| |
Computers on the network can easily be used by hackers to scan tool or other means to find loopholes in the system, and then attack for the vulnerability.
Through camouflage Linux system, set the system to hackers false, you can increase the difficulty of hacking the system analysis, to lure them astray, so as to further improve the security of computer systems. The following Red Hat Linux as an example, some of the commonly used methods Linux system camouflage for several common ways hackers.
For HTTP service
By analyzing the type of Web server, generally we can infer the type of operating system, for example, Windows uses IIS to provide HTTP services, and Linux, the most common is Apache.
The default Apache configuration where there is no information protection mechanism, and allow directory browsing. Browse through the directory, you can usually get a similar "Apache / 1.3.27 Server at apache.linuxforum.net Port 80" or "Apache / 2.0.49 (Unix) PHP / 4.3.8" information.
By modifying the configuration file ServerTokens parameters Apache related information can be hidden. However, Apache Red Hat Linux running a compiled program, prompt information is compiled in a program to hide this information need to modify the Apache source code, then recompile the installer to achieve the prompt replacement of the contents inside.
In Apache 2.0.50, for example, edit ap_release.h file, modify the "#define AP_SERVER_BASEPRODUCT \\" Apache \\ "" to "#define AP_SERVER_BASEPRODUCT \\" Microsoft-IIS / 5.0 \\ "". Edit os / unix / os.h file, modify the "#define PLATFORM \\" Unix \\ "" to "#define PLATFORM \\" Win32 \\ "". After modification, recompile, install Apache.
Apache After installation is complete, modify the httpd.conf configuration file, "ServerTokens Full" to "ServerTokens Prod"; the "ServerSignature On" to "ServerSignature Off", then save and exit. After restarting Apache, scan tool, findings suggest that information has been shown in the operating system for Windows.
For the FTP service
Through FTP service, you can speculate the type of operating system, for example, the FTP service under Windows mostly Serv-U, and Linux, commonly used vsftpd, proftpd and pureftpd software.
In proftpd, for example, modify the configuration file proftpd.conf, add the following:
ServerIdent on \\ "Serv-U FTP Server v5.0 for WinSock ready ... \\"
Save and exit, restart the proftpd service, log on to modify the message FTP server for testing:
C: \\> ftp 192.168.0.1
Connected to 192.168.0.1.
220 Serv-U FTP Server v5.0 for WinSock ready ...
User (192.168.0.1:(none)):
331 Password required for (none).
Password:
530 Login incorrect.
Login failed.
ftp> quit
221 Goodbye.
Thus the surface, the server is a running Serv-U of Windows up.
The return value for the TTL
You can use the ping command to detect a host, according to TTL base can speculate the type of operating system. For a gateway and routing without any network, directly to ping TTL value obtained by the other system, called the "TTL base." Network, each packet through a router, TTL will be minus 1, when the TTL is 0, the packet is discarded. |
|
|
|