14 18:00:08 DnProxy sshd[6801]: Failed password for illegal user ftpuser from 222.73.236.51 port 48344 ssh2
Feb 14 18:00:08 DnProxy sshd[6803]: Illegal user ftpuser from 222.73.236.51

zhbl

他是时好时坏，现在还是满正常的

aklus

arp 病毒
google 一下,
前段时间有很多这种情况的

zhbl

你好，你是怎么确定的arp病毒的，我想知道原因，否则无从下手，

5iwww

如果是arp 欺骗的话 确实会有上网时好时坏的现象

主要体现为：  欺骗的主机会广播一个包，对同子网内的主机说，我自己就是网关，于是子网内主机的gw的mac地址就不是以前的那个真实的网关的mac地址了，然而网关也会发正常的广播包更新主机的本地mac，这样就会出现上网时通时不通的现象。

用tcpdump arp 可以看出 是那个mac会公布自己是网关 ，然后比较真实网关的mac地址，如果不是，则为arp欺骗主机，切掉其端口即可

所以LZ可以检查一下 是否是arp欺骗 导致的问题

heyuan

这种网络打摆子，多半都是Arp
看看源Mac地址，然后到交换机上查。
如果MAc是伪装的，就一个一个端口拔。

aklus

你+我msn aklus@gmail.cn
发给你个软件

bleai

俺来帮你顶。。。
学习中。。。