JBoss漏洞修复.doc

修复JBoss漏洞操作手册中毒现象：1. ps axf看到多出了很多进程，尤其是有pnscan这个进程，它会对外扫描整个网络，导致网络拥塞：sh -c ./pnscan -r JBoss -w HEAD / HTTP/1.0rnrn -t 6400 /16 8080 /tmp/sess_0088025412. crontab -l看到多出了，有些中毒的则没有这个现象：1 1 10 * * /root/.sysdbs1 1 24 * * /root/.sysync.pl1 1 10 * * /root/.sysdbs1 1 24 * * /root/.sysync.pl3. $JBOSS_HOME/bin/多出了好多文件，这些文件的owner为未知（比如为1000)：a.tar.gzbm.cbm.hbm.oflu.plfly.plinstall-shipsortkisses/kisses.tar.gzkisses.tar.gz.1linda.pllindb.plMakefilepnscanpnscan.cpnscan.oversion.cversion.o修改：1.清除JBOSS后门程序:（all(default,minimal)这三个目录下都需要检查一下并做对应的处理。）#$JBOSS_HOME/server/all(default,minimal)/deploy/management/将该目录下的 iesvc.war wstats.war zecmd.war zmeu.war 等删除。只留下console-mgr.sar2. 修改jboss配置：一、JMX安全设置：（all(default,minimal)这三个目录下都需要检查一下并做对应的处理。）# vi $JBOSS_HOME/server/all(default,minimal)/deploy/jmx-console.war/WEB-INF/web.xml HtmlAdaptor An example security config that only allows users with the role JBossAdmin to access the HTML JMX console web application /*!- GET POST- JBossAdmin 把GET和POST两行注释掉，同时security-constraint整个部分不要注释掉。# vi $JBOSS_HOME/server/all(default,minimal)/deploy/jmx-console.war/WEB-INF/jboss-web.xml !- Uncomment the security-domain to enable security. You will need to edit the htmladaptor login configuration to setup the login modules used to authentication users. java:/jaas/jmx-console把security-domain注释去掉。# vi $JBOSS_HOME/server/all(default,minimal)/conf/props/perties# A sample perties file for use with the UsersRolesLoginModuleadmin=emsppassword123修改admin密码二、WEB-CONSOLE安全设置：（all(default,minimal)这三个目录下都需要检查一下并做对应的处理。）# vi $JBOSS_HOME/server/all(default,minimal)/deploy/management/console-mgr.sar/web-console.war/WEB-INF/web.xml HtmlAdaptor An example security config that only allows users with the role JBossAdmin to access the HTML JMX console web application /*!- GET POST- JBossAdmin 把GET和POST两行注释掉，同时security-constraint整个部分不要注释掉。# vi $JBOSS_HOME/server/all(default,minimal)/deploy/management/console-mgr.sar/web-console.war/WEB-INF/jboss-web.xml java:/jaas/web-console把security-domain注释去掉。# vi $JBOSS_HOME/server/all(default,minimal)/deploy/management/console-mgr.sar/web-console.war/WEB-INF/classes/pertie