01_불 필요한 계정 삭제

불 필요한 계정 삭제

<!--[if !supportEmptyParas]--> <!--[endif]-->

<!--[if !supportEmptyParas]--> <!--[endif]-->

<!--[if !supportEmptyParas]--> <!--[endif]-->

<!--[if !supportEmptyParas]--> <!--[endif]-->

[실습] lastlog 명령어에 대해서

<!--[if !supportEmptyParas]--> <!--[endif]-->

# cat /etc/passwd

root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin news:x:9:13:news:/etc/news: uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin gopher:x:13:30:gopher:/var/gopher:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin distcache:x:94:94:Distcache:/:/sbin/nologin nscd:x:28:28:NSCD Daemon:/:/sbin/nologin vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin pcap:x:77:77::/var/arpwatch:/sbin/nologin ntp:x:38:38::/etc/ntp:/sbin/nologin dbus:x:81:81:System message bus:/:/sbin/nologin apache:x:48:48:Apache:/var/www:/sbin/nologin avahi:x:70:70:Avahi daemon:/:/sbin/nologin rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin named:x:25:25:Named:/var/named:/sbin/nologin mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin hsqldb:x:96:96::/var/lib/hsqldb:/sbin/nologin sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin webalizer:x:67:67:Webalizer:/var/www/usage:/sbin/nologin dovecot:x:97:97:dovecot:/usr/libexec/dovecot:/sbin/nologin squid:x:23:23::/var/spool/squid:/sbin/nologin rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin haldaemon:x:68:68:HAL daemon:/:/sbin/nologin avahi-autoipd:x:100:101:avahi-autoipd:/var/lib/avahi-autoipd:/sbin/nologin gdm:x:42:42::/var/gdm:/sbin/nologin sabayon:x:86:86:Sabayon user:/home/sabayon:/sbin/nologin user01:x:500:500::/home/user01:/bin/bash user02:x:501:501::/home/user02:/bin/bash user03:x:502:502::/home/user03:/bin/bash

-> 기본 계정에 대해 확인한다.

-> 시스템 계정은 root 사용자를 제외하고 일반적으로 로그인이 가능하지 않는다.

-> 100번 이하 계정은 운영체제를 위해 서비스를 위해 존재하는 사용자유닉스에서는 삭제시 문제생길 우려가 있음.

프로그램이 없는데 사용자가 있으면 그건 삭제하는 것이 좋다.

<!--[if !supportEmptyParas]-->(관리대상)/sbin/nologin 시스템 어카운트 사용자는 로그인 할 수 없다. 

<!--[endif]-->

UID번호가 500 이상 사용자는 일반 사용자이다.

(일반 사용자)

# awk -F: '$3 > 499 && $3 < 60000 {print $1}' /etc/passwd

(시스템 사용자)

# awk -F: '$3 < 500 {print $1}' /etc/passwd

<!--[if !supportEmptyParas]--> <!--[endif]-->

<!--[if !supportEmptyParas]--> 

<!--[if !supportEmptyParas]--> <!--[endif]-->

# man lastlog

NAME lastlog - reports the most recent login of all users or of a given user <!--[if !supportEmptyParas]-->          가장 최근에 기록을 reports 해준다.<!--[endif]--> SYNOPSIS lastlog [options] <!--[if !supportEmptyParas]--> <!--[endif]--> DESCRIPTION lastlog formats and prints the contents of the last login log /var/log/lastlog file. The login-name, port, and last login time will be printed. The default (no flags) causes lastlog entries to be printed, sorted by their order in /etc/passwd. ..... (중략) .....

<!--[if !supportEmptyParas]-->시스템에 존재하는 사용자만 출력한다. /var/log/lastlog 

<!--[endif]-->

# lastlog --help

Usage: lastlog [options] <!--[if !supportEmptyParas]--> <!--[endif]--> Options: -b, --before DAYS print only lastlog records older than DAYS -h, --help display this help message and exit -t, --time DAYS print only lastlog records more recent than DAYS -u, --user LOGIN print lastlog record for user with specified LOGIN

<!--[if !supportEmptyParas]--> <!--[endif]-->

# lastlog

Username Port From Latest root pts/2 192.168.20.50 Mon Sep 15 21:49:58 +0900 2014 bin **Never logged in** daemon **Never logged in** adm **Never logged in** lp **Never logged in** sync **Never logged in** shutdown **Never logged in** halt **Never logged in** mail **Never logged in** news **Never logged in** uucp **Never logged in** operator **Never logged in** games **Never logged in** gopher **Never logged in** ftp **Never logged in** nobody **Never logged in** distcache **Never logged in** nscd **Never logged in** vcsa **Never logged in** pcap **Never logged in** ntp **Never logged in** dbus **Never logged in** ..... (중략) ..... squid **Never logged in** rpcuser **Never logged in** xfs **Never logged in** haldaemon **Never logged in** avahi-autoipd **Never logged in** gdm **Never logged in** sabayon **Never logged in** user01 **Never logged in** user02 **Never logged in**  <-- 불필요한 사용자들 user03 **Never logged in**

-> 시스템 계정인데 최근에 로그인이 되었던 사용자가 있거나

-> 일반 사용자인데 최근에 로그인한 기록이 없다면

-> 이상이 있다고 볼수도 있다. 따라서 자세하게 점검해 봐야 한다.

[실습] lastb 명령어에 대해서

<!--[if !supportEmptyParas]--> <!--[endif]-->

# man lastb

NAME last, lastb - show listing of last logged in users <!--[if !supportEmptyParas]-->                 마지막 로그인한 정보 listing(주로 로그인 실패 기록 출력)<!--[endif]--> SYNOPSIS last [-R] [-num] [ -n num ] [-adiowx] [ -f file ] [ -t YYYYMMDDHH- MMSS ] [name...] [tty...] lastb [-R] [-num] [ -n num ] [ -f file ] [-adiowx] [name...] [tty...] <!--[if !supportEmptyParas]--> <!--[endif]--> DESCRIPTION Last searches back through the file /var/log/wtmp (or the file des- ignated by the -f flag) and displays a list of all users logged in (and out) since that file was created. Names of users and tty’s can be given, in which case last will show only those entries matching the arguments. Names of ttys can be abbreviated, thus last 0 is the same as last tty0. ..... (중략) .....

<!--[if !supportEmptyParas]--> 

<!--[endif]-->

[TERM2] 모니터링 터미널

# while true (# watch lastb)

> do

> echo "------------`date`-----------"

> lastb | head

> sleep 2

> done

user01 ssh:notty localhost.locald Tue Sep 16 08:45 - 08:45 (00:00)

user01 ssh:notty localhost.locald Tue Sep 16 08:45 - 08:45 (00:00)

user01 ssh:notty localhost.locald Tue Sep 16 08:45 - 08:45 (00:00)

<!--[if !supportEmptyParas]--> <!--[endif]-->

# ssh user01@localhost

user01@localhost's password: (1) Permission denied, please try again. user01@localhost's password: (2) Permission denied, please try again. user01@localhost's password: (3) Permission denied (publickey,gssapi-with-mic,password).

-> 잘못된 암호 입력

<!--[if !supportEmptyParas]--> <!--[endif]-->

<!--[if !supportEmptyParas]--> <!--[endif]-->

일정한 시간안에 반복적으로 로그인이 실패하는 기록이 남겼졌을 때는 외부의 공격인지 확인해야 한다.

<!--[if !supportEmptyParas]--> <!--[endif]-->

<!--[if !supportEmptyParas]--> <!--[endif]-->

<!--[if !supportEmptyParas]--> <!--[endif]-->

<!--[if !supportEmptyParas]--> <!--[endif]-->

<!--[if !supportEmptyParas]--> <!--[endif]-->

<!--[if !supportEmptyParas]--> <!--[endif]-->