在redhat linux家族系列上
第一步确定系统:cat /etc/redhat-release
Red Hat Enterprise Linux AS release 4 (Nahant Update 4)
第二步确定主机的名称和IP以及其他网络设置
[root@localhost t]# cat etc/hosts
127.0.0.1 apollo.honeyp.edu apollo localhost.localdomain localhost
[root@localhost t]#
[root@localhost t]# cat etc/sysconfig/network
NETWORKING=yes
HOSTNAME=apollo.honeyp.edu
GATEWAY=172.16.1.254
DEVICE=eth0
BOOTPROTO=static
BROADCAST=172.16.1.255
IPADDR=172.16.1.107
NETMASK=255.255.255.0
NETWORK=172.16.1.0
ONBOOT=yes
第三步查看系统上谁曾经登陆过用的命令是
[root@localhost t]# last -f var/log/wtmp
root tty1 Thu Nov 9 10:37 gone - no logout
wtmp begins Wed Nov 8 22:59:52 2000
[root@localhost t]#
这里已经被入侵内者给清除痕迹了。
第四步查看谁曾经登陆过和从哪里过来的
[root@localhost t]# cat var/log/secure
Nov 5 10:54:49 apollo in.telnetd[680]: connect from 207.239.115.11
Nov 6 02:59:23 apollo in.ftpd[973]: connect from 128.121.247.126
Nov 8 00:08:40 apollo in.telnetd[2077]: connect from 216.216.74.2
Nov 8 00:08:40 apollo in.telnetd[2078]: connect from 216.216.74.2
[root@localhost t]#
第五部查看程序的启动和关闭过程
[root@localhost t]# cat var/log/messages
