昨天看到 diggirl被駭客攻擊了 ,就在想若是我遇到要怎麼處理,剛找到 這篇 ,今天獨孤木也貼出 SYN Flood 攻擊的基本原理及防禦 。 想知道diggirl的主機狀況為何,於是拿出老工具nmap: #nmap -v -A www.diggirl.net Starting Nmap 4.20 ( http://insecure.org ) at 2007-03-27 11:13 CST Initiating Parallel DNS resolution of 1 host. at 11:13 Completed Parallel DNS resolution of 1 host. at 11:13, 0.07s elapsed Initiating SYN Stealth Scan at 11:13 Scanning diggirl.net (202.153.195.38) [1697 ports] (略) PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd or WU-FTPD 22/tcp open ssh OpenSSH 4.2 (protocol 2.0) 25/tcp open smtp Sendmail 8.13.7/8.13.7 53/tcp open domain 80/tcp open http Apache Tomcat/Coyote JSP engine 1.1 110/tcp open pop3 Dovecot pop3d 443/tcp closed https 2401/tcp closed cvspserver 9090/tcp closed zeus-admin Device type: general purpose Running (JUST GUESSING) : Linux 2.6.X|2.4.X (92%) 果然是很省呀,用一台Linux全包了。 還是建議一下:把ftp、cvspserver關掉,改用sftp、Subversion。至於 zeus-admin我就沒用過,不需要還是關了吧。如果我是hacker,不用直接hack進diggirl...