사용 환경에서 필요한 내용만 정리.
OS : CentOS 7 3.10.0-957.el7.x86_64
보안 취약점 디렉토리 및 파일 권한 변경 조치에 따른 예시
chown -R wasadm:wasadm ./*
chmod -R 750 ./*
find . -name *.xml -exec chmod 640 {} \;
find . -name *.log -exec chmod 640 {} \;
find . -name *.properties -exec chmod 640 {} \;
보안 취약점 사항
IBM HTTPServer (apache)
This can be mitigated by adding (httpd.conf):
AddServerHeader Off
ServerTokens Prod
ServerSignature Off
WebSphere
v8.5.0.2 이하 버전에서는 두가지 옵션으로 server version 노출을 방지.
ServerHeaderValue :
Use the ServerHeaderValue property to replace the default value of the Server header that is added to all outgoing HTTP responses by server if a Server header does not already exist. The default value for the Server header is WebSphere Application Server v/x.x, where x.x is the version of WebSphere Application Server that is running on your system.
RemoveServerHeader :
Use the RemoveServerHeader property to force the removal of any server header from HTTP responses that the application server sends, thereby hiding the identity of the server program.
setting link : https://www.ibm.com/support/knowledgecenter/SSEQTP_8.5.5/com.ibm.websphere.base.doc/ae/rrun_chain_httpcustom.html
Starting with Version 8.5.0.2, a Server header is no longer automatically added to all outgoing HTTP responses if a Server header does not already exist. If you add this property with a value, that value is included in the Server header that appears in the response. If you specify the value DefaultServerValue, WebSphere Application Server v/x.x is used as the Server header value.
You can set the property 'com.ibm.ws.webcontainer.disablexPoweredBy' to true as described in the section
setting link : https://www.ibm.com/support/knowledgecenter/ko/SSAW57_8.5.5/com.ibm.websphere.nd.multiplatform.doc/ae/rweb_custom_props.html#com.ibm.ws.webcontainer.DisableXPoweredByHeader
설정 이후 서버 재 기동 필요.
OS : AIX
vi로 열면 아래와 같이 개행 문자가 보임
#!/bin/sh^M
#./startServer.sh server_name^M
#./stopServer.sh server_name -username username -password password^M
test1 root [/was8/bin]#perl -pi -e 's/^M//g' stopWasAll.sh
perl -pi -e 's/\015//g' startWeb.sh
perl -pi -e 's/\015//g' stopWeb.sh
vi로 열어 보면 이제 개행 문자가 사라진 모습을 확인 할 수 있다.
test1 root [/was8/bin]#vi stopW*.sh
#!/bin/sh
#./startServer.sh server_name
#./stopServer.sh server_name -username username -password password
#PropFilePasswordEncoder.sh
#export LANG=en_us.utf8
실 사용 환경에서 필요한 내용만 정리
OS : CentOS 7 3.10.0-957.el7.x86_64
Install APR (Apache Protable Runtime)
컴파일방식으로 설치 하기 때문에 사전에 APR을 다운로드
최신 Apache HTTP Server 사용하기 위해서는 버전에 맞는 APR 설치가 필요.
Download link : https://apr.apache.org/download.cgi
[root@was11 apr]$ ./configure --prefix=/SW/web/tools/apr
[root@was11 apr]$ make && make install
#압축 해제
[root@was11 apr-util]$ ./configure --prefix=/SW/web/tools/apr-util --with-apr=/SW/web/tools/apr
[root@was11 apr-util]$ make && make install
https://www.pcre.org/
[root@was11 pcre]# ./configure --prefix=/SW/web/tools/pcre
[root@was11 pcre]# make && make install
Download link : https://www.openssl.org/source/
[root@was11 openssl]# ./config --openssldir=/SW/web/tools/openssl
make uninstall
[root@was11 httpd24]$ tar -zxvf httpd-2.4.41.tar.gz
[root@was11 openssl]# make && make install
[root@was11 httpd24]# ./configure -prefix=/SW/web/httpd24 -enable-so -enable-rewrite --enable-proxy -enable-ssl -enable-mods-shared=all -enable-modules=shared -enable-mpms-shared=all --with-mpm=worker --with-apr=/SW/web/tools/apr --with-apr-util=/SW/web/tools/apr-util --with-pcre=/SW/web/tools/pcre --with-ssl=/SW/web/tools/openssl --enable-ssl -enable-unique-id
[root@was11 httpd24]# make && make install
/SW/web/httpd24/bin/apachectl start
실 사용 환경에서 필요한 내용만 정리.
OS : CentOS 7 3.10.0-957.el7.x86_64
기본 명령어
find ~ -name readme.txt
find [-H] [-L] [-P] [path...] [expression]
[root@localhost /]# find /sw -name "Mem.sh"
/sw/Mem.sh
[root@localhost /]# find . -name "Mem.sh"
find: ‘./run/user/1000/gvfs’: Permission denied
./sw/Mem.sh
[root@localhost sw]# find /sw -iname "Mem.sh"
/sw/Mem.sh
/sw/MEM.sh
[root@localhost /]# find /sw -name "*.sh" -mtime -1
/sw/Mem.sh
/sw/Mem1.sh
/sw/MEM.sh
[root@localhost /]# find /sw -name "*.sh" -mtime -1 | xargs grep "Mem"
/sw/Mem.sh:MEMINFO=`cat /proc/meminfo | grep 'MemTotal\|MemFree\|Buffers\|Cached'`
/sw/Mem1.sh: TOTAL=`free | grep ^Mem: | awk '{print $2}'`
/sw/Mem1.sh: USED=`free | grep ^Mem: | awk '{print $3}'`
/sw/Mem1.sh: FREE=`free | grep ^Mem: | awk '{print $4}'`
/sw/Mem1.sh: BUFFER=`free | grep ^Mem: | awk '{print $6}'`
실 사용 환경에서 필요한 내용만 정리.
OS : CentOS 7 3.10.0-957.el7.x86_64
A file's owner can be changed using the chown command.
chown [OPTION]... [OWNER][:[GROUP]] FILE...
[root@localhost sw]# chown -R root:root *
[root@localhost sw]# ls -alrt
total 8
dr-xr-xr-x. 18 root root 234 Feb 5 01:49 ..
drwxrwxrwx. 2 root root 6 Feb 5 01:49 img
drwx------. 2 root root 6 Feb 5 01:49 was
drwx------. 2 root root 6 Feb 5 01:49 web
drwxr-xr-x. 2 root root 6 Feb 5 01:49 app
drwxr-xr-x. 2 root root 6 Feb 5 01:49 java
drwxr-xr-x. 2 root root 6 Feb 5 01:49 bin
drwxr-xr-x. 2 root root 6 Feb 7 21:26 logs
-rwxr-xr-x. 1 root root 428 Feb 8 01:16 Mem.sh
-rwxr-xr-x. 1 root root 446 Feb 8 06:01 Mem1.sh
drwxr-xr-x. 9 root root 114 Feb 8 06:01 .
[root@localhost sw]# chown wasadm:wasadm img
[root@localhost sw]# chown wasadm:wasadm was
[root@localhost sw]# chown wasadm:wasadm Mem.sh
[root@localhost sw]# ls -alrt
total 8
dr-xr-xr-x. 18 root root 234 Feb 5 01:49 ..
drwxrwxrwx. 2 wasadm wasadm 6 Feb 5 01:49 img
drwx------. 2 wasadm wasadm 6 Feb 5 01:49 was
drwx------. 2 root root 6 Feb 5 01:49 web
drwxr-xr-x. 2 root root 6 Feb 5 01:49 app
drwxr-xr-x. 2 root root 6 Feb 5 01:49 java
drwxr-xr-x. 2 root root 6 Feb 5 01:49 bin
drwxr-xr-x. 2 root root 6 Feb 7 21:26 logs
-rwxr-xr-x. 1 wasadm wasadm 428 Feb 8 01:16 Mem.sh
-rwxr-xr-x. 1 root root 446 Feb 8 06:01 Mem1.sh
drwxr-xr-x. 9 root root 114 Feb 8 06:01 .
사용 환경에서 필요한 내용만 정리.
OS : CentOS 7 3.10.0-957.el7.x86_64
centos 6.x 버전 밑 버전에서 메모리 읽는 방식이 7에서 부터는 변경이 되었다.
(-/+ buffers/cache 부분이 사라졌다.)
메모리 사용량 (%) = 메모리used/(메모리used+메모리free)*100
[root@localhost sw]# free -m
total used free shared buff/cache available
Mem: 7803 892 4686 263 2224 6277
Swap: 8064 0 8064
메모리 사용률 계산
$$Memusage=\frac{used}{total}*100
$$
sar -r 1 명령어를 통해서도 사용률 확인 가능 (%memused) 확인
[root@localhost sw]# free -mw -s 1
total used free shared buffers cache available
Mem: 7803 900 4627 308 2 2273 6224
Swap: 8064 0 8064
total used free shared buffers cache available
Mem: 7803 900 4627 308 2 2273 6224
Swap: 8064 0 8064
| Parameters | |
|---|---|
| total | 총 메모리 크기 |
| used | 사용중인 메모리 (free-buff/cache) |
| free | 여유 메모리 (used-buff/cache) |
| shared | tmpfs, ramfs등에 사용되는 공유 메모리 |
| buffer/cache | 커널 버퍼 / 페이지 캐시 slab 메모리 |
| available | swapping 없이 new ps에 할당 가능한 메모리 예상 크기 |
사용 환경에서 필요한 내용만 정리.
OS : CentOS 7 3.10.0-957.el7.x86_64
사용 명령어 which, readlink
ll 명령어를 통해 찾아도 되지만, 심볼릭 링크가 여러번 사용되어 있는 경우 readlink 명령어로 찾는게 편함.
#which
[wasadm@localhost sw]$ which java
/usr/bin/java
#readlink
[wasadm@localhost sw]$ readlink -f /usr/bin/java
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.181-7.b13.el7.x86_64/jre/bin/java
#ll
[wasadm@localhost sw]$ ll /usr/bin/java
lrwxrwxrwx. 1 root root 22 Feb 5 01:36 /usr/bin/java -> /etc/alternatives/java
[wasadm@localhost sw]$ ll /etc/alternatives/java
lrwxrwxrwx. 1 root root 71 Feb 5 01:36 /etc/alternatives/java -> /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.181-7.b13.el7.x86_64/jre/bin/java
사용 환경에서 필요한 내용만 정리.
OS : CentOS 7 3.10.0-957.el7.x86_64
Change the mode of each FILE to MODE.
주의 할 점으로 chmod 의 경우 현재 상태의 권한을 변경.
[wasadm@localhost sw]$ chmod -R 700 ./was
[wasadm@localhost sw]$ chmod -R 700 ./web
[wasadm@localhost sw]$ chmod -R 755 ./bin
[wasadm@localhost sw]$ chmod -R 777 ./img
하위 디렉토리 속성 까지 변경
-R, --recursive change files and directories recursively
There are two ways to modify permissions, with numbers or with letters.
| Parameters | |
|---|---|
| u | User (the owner of the file) 소유자 |
| g | group (any member of the file's defined group) 그룹 |
| o | Other (anyone else) 기타 사용자 |
| a | All (equivalent to ugo) ugo 전체 사용자 |
| + | add permission |
| - | remove permission |
| = | set permission |
| Parameters | symbol | Permission |
|---|---|---|
| 1 | --- | No Permission |
| 2 | --x | Execute |
| 3 | -w- | Write |
| 4 | -wx | Write and Execute |
| 5 | r-- | Read |
| 6 | rw- | Read and Exceute |
| 7 | rwx | all |