JBoss漏洞修复.docVIP

修复JBoss漏洞中毒现象：1. ps axf看到多出了很多进程，尤其是有pnscan这个进程，它会对外扫描整个网络，导致网络拥塞：sh -c ./pnscan -r JBoss -w HEAD / HTTP/1.0\r\n\r\n -t 6400 /16 8080 /tmp/sess_00座机电话号码2. crontab -l看到多出了，有些中毒的则没有这个现象：1 1 10 * * /root/.sysdbs1 1 24 * * /root/.sysync.pl1 1 10 * * /root/.sysdbs1 1 24 * * /root/.sysync.pl3. $ JBOSS_HOME /bin/多出了好多文件，这些文件的owner为未知（比如为1000 ：a.tar.gzbm.cbm.hbm.oflu.plfly.plinstall-shipsortkisses/kisses.tar.gzkisses.tar.gz.1linda.pllindb.plMakefilepnscanpnscan.cpnscan.oversion.cversion.o修改：all default,minimal 这三个目录下都需要检查一下并做对应的处理。） # $ JBOSS_HOME /server/all default,minimal /deploy/management/ 将该目录下的 iesvc.war wstats.war zecmd.war zmeu.war 等删除。 只留下console-mgr.sar 2. 修改jboss配置：一、JMX安全设置：all default,minimal 这三个目录下都需要检查一下并做对应的处理。）# vi $ JBOSS_HOME /server/all default,minimal /deploy/jmx-console.war/WEB-INF/web.xml !-- A security constraint that restricts access to the HTML JMX console to users with the role JBossAdmin. Edit the roles to what you want and uncomment the WEB-INF/jboss-web.xml/security-domain element to enable secured access to the HTML JMX console. -- security-constraint web-resource-collection web-resource-name HtmlAdaptor /web-resource-name An example security config that only allows users with the role JBossAdmin to access the HTML JMX console web application url-pattern /* /url-pattern  !-- http-method GET /http-method http-method POST /http-method -- /web-resource-collection auth-constraint role-name JBossAdmin /role-name /auth-constraint /security-constraint 把GET和POST两行注释掉，同时security-constraint整个部分不要注释掉。# vi $ JBOSS_HOME /server/all default,minimal /deploy/jmx-console.war/WEB-INF/jboss-web.xml jboss-web !-- Uncomment the security-domain to enable security. You will need to edit the htmladaptor login configuration to setup the login modules used to authentication users. -- security-domain java:/jaas/jmx-console /security-domain  /jboss-web 把security-domain注释去掉。# vi $ JBOSS_HOME /server/all defaul