Zivo NiX BLog

There are two good methods to see what ports are open in Linux you can use
nmap which is a port scanner and you can use netstat.

nmap can be used to scan your machine to see whats ports are open issue the
following command to scan your computers machine:

once the scan has finished you will get the following ouput:

The second method was netstat. netstat can show hidden ports and what programs using
them issue the following command as root:

This will show you the output of something similar to:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp        0      0 127.0.0.1:61931             0.0.0.0:*                   LISTEN      5277/wish
tcp        0      0 127.0.0.1:5335              0.0.0.0:*                   LISTEN      3920/mDNSResponder
tcp        0      0 0.0.0.0:1241                0.0.0.0:*                   LISTEN      31438/nessusd: wait
tcp        0      0 10.0.0.14:32776             194.109.129.220:6667        ESTABLISHED 5062/xchat
tcp        0      0 10.0.0.14:45731             207.46.107.146:1863         ESTABLISHED 5277/wish
tcp        0      0 10.0.0.14:33009             82.96.64.2:6667             ESTABLISHED 5062/xchat
tcp        0      0 :::80                       :::*                        LISTEN      4355/httpd
tcp        0      0 :::22                       :::*                        LISTEN      32372/sshd
tcp        0      0 :::443                      :::*                        LISTEN      4355/httpd
udp        0      0 0.0.0.0:68              0.0.0.0:*                           3614/dhclient
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           3920/mDNSResponder

ClamAV

ClamAV es un conjunto de herramientas antivirus para UNIX con licencia GPL (software libre).

Clamscan

Adicionalmente el programa clamscan, desde la línea de comandos puede detectar virus en nuestros archivos.

Te conectas a Espora.org vía SecureShell

~$ ssh usuario@espora.org

o bien usa PuTTY.

Ejectuas clamscan

Verifica en que directorio estás

usuaria@maquina:~$ pwd
/home/mi_usuaria

Detecta virus en tu $HOME

usuario@maquina:~$ clamscan -r ./

• Descripción
  • clamscan : el antivirus
  • -r : opción ‘recursiva’, busca también en los subdirectorios
  • ./ : el directorio actual (tu $HOME)
• Manual y ayuda

usuaria@maquina:~$ man clamscan      #el manual

usuaria@maquina:~$ clamscan --help   #la ayuda, lista de opciones

si tienes muchos archivos, puedes filtar la salida de clamscan con la opción i para que sólo muestre los archivos infectados.

usuaria@maquina:~$ clamscan -ri /home/mi_usuaria

Tendrás algo como esto:

LibClamAV Warning: ********************************************************
LibClamAV Warning: ***  This version of the ClamAV engine is outdated.  ***
LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/faq.html ***
LibClamAV Warning: ********************************************************
LibClamAV Warning: ********************************************************
LibClamAV Warning: ***  This version of the ClamAV engine is outdated.  ***
LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/faq.html ***
LibClamAV Warning: ********************************************************
/home/mi_usuaria/public_html/mi_archivo.php: PHP.Defash.B FOUND

----------- SCAN SUMMARY -----------
Known viruses: 35669
Engine version: 0.84
Scanned directories: 300
Scanned files: 139
Infected files: 1
Data scanned: 2.06 MB
Time: 13.793 sec (0 m 13 s)

En este ejemplo, /home/mi_usuaria/public_html/mi_archivo.php tiene un virus llamado PHP.Defash.B.

¿Qué hacer con los archivos infectados?

• Borrarlos (clamscan borra el virus con todo y archivo. Tendrás que hacer de nuevo el archivo)

usuaria@maquina:~$ clamscan --remove -r nombre_archivo_infectado

• • Si es un archivo en texto, por ejemplo un HTML puedes editarlo y borrar sólo el virus.

• Desinfectarlos con el antivirus que tengas en tu computadora y volverlos a subir.

Examples

(0) Scan a single file:

clamscan file

(1) Scan a current working directory:

clamscan

(2) Scan all files (and subdirectories) in /home:

clamscan -r /home

(3) Load database from a file and limit disk usage to 50 MB:

clamscan -d /tmp/newclamdb –max-space=50m -r /tmp

(4) Scan a data stream:

cat testfile | clamscan -

(5) Scan a mail spool directory:

clamscan -r /var/spool/mail

Overview

With the introduction of Redhat version 8 and continued into version 9, the /etc/sysconfig/static-routes file no longer seems to function correctly.

Linux static routes changed in 8.0 to a new format. Now you are to create a file in /etc/sysconfig/network-scripts for each Ethernet interface you wish to create static routes on.

Example:

touch /etc/sysconfig/network-scripts/route-eth0

The syntax for this file is different from the traditional route format used in /etc/sysconfig/static-routes . Redhat has yet to document the change on their web site as of June 2003.

Syntax based on a usenet post go to /etc/sysconfig/network-scripts, make a file called route-devicename (ex: route-eth0) and populate it with your static routes for that device so if you wanted to make a static route to the 192.168.0.0/24 network through 152.3.182.5 type:

192.168.0.0/24 via 152.3.182.5

Persistent static routes for ANY linux distribution

You may use this method to add static routes and it will work under any Linux distribution. However, it is considered by some a ‘hack’ or the ‘ugly way’.

Edit your /etc/rc.local file and add your static routes using the route statement.

Example:

route add -net 10.10.98.0 netmask 255.255.255.0 gw 10.164.234.132 dev eth1
route add -net 10.164.234.96 netmask 255.255.255.252 gw 10.164.234.132 dev eth1
route add -net 10.164.234.112 netmask 255.255.255.240 gw 10.164.234.132 dev eth1

Force the old static-routes file to work under Redhat 9

Clear out the new /etc/sysconfig/network-scripts/ifup-routes script so that you can populate it with the original shell script from Redhat 7.x.

cat /dev/null > /etc/sysconfig/network-scripts/ifup-routes
vi /etc/sysconfig/network-scripts/ifup-routes

type in the following (or copy and paste) not including the tilde lines:

#!/bin/sh

# adds static routes which go through device $1

if [ "$1" = "" ]; then
echo “usage: $0 ”
exit 1
fi

if [ ! -f /etc/sysconfig/static-routes ]; then
exit 0
fi

# note the trailing space in the grep gets rid of aliases
grep “^$1 ” /etc/sysconfig/static-routes | while read device args; do
/sbin/route add -$args $device
done
grep “^any ” /etc/sysconfig/static-routes | while read ignore type net netmask mask bogus dev ; do
if [ "$dev" = "$1" ]; then
/sbin/route add -$type $net $netmask $mask $dev
fi
done

Remember to use /etc/sysconfig/network for your default gateway

If you only intend to add one route, your default gateway, then you need not worry about the static routes file or using the route command. Simply add your default gateway in /etc/sysconfig/network.

Example

NETWORKING=yes
HOSTNAME=”hostname.linux.org”
GATEWAY=”10.164.234.1″
GATEWAYDEV=”eth0″
FORWARD_IPV4=”yes”