简单处理一下挖矿进程
接收服务器异常报警短信,进入服务器查看进程,显示cpu高占率的进程,
$ top -c
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
2192163 test 20 0 2989000 2.3g 8084 S 200.3 14.7 1226:48 [kworker/u2:i2]
查看进程运行源文件位置
$ ll /proc/2192163
...略
lrwxrwxrwx 1 mm mm 0 Nov 11 13:02 cwd -> /home/test/.cache/.local/.local/
-r-------- 1 mm mm 0 Nov 11 12:34 environ
lrwxrwxrwx 1 mm mm 0 Nov 11 12:34 exe -> /home/test/.cache/.local/.local/stak/ld-linux-x86-64.so.2*
...略$ tar -czvf local.tar.gz .local # 出于习惯,对文件做的了备份 -_-!!!
.local/
.local/upd
.local/run
.local/bash
.local/stak3/
.local/stak3/libdl.so.2
.local/stak3/librt.so.1
.local/stak3/libidn.so.11
.local/stak3/xmrig
.local/stak3/libffi.so.6
.local/stak3/libmicrohttpd.so.10
.local/stak3/libgpg-error.so.0
.local/stak3/ld-linux.so.2
.local/stak3/libgmp.so.10
.local/stak3/libm.so.6
.local/stak3/libgnutls.so.30
.local/stak3/libz.so.1
.local/stak3/libc.so.6
.local/stak3/libhogweed.so.4
.local/stak3/libcrypto.so.1.0.0
.local/stak3/libp11-kit.so.0
.local/stak3/libtasn1.so.6
.local/stak3/libnettle.so.6
.local/stak3/libpthread.so.0
.local/stak3/libssl.so.1.0.0
.local/stak3/libgcrypt.so.20
.local/z
.local/dir.dir
.local/x
.local/stak/
.local/stak/libkrb5support.so.0
.local/stak/libdl.so.2
.local/stak/librt.so.1
.local/stak/xmrig
.local/stak/libcom_err.so.2
.local/stak/libgcc_s.so.1
.local/stak/libnuma.so.1
.local/stak/libgssapi_krb5.so.2
.local/stak/libm.so.6
.local/stak/libpcre.so.1
.local/stak/libresolv.so.2
.local/stak/libz.so.1
.local/stak/libssl.so.10
.local/stak/libc.so.6
.local/stak/libhwloc.so.5
.local/stak/libk5crypto.so.3
.local/stak/ld-linux-x86-64.so.2
.local/stak/libkeyutils.so.1
.local/stak/libkrb5.so.3
.local/stak/libpthread.so.0
.local/stak/libltdl.so.7
.local/stak/libcrypto.so.10
.local/stak/libselinux.so.1
.local/a
.local/h64
.local/bash3
.local/.a
.local/c
.local/bash.pid
.local/cron.d
.local/h32
-
首次尝试
进行尝试修改cron.d文件位置,再kill -9 2192163, 无效,过了一会又自动重启
定时任务已经被启动过,此时修改cron.d没去重启crontab的话.应该是无法重启定时任务的 -
直接删除启动文件
删除之后,再kill进程,删除定时任务,再观察定时任务日志,
root@主机名:/home/test/.cache# rm -rf .local
root@主机名:/home/test/.cache# kill -9 218786
# 切换到进程对应的用户 su test
# 查看定时任务
test@主机名:/root$ crontab -l
* * * * * /home/test/.cache/.local/.local/upd >/dev/null 2>&1
# 删除定时任务,再查看定时任务
test@主机名:/root$ crontab -l
#* * * * * /home/test/.cache/.local/.local/upd >/dev/null 2>&1
查看定时间任务日志
root@iZbp18fygyh37en455ppjvZ:/var/log# tail -f syslog
Nov 11 13:18:01 主机名 CRON[2617883]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:19:01 主机名 CRON[2618583]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:20:01 主机名 CRON[2619276]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:21:01 主机名 CRON[2619957]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:21:58 主机名 systemd[1]: Started Session 378189 of user root.
Nov 11 13:22:01 主机名 CRON[2620676]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:23:01 主机名 CRON[2621362]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:24:01 主机名 CRON[2622041]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:25:01 主机名 CRON[2622730]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Nov 11 13:25:01 主机名 CRON[2622731]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:26:01 主机名 CRON[2623441]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:26:11 主机名 crontab[2623556]: (root) LIST (root)
Nov 11 13:26:27 主机名 crontab[2623739]: (test) LIST (test)
Nov 11 13:26:33 主机名 crontab[2623810]: (test) BEGIN EDIT (test)
Nov 11 13:27:01 主机名 CRON[2624162]: (test) CMD (/home/test/.cache/.local/.local/upd >/dev/null 2>&1)
Nov 11 13:27:05 主机名 crontab[2623810]: (test) REPLACE (test)
Nov 11 13:27:05 主机名 crontab[2623810]: (test) END EDIT (test)
Nov 11 13:27:11 主机名 crontab[2624271]: (test) LIST (test)
Nov 11 13:28:01 主机名 cron[558]: (test) RELOAD (crontabs/test)
Nov 11 13:35:01 主机名 CRON[2629610]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Nov 11 13:45:01 主机名 CRON[2636413]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
最终定时任务日志正常的…也没有异常进程出现…
原因是服务器的账户密码太很简单,
修改为16位复杂密码,
结束