没有合适的资源?快使用搜索试试~ 我知道了~
首页黑客手册2015:提升Linux技能与网络安全
"《黑客手册》(The Hacker's Manual)于2015年发布,是一本专注于个人网络和系统安全技术的专业指南。本书特别强调了将Linux技能提升到更高层次,提供了超过80种黑客技巧,旨在使读者成为Linux高手,涵盖从基础安全策略到系统管理员秘籍以及硬件改造等多方面内容。它强调的是完全修订和更新后的版本,适应了2014年的技术发展,汇集了最优质的Linux教程,共计146页。 书中涉及的主题广泛,包括网络安全、隐私保护,着重指出这些技巧在法律框架内是安全且合法的。尽管黑客一词常与犯罪活动关联,但本书澄清了其最初的含义,源自1960年代麻省理工学院(MIT),最初是指顶尖程序员群体,他们精通Fortran等编程语言,并以其突破性成就闻名,常常令人惊叹。 作为一本教程书籍,《黑客手册》不仅传授技术知识,还帮助读者理解如何运用这些技术来提高个人电脑操作效率和安全性,而不局限于负面的刻板印象。通过阅读这本书,用户可以提升自己的Linux技能,同时掌握网络安全实践,确保在数字化世界中既能保护自己,又能合法地探索技术的边界。 该书适合对Linux和系统安全感兴趣的读者,无论是初学者还是经验丰富的开发者,都能从中受益。如果你对黑客技巧、Linux技术和安全防护感兴趣,这本书将是你的理想选择。同时,它也提供了一个平台,让读者在享受黑客精神的纯粹创新精神的同时,保持在法律和道德的边界内。购买《黑客手册》,让你的技能和知识得到升华,迎接一个全新的黑客世界。"
资源详情
资源推荐
![](https://csdnimg.cn/release/download_crawler_static/9179921/bg10.jpg)
16
Secure VPS
Stay thy LAMP stack-installing hand a moment while
we give you a primer on virtual private server security.
irtual servers are cheap. In fact,
with a few usage provisos, you
can get one from Amazon for
free and having your own virtual
server is a great way to learn
about all the responsibilities,
pitfalls and street credits
associated with remotely
administering your own
internet-facing box, without
having to worry about failing
hardware and hefty server bills.
Except for Amazon’s free usage tier, the
cheapest virtual machines (VMs) out there run
on what’s known as operating system-level
virtualisation technology. The most abundant
example is
OpenVZ
(
Open Virtuozzo
), which
runs a modified Linux kernel that’s shared
among all the guest OSes (
OpenVZ
only
supports Linux guests, but why would you
want anything else?).
OpenVZ
is close to being an example of a
hosted (Type 2) hypervisor, since it runs inside
a conventional OS. However, purists would
argue that it doesn’t really do true
virtualisation, but rather
containerisation – being more
akin to supervising a bunch of
chroot environments rather
than actual OSes. Incidentally,
the etymology behind the word
hypervisor relates to the fact
that operating systems were once referred to
as ‘supervisors’. Hence, a hypervisor is a
supervisor of supervisors.
“Hypervisor relates to the fact
that operating systems were
once referred to as supervisors.”
![](https://csdnimg.cn/release/download_crawler_static/9179921/bg11.jpg)
If you require a greater level of guest
isolation, then you should direct your attention
towards a bare metal (or Type 1) hypervisor,
such as
VMWare
or
Xen
. This model enables
your guest OSes to run their own kernels,
so you can run whatever you like. The
hypervisor itself is fairly minimal and handles
all the low-level hardware shenanigans.
In order to be of any use to guest OSes,
a control domain (dom0) needs to be running
on top of the hypervisor. This is a privileged
VM running a
Xen
-enabled kernel which
manages all the lesser guests (unprivileged
domains) and provides an interface for them
to interact with hardware. The Linux kernel
supports
Xen
, but one can also use NetBSD or
OpenSolaris as the control stack. We should
also mention
KVM
here, which does an
excellent job of obscuring the boundary
between Type 1 and Type 2. Once the
KVM
module is loaded, the host OS becomes a
hypervisor; a virtualiser, such as
Qemu
can
then utilise it to run any OS compatible with
the host's CPU architecture. In fact,
Qemu
can
virtualise x86, PowerPC and S/390 guests,
but there’s a performance cost when
emulating foreign architectures. Guests fall
into two camps:
Paravirtualisation (PV) This requires a
PV-aware kernel, so the guest knows that it’s
running on imaginary hardware.
Hardware-assisted Virtualisation (HVM)
Paravirtualisation’s counterpart, HVM – or full
virtualisation – requires a CPU with
virtualisation extensions which mitigates the
performance penalty associated with tricking
the Guest OS by emulating BIOS and other
hardware. To further complicate matters, fully
virtualised guests can be partially
paravirtualised through so-called ‘PV-on-HVM’
drivers, so that I/O can be accelerated and
grey areas introduced.
Whatever path you go down, after a quick
and easy credit card payment you will be
provided with a hostname/IP address and
password. You will then be able to ssh into
your new appliance with full root access:
$ ssh root@host
There are a few initial things you should
take care of, just as when you install a new OS
on an actual machine. Some of these might be
Disclaimer
Cheap VPS servers are definitely not a good
idea for conducting any mission-critical
operations or storing any data that is remotely
sensitive. In this guide we do some rudimentary
hardening, but this won't make you bulletproof.
Sound advice is to not run services you don't
need/understand and update everything
regularly. Almost by design, there will always be
some room for mischief. There are attack
vectors outside of the VM itself: a kernel-level
exploit on an
OpenVZ
setup could compromise
any virtual machine running there, or there may
be a vulnerability inside your hosting provider's
control panel – or any of their infrastructure for
that matter.
Be aware, also, that there are many fly-by-
night types operating in this budget sector, often
overselling appliances through many levels of
resellers. Some of them have fancy websites,
but do not be deceived. Find some reviews and
remember the old adage: if something sounds
too good to be true, then it probably is.
And don't expect much help either. You have
to do reinstalls and reboots yourself through
cPanel
or (for the more impecunious)
SolusVM
.
Although most providers have a ticket system
for technical support, this is usually only for help
at the hardware and OS image levels. Don't
expect them to tell you why your PHP script is
running slowly or how to set up
Apache
.
already done for you – it depends on the
amount of effort put into whatever image
you're using. So you should check /etc/
hostname, /etc/locale.gen, /etc/hosts
(etc) and set up your timezone. It’s sometimes
best to set this to UTC as it befits the virtual
nature of the whole affair:
$ ln -sf /usr/share/zoneinfo/UTC /etc/
localtime
Now you should set
up a normal user, as
being root all the time
is not a particularly
good idea:
$ useradd -m -G
wheel user
Replace user with
your preferred handle. Here we have added
ourselves to the wheel group, which lets us
use su to become root. If you would rather use
sudo, then the -G wheel part is not necessary
– instead you will need to use visudo.
Securing Secure Shell
Although you might have a good memory and
a secure password, it’s preferable to go one
step further and create a keypair to
authenticate with
ssh
and disable password
logins altogether. The public key is stored on
the server and you should keep your private
key somewhere safe and ideally not make any
Elliptic Curve Crypto is so advanced that you can get away with much shorter key lengths
(256, 384 and 521 bits versus 1,024, 2,048, 3,072 or 4,096 for RSA).
copies of it. If you do lose it, most VPSes will
allow you to log in through a serial console and
fix things. You can generate the keypair on
your local machine by running:
$ ssh-keygen
You will be prompted for a filename for the
private key, and then again for a passphrase.
If you envisage having lots of different keys for
many different servers, then it’s a good idea to
change the default filename to include the
relevant hostname. Otherwise, the default
~/.ssh/id_rsa is probably fine. The public key
will be generated in the same place with a
.pub suffix. Note the pretty random art image
associated with the key: these can be useful if
you find yourself comparing keys at any point.
By default,
ssh-keygen
produces a 2,048-bit
RSA keypair which should be fine for all but
the most paranoid. There are plenty of options
though, so you could also make a 521-bit
Elliptic Curve pair with:
$ ssh-keygen -t ecdsa -b 521
You then copy the key to your server with:
17
“Qemu can virtualise x86,
PowerPC and S/390, but
there’s a performance cost.”
Secure VPS
![](https://csdnimg.cn/release/download_crawler_static/9179921/bg12.jpg)
$ ssh-copy-id user@host
Replace user and host with the user you
set up before and the address of your VPS.
This will append your public key to the file
~/.ssh/authorized_keys on the remote host.
If you do have to copy your private key, make
sure that its permissions (600) are preserved,
otherwise you will found yourself castigated
for insecure practices.
Now test your freshly baked key. If you kept
the default filename then you don't need any
special syntax, otherwise you'll have to use the
-i (identity file) option:
$ ssh -i ~/.ssh/private_key user@host
If all has gone according to plan, you
should be prompted for the passphrase for
your private key and allowed to log in. With
that done, we can change the following lines in
sshd_config on our server to disable
password authentication, the legacy v1
protocol and login by anyone other than user,
and optionally change the port from the
default 22:
Port 2022
Protocol 2
PasswordAuthentication no
AllowUsers user
Now we restart the
SSH server. If you are
using the trusty
Sysvinit scripts, this is
simply just a matter of
becoming root and
running the command
$ /etc/init.d/sshd restart
or for Systemd:
$ systemctl restart sshd
Now the only people that can log in are
those in possession of our key file. The server
is now also running on a different port, which
may deter some script kiddies, but also
means you have to point your SSH client
appropriately:
$ ssh user@host:2022
You can use
ssh-agent
to keep this key
unlocked for the duration of your local session,
which is a handy labour-saving device,
although it comes at a small privacy cost.
This is achieved with:
$ ssh-add ~/.ssh/private_key
If you are running some sort of Proper
Desktop Environment, or have otherwise
figured out how to shoehorn Gnome Keyring
or some such onto your system, then you can
even automatically unlock and load your key
into memory upon login. Again, it's handy but
potentially insecure.
It’s worth considering tunnelling any
services you run explicitly for you or your
authorised users over an SSH connection.
For example, if you are running a VNC server,
then rather than exposing it to the outside
world, configure it to listen only on the local
loopback address. VNC's default port is 5900,
so when we ssh from our local machine we
forward this port to 5901 like so:
$ ssh -L 5901:localhost:5900 user@host:2022
The part after the first colon is relative to
the remote machine – we are forwarding its
port 5900 to our 5901. Providing that the
localhost alias is set up correctly in your
server's hosts file, you can now tell the VNC
client to connect to your local machine on
port 5901 (or display :1 in VNC parlance).
All going well, you should have a working VNC
session and that fuzzy warm feeling that
comes when all your clicks and keystrokes are
being sent over an encrypted channel.
Playing with fire(walls)
Setting up an iptables-based firewall is our
next challenge. The iptables program filters
packets based on rules, which exist in a table
called filter and are grouped into three chains:
INPUT for incoming packets, OUTPUT for
outgoing packets and FORWARD for more
advanced routing, with which we shall not
concern ourselves. Likewise the other tables
mangle and nat. Each chain has a default
policy, which is usually to accept all packets.
Besides accepting them, we also have the
target REJECT to vocally dismiss the
connection, and DROP to silently ignore the
Such AWStats. Much graph. Very comprehensive. Wow.
18
Secure VPS
Full lockdown
Filtering outgoing packets is really only for the paranoid, but if the tinfoil hat demands it here is a
quick summary of traffic you will probably want to allow before the big ol' REJECT rule.
Loopback traffic Similar to incoming rules, use -o lo -j ACCEPT
DNS
TCP and UDP on port 53.
NTP UDP port 123
HTTP(S) TCP on ports 80 & 443
FTP
TCP on port 21 (Active FTP will initiate an incoming connection
from the server’s port 20, but our established/related rule on the
INPUT chain should take care of that)
git TCP 9418
ping
ICMP use --icmp-type 8 (echo) as in incoming rules
If you really want to fulfil the ultimate control freak sysadmin stereotype, then it’s possible to log
all the packets that iptables rejects, but this can very quickly lead to oversized log files and full
disks, which will be much more of a problem for you than someone scanning your box for
non-existent SMB shares.
“Consider tunnelling
services you run explicitly
for you over SSH.”
![](https://csdnimg.cn/release/download_crawler_static/9179921/bg13.jpg)
packets. The latter is good for evading
detection, but annoying for diagnosing issues.
You can examine your current iptables rules
by running the following as root:
$ iptables -L
Let's start with a tabula rasa by purging all
currently operational rules (even though there
properly aren't any) and any extra chains:
$ iptables -F
$ iptables -X
While it’s tempting to lock down everything
here, and indeed an overly permissive firewall
is not a good idea, it will be beneficial to
concede that connection establishment and
packet filtering are more complicated than
you might think. It would, after all, be very
embarrassing if you locked yourself out of
your own machine.
Our first two handy rules deal with traffic
on the local interface. A lot of programs talk to
each other this way, but we don't allow traffic
to access lo from the outside world. The third
rule conveniently allows all connections that
are currently established and any further
connections which they engender. That should
save you some heartache – you generally
want to let in packets from the services to
which you connect.
$ iptables -A INPUT -i lo -j ACCEPT
$ iptables -A INPUT ! -i lo -d 127.0.0.0/8 -j
REJECT
$ iptables -A INPUT -m state --state
ESTABLISHED, RELATED -j ACCEPT
Now we ensure incoming SSH connections
will not get summarily squashed:
$ iptables -A INPUT -p tcp --dport 2022 -j
ACCEPT
The -A option indicates that we are
appending this rule to the input chain, so that
it is processed after all the other rules. We
could also use -I INPUT 1 to insert this rule at
the top of the chain.
It’s also nice to enable your server to
accept – and subsequently respond to –
ping requests:
$ iptables -A INPUT -p icmp -m icmp --icmp-
type 8 -j ACCEPT
And if you run a web server then you will
want to allow http and https traffic:
$ iptables -A INPUT -p tcp --dport 80 -j
ACCEPT
$ iptables -A INPUT -p tcp --dport 443 -j
ACCEPT
Now it should be safe to reject all other
incoming packets:
$ iptables -A INPUT -j
REJECT
The rules for each
of the chains are
processed
sequentially, so that
any incoming packet that do not match any of
the earlier rules is rejected.
We have to save our iptables rules and
ensure they are restored when/if you reboot.
Exactly how you do this depends on your
distro/init system. For some, the iptables-
save command outputs the current rules to
stdout, and for Systemd iptables.service
loads the rules from /etc/iptables/iptables.
rules, so the following will suffice:
$ iptables-save > /etc/iptables/iptables.rules
$ systemd enable iptables
For Debian, the standard method is to save
the rules per the above and then create the file
/etc/network/if-pre-up.d/iptables with:
#! /bin/sh
/sbin/iptables-restore < /etc/iptables/iptables.
rules
Hopefully, your chances of getting owned have
now been diminished. Exactly what you do
from now on is up to you – not doing anything
is pointless, but your VPS provider would
probably approve. Having your Dropbox folder
accessible on your server is sometimes handy,
for instance, but on the other hand that might
result in the proprietary chills, so why not set
up an
OwnCloud
server (
See p78
)? Or how
about subscribing to
Linux Format
and learn
how to set up a simple
Nginx
[see the
archives, LXF188] or
Lighttpd
web server?
And then getting it to serve usage stats using
the great AWStats? Whatever you do, be
mindful of security, but if you do get hacked
then starting over is trivial. Q
With logging turned on we can see all the noisy broadcasts around us that we are ignoring.
If you want to stay sane, don’t try to understand the pricing structure for EC2 instances.
19
“DROP: Good for evading
detection, but annoying for
diagnosing issues.”
Secure VPS
![](https://csdnimg.cn/release/download_crawler_static/9179921/bg14.jpg)
20
Privacy
SIGN OUT
+ You Search Images Maps Play YouTube News Gmail Drive Calendar
Advertising Business About
Privacy & Terms Settings Google.com
W
e are using the cloud more
and more. As internet
connections get faster and
more reliable, the
convenience of having all our data available
on all our devices becomes ever more
attractive. However, there are
disadvantages to using cloud services,
particularly the free of charge ones that
still have to make a profit somehow.
There are many valid, albeit scary,
questions you’ll want to mull over before
trusting a third party to keep your data
safe, and we’ve listed them below. The answers,
as you will discover in this feature, are generally
not what you want to hear.
Privacy Is your data stored or is it mined for
advertising and marketing purposes?
Reliability Can you be certain that the
service you’re using will always be available?
What guarantees do you have regarding the
safety of your data and is there anything you
can do to improve this?
Security Is your data encrypted? Who has
access to the encryption keys? Could your data
be hacked or stolen?
Continuity Can the cloud provider suspend
or cancel your account, possibly even losing all
your data, for any reason?
Performance Is your internet connection fast
enough to use the services that you want
without delays?
Copyright Who owns the content you
upload? Can your photos be sold or published
without your consent?
While a large company’s security and back-
up policies are likely to be better designed and
implemented than your own, you still have the
questions about what they can do with your
data. You may feel that allowing them to
parse emails to provide more relevant
advertising, which you may or may not
ignore, is a fair price for a free service.
On the other hand, you may want to keep
private emails just that, and if you are
using email for business, you’ve even
more concerns. You are not only responsible for
your own data but that of organisations you
deal with. You may also be concerned about
keeping private information within your private
network, not only for commercial secrecy but
also data protection and preserving the privacy
of the people an organisation deals with.
I’m getting out of hereGoogle Search
Liberate your personal data from companies that want to nose
through your emails, photos and friends and take over your life.
Escape
“What guarantees do
you have regarding the
safety of
your data?”
And Facebook Twitter Flickr + more!
剩余145页未读,继续阅读
![rar](https://img-home.csdnimg.cn/images/20210720083606.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://profile-avatar.csdnimg.cn/default.jpg!1)
lj113
- 粉丝: 0
- 资源: 1
上传资源 快速赚钱
我的内容管理 展开
我的资源 快来上传第一个资源
我的收益
登录查看自己的收益我的积分 登录查看自己的积分
我的C币 登录后查看C币余额
我的收藏
我的下载
下载帮助
![](https://csdnimg.cn/release/wenkucmsfe/public/img/voice.245cc511.png)
最新资源
- 计算机人脸表情动画技术发展综述
- 关系数据库的关键字搜索技术综述:模型、架构与未来趋势
- 迭代自适应逆滤波在语音情感识别中的应用
- 概念知识树在旅游领域智能分析中的应用
- 构建is-a层次与OWL本体集成:理论与算法
- 基于语义元的相似度计算方法研究:改进与有效性验证
- 网格梯度多密度聚类算法:去噪与高效聚类
- 网格服务工作流动态调度算法PGSWA研究
- 突发事件连锁反应网络模型与应急预警分析
- BA网络上的病毒营销与网站推广仿真研究
- 离散HSMM故障预测模型:有效提升系统状态预测
- 煤矿安全评价:信息融合与可拓理论的应用
- 多维度Petri网工作流模型MD_WFN:统一建模与应用研究
- 面向过程追踪的知识安全描述方法
- 基于收益的软件过程资源调度优化策略
- 多核环境下基于数据流Java的Web服务器优化实现提升性能
资源上传下载、课程学习等过程中有任何疑问或建议,欢迎提出宝贵意见哦~我们会及时处理!
点击此处反馈
![](https://img-home.csdnimg.cn/images/20220527035711.png)
![](https://img-home.csdnimg.cn/images/20220527035711.png)
![](https://img-home.csdnimg.cn/images/20220527035111.png)
安全验证
文档复制为VIP权益,开通VIP直接复制
![](https://csdnimg.cn/release/wenkucmsfe/public/img/green-success.6a4acb44.png)