Author: eagle
前言 Foreword
本文参考sinbad网络安全站的那篇linux安全配置的文章的框架，呵呵，我不太会组织语法（语文差：） This reference to sinbad linux network security station, the essay framework security configuration article, Oh, I do not will organize the syntax (language difference:)
呵呵，这篇文章的目的在于让读者对linux的安全配置有个大概的了解，呵呵，因为我也看过一些关于这方面的文章，说的太空了，呵呵其实我觉得linux机器要做一般的安全配置的话，分分钟就搞定了，嘿嘿 Oh, this article aims to give readers the security configuration of linux have a rough idea, huh, huh, because I read some articles about this, that space, huh fact, I think linux machine to do general security configuration, then every minute to get, hey
1，安装 1, the installation
安装的时候，大家都轻车熟路了，呵呵，首先，隔离网络进行系统安装，当然选择custom方式，安装你需要的软件包。 When installed, we have hundreds of times, and Oh, first of all, isolate the network installation, of course, choose custom mode, you need to install the package.
硬盘分区：如果用root分区纪录数据，如log文件和email，就可能因为拒绝服务产生大量日志或垃圾邮件。 Hard disk partition: If the root partition record data such as log files and email, it may generate a large number of logs because of denial of service or spam. 导致系统崩溃。 Cause a system crash. 所以建议为/var开辟单独的分区，用来存放日志和邮件，以避免root分区被溢出啦，那就惨喽。 It is proposed for / var to open up a separate partition to store logs and e-mail, to avoid overflow root partition is the matter, it is miserable myself. 最好为特殊的应用程序单独开一个分区，特别是可以产生大量日志的程序，还有建议为/home单独分一个区，这样他们就不能填满/分区了，以下是我硬盘上的分区情况： Best for the particular application to open a separate partition, in particular, the procedure can produce a large number of logs, as well as suggestions for the / home a separate sub-zone, so that they can not fill the / partition, the following is a partition of my hard drive :
/ root / Root
/var log / Var log
/hacking 嘻嘻，我的一些黑软 / Hacking hee hee, some of my black soft
swap 不多说了 swap not much to say
/home / Home
当系统安装完重新启动后，最好打上相应系统的安全补丁，请大家养成良好的习惯，记住，你不是在自己家里装98，你装的是一个linux服务器，呵呵。 When the system restarts after installation, the best marked with the appropriate system security patches, please develop good habits, remember that you are not mounted in their own homes 98, you installed a linux server, huh, huh. 对于redhat系统而言可以在：http://www.redhat.com/corp/support/errata/找到补丁。 For redhat systems can: http://www.redhat.com/corp/support/errata/ find patches.
在redhat6.1以后的版本带有一个工具up2date，它能够测定哪些rpm包需要升级，然后自动从redhat的站点下载并完成安装。 In redhat6.1 later with a tool up2date, it can determine which packages need to upgrade rpm, then automatically downloaded from the redhat site and complete the installation.
2，关闭服务 2, close the service
呵呵，有句话说的好，要想你的系统绝对安全，就是掐断网线，呵呵，当然我们的机器要对外提供服务，那是不现实的，所以关闭不必要的服务是必要的，因为有些服务会为您的系统带来麻烦。 Oh, there is a saying that good, to the absolute security of your system is cut off cable, Oh, of course, we want to provide services outside of the machine, it is unrealistic, so turn off unnecessary services is necessary because Some services will be trouble for your system.
默认的linux就是一个强大的系统，运行了很多的服务。 The default linux is a powerful system to run a lot of services. 但，有许多服务是不需要的，很容易引起安全风险。 However, many services are not needed, can easily lead to security risks. 第一个文件是/etc/inetd.conf，它制定了/usr/sbin/inetd将要监听的服务，你可能只需要其中的两个：telnet和ftp，其他的许多如popd,imapd和rsh都是有可能引发安全问题的。 The first file is / etc / inetd.conf, it has developed / usr / sbin / inetd will listen service, you may only need two of them: telnet and ftp, many other such popd, imapd, and rsh are all may lead to security issues. 用下面的命令显示没有被注释掉的服务： With the following command to display the service is not commented out:
suneagle# grep -v "#" /etc/inetd.conf suneagle # grep-v "#" / etc / inetd.conf
ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a ftp stream tcp nowait root / usr / sbin / tcpd in.ftpd-l-a
telnet stream tcp nowait root /usr/sbin/tcpd in.telnetd telnet stream tcp nowait root / usr / sbin / tcpd in.telnetd
shell stream tcp nowait root /usr/sbin/tcpd in.rshd shell stream tcp nowait root / usr / sbin / tcpd in.rshd
login stream tcp nowait root /usr/sbin/tcpd in.rlogind login stream tcp nowait root / usr / sbin / tcpd in.rlogind
talk dgram udp wait nobody.tty /usr/sbin/tcpd in.talkd talk dgram udp wait nobody.tty / usr / sbin / tcpd in.talkd
ntalk dgram udp wait nobody.tty /usr/sbin/tcpd in.ntalkd ntalk dgram udp wait nobody.tty / usr / sbin / tcpd in.ntalkd
pop-3 stream tcp nowait root /usr/sbin/tcpd ipop3d pop-3 stream tcp nowait root / usr / sbin / tcpd ipop3d
imap stream tcp nowait root /usr/sbin/tcpd imapd imap stream tcp nowait root / usr / sbin / tcpd imapd
finger stream tcp nowait nobody /usr/sbin/tcpd in.fingerd finger stream tcp nowait nobody / usr / sbin / tcpd in.fingerd
linuxconf stream tcp wait root /bin/linuxconf linuxconf --http linuxconf stream tcp wait root / bin / linuxconf linuxconf - http
exec stream tcp nowait root /bin/sh sh -i exec stream tcp nowait root / bin / sh sh-i
哈哈，大家看最后一行，不就被绑了个rootshell么？ Haha, we read the last line, not tied up on a rootshell it? 呵呵，有什么后果？ Oh, what are the consequences? 呵呵看看，在远程的一台win2000机器上用如下命令： Oh look, in a remote win2000 machine with the following command:
E:＼cmd>nc 192.0.0.88 512 E: \ cmd> nc 192.0.0.88 512
bash# id bash # id
id id
uid=0(root) gid=0(root) groups=0(root) uid = 0 (root) gid = 0 (root) groups = 0 (root)
bash# bash #
知道了吧？ Know it? 嘿嘿，大家注意哦*^_^* Hey, we pay attention Oh *^_^*
我有写过一篇关于用这个文件绑后门的文章，呵呵，攻击性很强，这个命令可以帮你查出有没有后门，呵呵。 I have written a paper tied on the back door with this article, Oh, very aggressive, this command can help you find out there is no back door, Oh.
下个要启动的是.rc脚本，它们决定了init进程要启动哪些服务。 To start the next. Rc script, they determine what services to start the init process. redhat系统下，这些脚本在/etc/rc.d/rc3.d（如果你的系统以x为默认启动的话，就是/etc/rc.d/rc5.d）。 redhat systems, these scripts in / etc/rc.d/rc3.d (If your system to start, then x is the default is / etc/rc.d/rc5.d). 要在启动时禁止某个服务，只需要把大写的S替换为小写的s，同时，redhat也提供一个工具来帮助你关闭服务，输入/usr/sbin/setup，然后选择"system services",就可以定制系统启动时跑哪些服务。 To start a service when the ban, just need to replace the capital S-lowercase s, at the same time, redhat also provides a tool to help you close the service, enter / usr / sbin / setup, and then select the "system services", on You can customize which services run at system startup. 另外一个选择是chkconfig命令，很多linux版本的系 Another option is the chkconfig command, many versions of linux system
统都自带这个工具。 System comes with this tool. 脚本名字中的数字是启动的顺序，以大写的K开头的是杀死进程用的。 Script name is the start of the sequence numbers, beginning with a capital K is used to kill the process. 以下是一些主要的服务： Here are some key services:
S05apmd 笔记本需要 S05apmd laptop needs
S10xntpd 网络时间协议 S10xntpd Network Time Protocol
S11portmap 运行rpc服务必需 S11portmap running rpc services required
S15sound 声卡相关 S15sound sound card related
S15netfs nfs客户端 S15netfs nfs client
S20rstatd 避免运行r服务，远程用户可以从中获取很多信息 S20rstatd to avoid running the r services, remote users can access a lot of information
S20rusersd S20rusersd
S20rwhod S20rwhod
S20rwalld S20rwalld
S20bootparamd 无盘工作站 S20bootparamd diskless workstation
S25squid 代理服务 S25squid agency services
S34yppasswdd NIS服务器，此服务漏洞很多 S34yppasswdd NIS server, this service a lot of loopholes
S35ypserv NIS服务器，此服务漏洞很多 S35ypserv NIS server, this service a lot of loopholes
S35dhcpd dhcp服务 S35dhcpd dhcp service
S40atd 和cron很相似的定时运行程序的服务 S40atd and cron run the program very similar to regular service
S45pcmcia pcmcia卡，笔记本 S45pcmcia pcmcia card, notebook
S50snmpd SNMP，远程用户能从中获得许多系统信息 S50snmpd SNMP, remote user access to many system information from the
S55named DNS服务 S55named DNS service
S55routed RIP，没有必要就别运行它 S55routed RIP, there is no need to run it on the other
S60lpd 打印服务 S60lpd Print Services
S60mars-nwe Netware的文件和打印服务 S60mars-nwe Netware file and print services
S60nfs NFS服务器，漏洞极多 S60nfs NFS server, vulnerability very much
S72amd automount,mount远程用的 S72amd automount, mount the remote use of
S75gated 另外一种路由服务，例如OSPF S75gated another routing services, such as OSPF
S80sendmail 邮件服务，如关闭，仍然可以发信，只是不能收信和作中继 S80sendmail mail service, such as closing, you can still send letters, but can not be prepared to receive and relay
S85httpd web服务器 S85httpd web server
S87ypbind NIS客户端 S87ypbind NIS client
S90xfs X font服务器 S90xfs X font server
S95innd News服务器 S95innd News server
Slinuxconf 这个都熟悉吧，呵呵，通过浏览器远程管理系统用的 Slinuxconf that are familiar, huh, huh, remote management system through a browser using
用这个命令察看在关闭启动脚本之前有多少服务在运行： Use this command to turn off the startup script look at how many services are running before:
suneagle# ps -eaf|wc -l suneagle # ps-eaf | wc-l
54 54
我的系统有54种服务在运行呢，当你关闭一些服务以后，重新运行以上命令看看少了多少服务。 My system has 54 kinds of services are running it, when you turn off some of the service, re-run the above command to see how much less service. 运行的服务越少，系统自然越安全了，嘿嘿。 The fewer services running, the system naturally more secure, hehe. 用下面命令察看哪些服务在运行： With the following command to see which services are running:
suneagle# netstat -na --ip suneagle # netstat-na - ip
Active Internet connections (servers and established) Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 136 192.0.0.88:23 192.0.0.5:1236 ESTABLISHED tcp 0 136 192.0.0.88:23 192.0.0.5:1236 ESTABLISHED
tcp 0 0 192.0.0.88:23 192.0.0.8:1113 ESTABLISHED tcp 0 0 192.0.0.88:23 192.0.0.8:1113 ESTABLISHED
tcp 0 0 192.0.0.88:139 192.0.0.8:1112 ESTABLISHED tcp 0 0 192.0.0.88:139 192.0.0.8:1112 ESTABLISHED
tcp 0 0 192.0.0.88:1024 61.153.17.24:23 ESTABLISHED tcp 0 0 192.0.0.88:1024 61.153.17.24:23 ESTABLISHED
tcp 0 0 192.0.0.88:23 192.0.0.8:1084 ESTABLISHED tcp 0 0 192.0.0.88:23 192.0.0.8:1084 ESTABLISHED
tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:139 0.0.0.0: * LISTEN
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:80 0.0.0.0: * LISTEN
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:25 0.0.0.0: * LISTEN
tcp 0 0 0.0.0.0:515 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:515 0.0.0.0: * LISTEN
tcp 0 0 0.0.0.0:512 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:512 0.0.0.0: * LISTEN
tcp 0 0 0.0.0.0:98 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:98 0.0.0.0: * LISTEN
tcp 0 0 0.0.0.0:79 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:79 0.0.0.0: * LISTEN
tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:143 0.0.0.0: * LISTEN
tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:110 0.0.0.0: * LISTEN
tcp 0 0 0.0.0.0:513 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:513 0.0.0.0: * LISTEN
tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:514 0.0.0.0: * LISTEN
tcp 0 0 0.0.0.0:23 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:23 0.0.0.0: * LISTEN
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:21 0.0.0.0: * LISTEN
tcp 0 0 0.0.0.0:113 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:113 0.0.0.0: * LISTEN
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:111 0.0.0.0: * LISTEN
udp 0 0 127.0.0.1:1024 0.0.0.0:* udp 0 0 127.0.0.1:1024 0.0.0.0: *
udp 0 0 192.0.0.88:138 0.0.0.0:* udp 0 0 192.0.0.88:138 0.0.0.0: *
udp 0 0 192.0.0.88:137 0.0.0.0:* udp 0 0 192.0.0.88:137 0.0.0.0: *
udp 0 0 0.0.0.0:138 0.0.0.0:* udp 0 0 0.0.0.0:138 0.0.0.0: *
udp 0 0 0.0.0.0:137 0.0.0.0:* udp 0 0 0.0.0.0:137 0.0.0.0: *
udp 0 0 0.0.0.0:518 0.0.0.0:* udp 0 0 0.0.0.0:518 0.0.0.0: *
udp 0 0 0.0.0.0:517 0.0.0.0:* udp 0 0 0.0.0.0:517 0.0.0.0: *
udp 0 0 0.0.0.0:111 0.0.0.0:* udp 0 0 0.0.0.0:111 0.0.0.0: *
raw 0 0 0.0.0.0:1 0.0.0.0:* 7 raw 0 0 0.0.0.0:1 0.0.0.0: * 7
raw 0 0 0.0.0.0:6 0.0.0.0:* 7 raw 0 0 0.0.0.0:6 0.0.0.0: * 7
呵呵，我这个系统由于测试用，所以故意开了不少危险端口，呵呵，大家别学我哦，该关的就关啦，哈哈。 Oh, I tested with this system because so many dangerous deliberately opened port, Oh, we do not learn from me Oh, the customs of the customs, ha ha.
3，日志纪录和增强 3, the log records and enhance the
关闭一些不必要的服务以后，日志也是需要我们关心的一块，配置好的unix系统日志非常强大，甚至可以做出陷阱，关于日志，我可以写长篇大论，这里就不很详细讲述日志的原理了，感兴趣的朋友可以参考相关资料或阅读我的另一篇文章《solaris系统日志原理》。 After some unnecessary services turned off, the log is the one we need to care about, configured very powerful unix system log, or even make a trap, on the log, I can write at length, there is not very detailed about the principles of the log, interested friends can refer to the relevant information or read my other article "solaris system log works." 好！ Good! 所有的日志都在/var/log下（仅对linux系统而言），默认情况下linux的日志就很强大了，除了ftp。 All the logs are in / var / log under (only linux system), by default, the log of linux is very strong, in addition to ftp. 但我们可以通过修改/etc/ftpaccess或者/etc/inetd.conf，来保证每一个ftp连接日志都能够纪录下来。 But we can modify the / etc / ftpaccess or / etc / inetd.conf, to ensure that each ftp connection log can record down. 下面是一个修改inetd.conf的例子： Here is an example of a modified inetd.conf:
ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -L -i -o ftp stream tcp nowait root / usr / sbin / tcpd in.ftpd-l-L-i-o
-l 每一个ftp连接都写到syslog -L Each ftp connections are written to the syslog
-L 纪录用户的每一个命令 -L command to record the user's every
-i 文件received,纪录到xferlog -I file received, record the xferlog
-o 文件transmitted,记录到xferlog -O file transmitted, recorded in the xferlog
账号的安全问题 Account of security issues
删除/etc/passwd&/etc/shadow中的一些系统账号，如mail,news等等。 Delete / etc / passwd & / etc / shadow account in some systems, such as mail, news and more. 尽量关闭匿名ftp服务，删掉ftp用户。 Try to turn off anonymous ftp, delete the ftp user.
/etc/ftpusers文件，包含了不能使用ftp的用户列表，root应该在其中。 / Etc / ftpusers file contains a list of users can not use ftp, root should be in them.
修改/etc/securetty，去除终端ttyp0-ttyp9，使root只能从console或者使用ssh登陆。 Modify / etc / securetty, remove the terminal ttyp0-ttyp9, so that root can only login from the console or using ssh. /etc/issue，不要让次文件透露系统信息。 / Etc / issue, do not let the sub-file to disclose system information. 同时要修改/etc/rc.d/rc/local。 At the same time to modify / etc / rc.d / rc / local. SUID程序是非常危险的，这些程序被普通用户以euid=0（即root）的身份执行，只能有少量程序被设置为SUID。 SUID programs are very dangerous, these programs are ordinary users to euid = 0 (ie root), as implemented, only a small amount of the program is set to SUID. 用一下命令列出系统的SUID二进制程序： What command to list with the SUID binaries:
suneagle# find / -perm -4000 -print suneagle # find /-perm -4000-print
用chmod -s去掉一些不需要程序的suid位。 Use chmod-s remove some unwanted program suid bit.
4，连接服务器 4, the Connection Server
作为系统管理员，需要经常对系统进行关系和上传文件，这些通过通信过程必须要保证是安全的。 As a system administrator, the system requires frequent relations and upload files, which through the communication process must be guaranteed to be safe. 我介绍两个方法：ssh和tcp wrappers。 I introduced two ways: ssh and tcp wrappers.
其实我比较偏向于用ssh，它把你和防火墙之间的通信全部进行了加密，而tcp wrappers没有做到加密一点，呵呵虽然现在先进的sniffer技术也可以嗅探到ssh的数据包，但它依然还是最安全的。 In fact, I am more biased in favor of using ssh, it is the communication between you and the firewall all encrypted, and encrypted tcp wrappers do not do that, huh, huh Although sniffer technology can be advanced to the ssh packet sniffer, but it is still the safest. 建议用ssh完全取代telnet/ftp，它能够确保数据在网络中的安全传输。 Proposed to use ssh completely replace telnet / ftp, it can ensure the security of data transmission in the network. ssh和tcpwrapper都有它们自己的日志纪录，并设有访问控制策略，大家如果要深入了解ssh的话，可以参考想关书籍。 ssh and tcpwrapper have their own log records, and has access control policy, we understand if you want to ssh, you can refer to the relevant books.
tcpwrappers尽管没有对数据进行加密，但它有日志系统并且可以控制哪些人可以访问你的系统，它在inetd中包装了其他的二进制文件，如telnet,ftp,finger等等。 tcpwrappers Although there is no encryption of data, but it has a log system and can control who can access your system, it is packed in the inetd in other binary files, such as telnet, ftp, finger, and so on. 系统用tcpwrapper进行inetd监听连接，记录了所有请求并且与访问控制列表作比较，如果允许连接，tcpwrapper将调用实际的服务器进程来连接，如in.telnetd服务，如果拒绝，连接将断开。 Monitoring system with tcpwrapper for inetd connections, logs all requests and compared with the access control list, if allowed to connect, tcpwrapper calls to connect to the actual server process, such as in.telnetd service, if rejected, the connection will be disconnected. 对linux用户比较幸运的是tcpwrapper已经被默认安装了，我们所要做的就是编辑/etc/hosts.allow和/etc/hosts.deny两个文件，注意以下事项： Fortunately for users of linux is tcpwrapper is installed by default, we have to do is edit / etc / hosts.allow and / etc / hosts.deny two files, note the following:
1，尽量使用ip 1, to make use of ip
2，首先通过/etc/hosts.deny禁止来自任何地方对所有服务的访问：ALL:ALL 2, first through the / etc / hosts.deny prohibited from any place access to all services: ALL: ALL
然后在/etc/hosts.allow中添加要授权的机器及服务。 Then in / etc / hosts.allow add the machine to be authorized and services. 冒号左边为服务，冒号右边为授权机器。 Colon on the left for the service, right of the colon as an authorized machine.
5，加固系统 5, the reinforcement system
一上的措施足以应付一般的网络攻击，但你的系统不是100%安全的，从来就没有绝对安全的系统，不是么？ An adequate measure on the general network attacks, but your system is not 100% safe, never absolutely secure system, is not it? 嘿嘿。 Hey. 我们来进一步加固系统！ To further strengthening our system!
编辑/etc/groups，增加wheel组（其实我很喜欢freebsd的地方，就是默认freebsd这些工作做的很好）。 Edit / etc / groups, to increase the wheel group (in fact I like freebsd place, is the default freebsd these do well). 这个组包含了一些用户，可以执行/bin/su等强大的命令。 This group contains a number of users can execute / bin / su so powerful command. 对其他用户执行这些命令的控制，可以改善系统的安全。 Execute these commands for other users to control, can improve system security. 如下命令： The following command:
suneagle# /bin/chgrp wheel /bin/su suneagle # / bin / chgrp wheel / bin / su
suneagle# /bin/chmod 4750 /bin/su suneagle # / bin / chmod 4750 / bin / su
然后锁定一些文件：.rhosts,.netrc,/etc/hosts.equiv。 Then lock some files:. Rhosts,. Netrc, / etc / hosts.equiv. r命令可以通过这些文件远程连入你的系统。 r command can be remotely connected to these files on your system. 先touch这些文件，然后chmod至0。 First touch these files, and then chmod to 0.
suneagle# /bin/touch /root/.rhosts /root/.netrc /etc/hosts.equiv;/bin/chmod 0 /root/.rhosts /root/.netrc /etc/hosts.equiv suneagle # / bin / touch / root / .rhosts / root / .netrc / etc / hosts.equiv; / bin / chmod 0 / root / .rhosts / root / .netrc / etc / hosts.equiv
linux还有一个众所周知的命令：chattr，呵呵+i操作，即使是root，也在-i之前改不了它们，先在你的系统的/etc/shadow,/etc/inetd.conf等文件来个chattr +i可以避免一下exploit给你添后门什么的，呵呵。 There is also a well-known linux command: chattr, Oh + i operation, even root, before also-i can not change them, first in your system's / etc / shadow, / etc / inetd.conf and other documents to a chattr + i can avoid what you add to the back door exploit what, huh, huh.
bash的问题 bash problem
对于bash用户来讲，有个.bash_history文件，可以记录你的所用的命令，谁也不希望其他人包括root知道自己敲了哪些命令吧？ For bash users, there is. Bash_history file, you can record the commands used, including other people who do not want to knock root know what command it? 我有两种方法来解决这个问题 I have two ways to solve this problem
1，在自己的.bash_profile文件中加入一行： 1, in their own. Bash_profile file to add the line:
HISTFILESIZE=0 HISTFILESIZE = 0
记住不要把HISTSIZE置零，那样就无法使用上下健来调用历史命令了。 Remember not to HISTSIZE zero, so it can not be used to call up and down the health history of commands.
2，删除自己目录下的.bash_history，然后建立一个连接： 2, to delete their own directory. Bash_history, and then establish a connection:
suneagle$ ln -s /dev/null $HOME/.bash_history suneagle $ ln-s / dev / null $ HOME / .bash_history
这样，大家理解吧？ In this way, we understand it? 历史命令都掉到黑洞洞里啦~~~~~ In the command fell to the dark history of friends ~~~~~
最后，保证物理安全，建立在/etc/lilo.conf中设置密码来控制linux的启动，呵呵，虽然也是可以被破解的，嘿嘿，因为它是明文存放，破解方法吗，知者知之，不知者就不知啦，嘿嘿。 Finally, to ensure physical security, based on the / etc / lilo.conf to set passwords to control the linux boot, huh, huh, although also can be cracked, hey, since it is explicitly stored, crack method you, know who know it, I do not know who to know you, hey.
ok，写了这么多，大概把安全性讲了一下，算是可一个不错的入门教材。 ok, so much to write about the security talk a little, can be regarded as a good primer.
Tidak ada komentar:
Posting Komentar