目录
1.开关机安全控制
1.2 实例：GRUB 菜单设置密码
2.终端登录安全控制
2.1 限制root只在安全终端登录
3.弱口令检测
3.1 Joth the Ripper,JR编辑
4.网络端口扫描
4.1 nmap命令
1.开关机安全控制
1.1 GRUB限制
限制更改GRUB引导参数
通常情况下在系统开机进入GRUB菜单时，按e键可以查看并修改GRUB引导参数，这对服务器是一个极大的威胁。
可以为GRUB 菜单设置一个密码，只有提供正确的密码才被允许修改引导参数。
1.2 实例：GRUB 菜单设置密码
（1）根据提示设置GRUB菜单的密码；
（2）备份密码字符串、grub.cfg文件以及00_header文件；
（3）设置能够修改GRUB菜单的用户名和密码；
（4）生成新的grub.cfg文件；
2.终端登录安全控制
2.1 限制root只在安全终端登录
/etc/securetty：保存虚拟终端的配置文件，注释指定虚拟主机，将无法登录到系统；
2.2 禁止普通用户登录
A
/etc/nologin：创建该文件后，普通用户将无法再登录到系统中；
[root@localhost ~]# touch /etc/nologin #创建文件，禁止普通用户登录
[root@localhost ~]# rm -f /etc/nologin #删除该文件后，其他普通文件仍然又可以继续登录到系统中
3.弱口令检测
3.1 Joth the Ripper,JR
使用jr工具密码破解 ，步骤如下：
（1） 解压工具包
[root@localhost ~]# cd /opt
[root@localhost opt]# ls #将john压缩工具包拉入虚拟机中
john-1.8.0.tar.gz rh
[root@localhost opt]# tar xf john-1.8.0.tar.gz #解压工具包
（2）切换到src子目录
[root@localhost opt]# ls
john-1.8.0 john-1.8.0.tar.gz rh
[root@localhost opt]# cd john-1.8.0/
[root@localhost john-1.8.0]# ls
doc README run src
[root@localhost john-1.8.0]# cd src/
（3）进行编译安装
[root@localhost src]# yum install -y gcc gcc-c++ make #编码安装之前先安装gcc
已加载插件：fastestmirror, langpacks
Loading mirror speeds from cached hostfile
* base: ftp.sjtu.edu.cn
* extras: mirrors.163.com
* updates: mirrors.163.com
软件包 gcc-4.8.5-44.el7.x86_64 已安装并且是最新版本
软件包 gcc-c++-4.8.5-44.el7.x86_64 已安装并且是最新版本
软件包 1:make-3.82-24.el7.x86_64 已安装并且是最新版本
无须任何处理
rm -f ../run/unshadow
ln -s john ../run/unshadow
rm -f ../run/unafs
ln -s john ../run/unafs
rm -f ../run/unique
ln -s john ../run/unique
make[1]: 离开目录“/opt/john-1.8.0/src（4）准备待破解的密码文件
[root@localhost src]# cd ..
[root@localhost john-1.8.0]# ls
doc README run src
[root@localhost john-1.8.0]# cd run/
[root@localhost run]# ls
ascii.chr john lm_ascii.chr makechr relbench unique
digits.chr john.conf mailer password.lst unafs unshadow
[root@localhost run]# cp /etc/shadow ./shadow #将/etc/shadow下的文件复制到当前目录下的shadow.txt文件中
（ 5）执行暴力破解（./john --wordlist=[指定字典文件的绝对路径] [需要破解的文件名]：使用指定的字典文件进行破解）
[root@localhost run]# ./john shadow --wordlist=./password.lst #执行暴力破解密码
Loaded 4 password hashes with 4 different salts (crypt, generic crypt(3) [?/64])
Press 'q' or Ctrl-C to abort, almost any other key for status
123456 (zhangsan)
123123 (lisi)
2g 0:00:01:02 100% 0.03212g/s 56.96p/s 123.1c/s 123.1C/s !@#$%..sss
Use the "--show" option to display all of the cracked passwords reliably
Session completed
[root@localhost run]#
password.lst:该文件保存密码字典
[root@localhost /opt/john-1.8.0/run]# vim password.lst #该文件保存密码字典，只有保存在字典里的密码才能够破解出来，对于字典里没有的密码，将无法破解（字典里的文件越全，破解能力越强）
slip
stivers
test2
test3
tula
unix
user1
xanth
john.pot：破解后的密码信息都保存在该文件中,加密后的字符串对应解密后的密码
[root@localhost run]# vim john.pot
$6$BZfw4ECl$6X4RYQDDzbDlmXYN1N7E4lz9sA7VmSpVfPkfLFDh8bvUSHPYODst3h9kEnz/k4UU7M0gybLdnjqi0ofSpc41J/:123456
$6$ir9lWkcD$NbNigOetdQuBSrfwXwB63z9cg8rCMasotwVb5WgfdEKdKD6VzZyjz8ey4agu5axJChKy.KwT94XO1NE/lXXcX/:123123
4.网络端口扫描
4.1 nmap命令
netstat -lntp：以数字形式显示TCP处于监听状态的网络连接及端口信息
[root@localhost yum.repos.d]# netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1099/sshd
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1101/cupsd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1425/master
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 1134/named
tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN 4199/sshd: root@pts
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 715/rpcbind
tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN 1134/named
tcp 0 0 192.168.80.100:53 0.0.0.0:* LISTEN 1134/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 1134/named
tcp6 0 0 :::22 :::* LISTEN 1099/sshd
tcp6 0 0 ::1:631 :::* LISTEN 1101/cunetstat -antp：以数字形式显示TCP所有状态下的网络连接及端口信息
[root@localhost yum.repos.d]# netstat -antp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1099/sshd
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1101/cupsd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1425/master
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 1134/named
tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN 4199/sshd: root@pts
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 715/rpcbind
tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN 1134/named
tcp 0 0 192.168.80.100:53 0.0.0.0:* LISTEN 1134/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 1134/named
tcp 0 36 192.168.80.100:22 192.168.80.1:60425 ESTABLISHED 4199/ssss -antp：以数字形式显示TCP所有状态下的网络连接及端口信息；（效果和netstat命令相同，但执行效率比netstat命令更高）
[root@localhost yum.repos.d]# ss -antp
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:22 *:* users:(("sshd",pid=1099,fd=3))
LISTEN 0 128 127.0.0.1:631 *:* users:(("cupsd",pid=1101,fd=11))
LISTEN 0 100 127.0.0.1:25 *:* users:(("master",pid=1425,fd=13))
LISTEN 0 128 127.0.0.1:953 *:* users:(("named",pid=1134,fd=23))
LISTEN 0 128 127.0.0.1:6010 *:* users:(("sshd",pid=4199,fd=9))
LISTEN 0 128 *:111 *:* users:(("rpcbind",pid=715,fd=8))
LISTEN 0 10 192.168.122.1:53 *:* users:(("named",pid=1134,fd=25))
LISTEN 0 10 192.168.80.100:53 *:* 查看进程是否开启的四种方法
[root@localhost opt]# ps -elf | grep ssdh
0 S root 5375 4207 0 80 0 - 28206 pipe_w 16:14 pts/0 00:00:00 grep --color=auto ssdh
[root@localhost opt]# netstat -lntp | grep sshd #第一种
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1099/sshd
tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN 4199/sshd: root@pts
tcp6 0 0 :::22 :::* LISTEN 1099/sshd
tcp6 0 0 ::1:6010 :::* LISTEN 4199/sshd: root@pts
[root@localhost opt]# ps aux | grep httpd #第二种
root 5464 0.0 0.0 112824 988 pts/0 S+ 16:19 0:00 grep --color=auto httpd
[root@localhost opt]# lsof -i :80 #第三种
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 5563 root 4u IPv6 71872 0t0 TCP *:http (LISTEN)
httpd 5568 apache 4u IPv6 71872 0t0 TCP *:http (LISTEN)
httpd 5569 apache 4u IPv6 71872 0t0 TCP *:http (LISTEN)
httpd 5570 apache 4u IPv6 71872 0t0 TCP *:http (LISTEN)
httpd 5571 apache 4u IPv6 71872 0t0 TCP *:http (LISTEN)
httpd 5572 apache 4u IPv6 71872 0t0 TCP *:http (LISTEN)
[root@localhost opt]# systemctl status httpd #第四种
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled)
Active: active (running) since 六 2024-04-27 16:27:02 CST; 11s ago
Docs: man:httpd(8)
man:apachectl(8)
Main PID: 5563 (httpd)
Status: "Total requests: 0; Current requests/sec: 0; Current traffic: 0 B/sec"
Tasks: 6
CGroup: /system.slice/httpd.service
├─5563 /usr/sbin/httpd -DFOREGROUND
├─5568 /usr/sbin/httpd -DFOREGROUND
├─5569 /usr/sbin/httpd -DFOREGROUND
├─5570 /usr/sbin/httpd -DFOREGROUND
├─5571 /usr/sbin/httpd -DFOREGROUND
└─5572 /usr/sbin/httpd -DFOREGROUND
如何通过端口查看进程号
[root@localhost opt]# netstat -lntp | grep sshd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1099/sshd
tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN 4199/sshd: root@pts
tcp6 0 0 :::22 :::* LISTEN 1099/sshd
tcp6 0 0 ::1:6010 :::* LISTEN 4199/sshd: root@pts
[root@localhost opt]# lsof -i :80
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 5563 root 4u IPv6 71872 0t0 TCP *:http (LISTEN)
httpd 5568 apache 4u IPv6 71872 0t0 TCP *:http (LISTEN)
httpd 5569 apache 4u IPv6 71872 0t0 TCP *:http (LISTEN)
httpd 5570 apache 4u IPv6 71872 0t0 TCP *:http (LISTEN)
httpd 5571 apache 4u IPv6 71872 0t0 TCP *:http (LISTEN)
httpd 5572 apache 4u IPv6 71872 0t0 TCP *:http (LISTEN)
[root@localhost opt]# ss -lntup | grep :80
tcp LISTEN 0 128 [::]:80 [::]:* users:(("httpd",pid=5572,fd=4),("httpd",pid=5571,fd=4),("httpd",pid=5570,fd=4),("httpd",pid=5569,fd=4),("httpd",pid=5568,fd=4),("httpd",pid=5563,fd=4))
nmap -p 80 192.168.80.0/24 ：扫描出指定192.168.80.0网段内有哪些主机开启了80端口
[root@localhost opt]# nmap -p 80 192.168.80.0/24
Starting Nmap 6.40 ( http://nmap.org ) at 2024-04-27 16:59 CST
Nmap scan report for 192.168.80.1
Host is up (0.00051s latency).
PORT STATE SERVICE
80/tcp closed http
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.80.2
Host is up (0.00025s latency).
PORT STATE SERVICE
80/tcp closed http
MAC Address: 00:50:56:E7:A2:D5 (VMware)
Nmap scan report for 192.168.80.254
Host is up (-0.10s latency).
PORT STATE SERVICE
80/tcp filtered http
MAC Address: 00:50:56:E8:8F:B7 (VMware)
Nmap scan report for 192.168.80.100
Host is up (0.00020s latency).
PORT STATE SERVICE
80/tcp open http
Nmap done: 256 IP addresses (4 hosts up) scanned in 2.69 seconds
nmap -n -sP 192.168.80.0/24：查看192.168.80.0网段内，有哪些主机存活
[root@localhost opt]# nmap -n -sP 192.168.80.0/24
Starting Nmap 6.40 ( http://nmap.org ) at 2024-04-27 17:04 CST
Nmap scan report for 192.168.80.1
Host is up (0.0011s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.80.2
Host is up (0.00013s latency).
MAC Address: 00:50:56:E7:A2:D5 (VMware)
Nmap scan report for 192.168.80.254
Host is up (-0.10s latency).
MAC Address: 00:50:56:E8:8F:B7 (VMware)
Nmap scan report for 192.168.80.100
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 2.17 seconds
4.2 nmap使用方法
