论文部分内容阅读
1.使用系统命令和配置文件来跟踪人侵者的来源路径 (1)Who------(查看谁登录到系统中)。 (2)W-------(查看谁登录到系统中,且在做什么)。 (3)last------(显示系统曾经被登录的用户和TTYS)。 (4)lastcomm--(显示系统过去被运行的命令)。 (5)netstat---(查看当前的网络状态,如telnet到你机器上来的用户的IP地址)。 (6)查看router的信息。 (7)/var/log/messages,查看外部用户的登录状况。 (8)用finger查看所有的登录用户。 (9)查看用户目录下/home/username下的登录历史文件(.history.rchist,etc)。
1. Use system commands and configuration files to track the intruder’s source path (1) Who ------ (Check who is logged in to the system). (2) W ------- (check who logged into the system, and what to do). (3) last ------ (show the system has been logged in users and TTYS). (4) lastcomm - (show the system was run in the past command). (5) netstat --- (Check the current network status, such as telnet to your machine up to the user’s IP address). (6) View router information. (7) / var / log / messages, check the login status of external users. (8) Use finger to see all logged in users. (9) Check the login history file under the / home / username user directory (.history.rchist, etc).