nmap
工具 (在同名套件中) 可以在未登錄的前提下,快速地經由網路連結機器辨識網際網路服務。在另部機器鍵入命令連結至同個網路:
$
nmap mirwiz
Starting Nmap 7.80 ( https://nmap.org ) at 2021-04-29 14:41 CEST Nmap scan report for mirwiz (192.168.1.104) Host is up (0.00062s latency). Not shown: 992 closed ports PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp 80/tcp open http 111/tcp open rpcbind 139/tcp open netbios-ssn 445/tcp open microsoft-ds 5666/tcp open nrpe 9999/tcp open abyss Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds
ps auxw
displays a list of all processes with their user identity. By checking this information against the output of the who
or w
commands, which give a list of logged in users, it is possible to identify rogue or undeclared servers or programs running in the background. Looking at crontabs
(tables listing automatic actions scheduled by users) will often provide interesting information on functions fulfilled by the server (a complete explanation of cron
is available in 節 9.7, “以 cron
和 atd
使用排定的工作”).
/etc/
資料夾內,有時放在 /usr/local/
的次資料夾裡。若從原始碼開始安裝程式而不是由套件安裝,組態檔就會放在前述的次資料夾內。偶而,還可在 /opt/
找到組態檔。
/etc/debian_version
,通常包括 Debian 系統的版本編號 (它是 base-files 套件的一部份)。若以 代碼/sid
方式呈現,表示此系統從該代碼版本取得的最新版套件 (測試版或不穩定版)。
apt-show-versions
程式 (from the Debian package of the same name) 檢查安裝的套件並辨識可用的版本。aptitude
以表單的方式,做同樣的工作。
/etc/apt/sources.list
檔案 (以及 /etc/apt/sources.list.d/
資料夾) 可看到已安裝 Debian 套件的來源。若出現不明來源,管理員可能選擇重新安裝電腦系統確保其軟體與 Debian 相容。
sources.list
file is often a good indicator: the majority of administrators keep, at least in comments, the list of APT sources that were previously used. But you should not forget that sources used in the past might have been deleted, and that some random packages grabbed on the Internet might have been manually installed (with the help of the dpkg
command). In this case, the machine is misleading in its appearance of being a “standard” Debian system. This is why you should pay attention to any indication that will give away the presence of external packages (appearance of deb
files in unusual directories, package version numbers with a special suffix indicating that it originated from outside the Debian project, such as ubuntu
or lmde
, etc.).
/usr/local/
資料夾的內容,其目的是收錄編譯後與手動安裝後的程式。列出以此方式安裝的軟體清單,指出一個問題,為什麼不使用 Debian 對應的套件。
表格 3.1. 作業系統與架構對照表
作業系統 | 架構 |
---|---|
DEC Unix (OSF/1) | alpha, mipsel |
HP Unix | ia64, hppa |
IBM AIX | powerpc |
Irix | mips |
OS X | amd64, powerpc, i386 |
z/OS, MVS | s390x, s390 |
Solaris, SunOS | sparc, i386, m68k |
Ultrix | mips |
VMS | alpha |
Windows 95/98/ME | i386 |
Windows NT/2000 | i386, alpha, ia64, mipsel |
Windows XP / Windows Server 2008 | i386, amd64, ia64 |
Windows RT | armel, armhf, arm64 |
Windows Vista / Windows 7-8-10 | i386, amd64 |