Iintsholongwane kwi-GNU / Linux: Ngaba yinyani okanye yintsomi?

Nanini na xa ingxoxo Virus y GNU / Linux ayithathi thuba lide ukuba umsebenzisi avele (ihlala iWindows) ithini:

«KwiLinux akukho zintsholongwane kuba abaqulunqi bezi nkqubo zingalunganga abachithi xesha benza into kwiNkqubo yokuSebenza phantse ukuba akukho mntu uyisebenzisayo »

Endihlala ndiphendula:

"Ingxaki ayisiyiyo leyo, kodwa abadali bezi nkqubo zingalunganga abazukuchitha ixesha ngokwenza into eza kulungiswa ngohlaziyo lokuqala lwenkqubo, nditsho nangaphantsi kweeyure ezingama-24"

Kwaye andiphazami, njengoko eli nqaku libalaseleyo lipapashwe kwi Inombolo yoku-90 (Unyaka ka-2008) ukusuka kwiTodo Linux Magazine. Umdlali wakhe UDavid Santo Orcero isinika ngendlela yobugcisa (kodwa kulula ukuyiqonda) inkcazo yokuba kutheni GNU / Linux ayinalo olu hlobo lwesoftware enobungozi.

Kucetyiswa i-100%. Ngoku baya kuba nezinto ezingaphaya kokukholisa ukuthulisa nabani na othetha ngaphandle kwesiseko esiqinileyo ngalo mbandela.

Khuphela iNqaku (PDF): Iintsomi nenyaniso: I-Linux kunye neeVirus

 

UKUHLELA:

Nali inqaku elibhaliweyo, njengoko sijonga ukuba kukhululeke ngakumbi ukufunda ngale ndlela:

================================================== ======================

Ingxoxo yeLinux kunye nentsholongwane ayonto intsha. Njalo sihlala sibona i-imeyile kuluhlu lubuza ukuba ngaba zikhona na iintsholongwane zeLinux; kwaye ngokuzenzekelayo umntu uphendula ngokuqinisekileyo kwaye amabango ukuba ukuba awaziwa kakhulu kungenxa yokuba iLinux ayixhaphakanga njengeWindows. Kukho ukukhutshwa rhoqo kweendaba ezivela kubaphuhlisi be-antivirus besithi bakhupha iinguqulelo zeentsholongwane zeLinux.

Ngokwam, bendikhe ndaneengxoxo ezithile nabantu abahlukeneyo ngeposi, okanye ngoluhlu lokusasaza, ngokubhekisele kumba wokuba azikho na iintsholongwane kwiLinux. yintsomi, kodwa inzima ukudiliza intsomi okanye, kunoko, kukukhohlisa, ngakumbi ukuba kubangelwa ngumdla wezoqoqosho. Umntu othile unomdla wokuhambisa umbono wokuba ukuba iLinux ayinazo ezi ngxaki, kungenxa yokuba bambalwa kakhulu abantu abayisebenzisayo.

Ngexesha lokupapasha le ngxelo ndingathanda ukubhala isicatshulwa esichazayo ngobukho beentsholongwane kwiLinux. Ngelishwa, xa iinkolelo kunye nomdla kuqoqosho uxhaphake, kunzima ukwakha into eqinisekileyo.
Nangona kunjalo, siya kuzama ukwenza ingxoxo epheleleyo apha ngokufanelekileyo ukukhupha izixhobo kuhlaselo lwabani na ofuna ukuphikisana.

Yintoni intsholongwane?

Okokuqala, siza kuqala ngokuchaza ukuba yintoni intsholongwane. Yinkqubo ekopiayo kwaye ibaleke ngokuzenzekelayo, kwaye ejolise ekutshintsheni ukusebenza kwesiqhelo kwekhompyuter, ngaphandle kwemvume yomsebenzisi okanye ulwazi. Ukwenza oku, intsholongwane ithatha indawo yeefayile ezinokuphunyezwa kunye nabanye abasulelekileyo kwikhowudi yabo. Inkcazo esemgangathweni, kwaye sisishwankathelo somgca omnye wokungena kweWikipedia kwiintsholongwane.
Elona candelo libaluleke kakhulu kule nkcazo, kwaye eyahlula intsholongwane kwezinye ii-malware, kukuba intsholongwane iyazifaka, ngaphandle kwemvume yomsebenzisi okanye ulwazi. ukuba ayizifaki ngokwayo, ayisiyintsholongwane: inokuba yingcambu, okanye iTrojan.

Ingcambu ye-rootkit sisixhobo se-kernel esikuvumela ukuba ufihle iinkqubo ezithile kuluncedo lwendawo yomsebenzisi. Ngamanye amagama, lutshintsho lwekhowudi yomthombo wekernel injongo yayo kukuba izinto ezisivumelayo ukuba zibone ukuba kwenzeka ntoni ngalo naliphi na ixesha azibonisi inkqubo ethile, okanye umsebenzisi othile.

ITrojan iyafana: lutshintsho kwikhowudi yemvelaphi yenkonzo ethile yokufihla ubuqhetseba. Kuzo zombini iimeko, kuyafuneka ukufumana ikhowudi yemvelaphi yenguqulo ngqo efakwe kumatshini weLinux, ubambe ikhowudi, uyiqokelele, ufumane amalungelo olawulo, fakela izinto ezinokuphunyezwa, kwaye uqalise inkonzo-kwimeko yeTrojan- okanye inkqubo yokusebenza igcwalise - kwimeko ye-
ingcambu-. Inkqubo, njengoko sibona, ayisiyonto ilula, kwaye akukho mntu unokukwenza konke oku "ngempazamo". Zombini zifuna ukufakela ukuba umntu onelungelo lolawulo, enolwazi, enze uthotho lwamanyathelo okwenza izigqibo ngobuchwephesha.

Ayisiyongqondo engabalulekanga yesemantic: ukuba intsholongwane izifake, konke ekufuneka sikwenzile kukuqhuba inkqubo yosulelo njengomsebenzisi oqhelekileyo. Kwelinye icala, ukufakelwa kwengcambu okanye iTrojan kubalulekile ukuba umntu onobungozi angene kwiingcambu zomatshini, kwaye ngendlela engeyiyo ezenzekelayo, enze uthotho lwamanyathelo anokufumaneka. intsholongwane isasazeka ngokukhawuleza nangokufanelekileyo; i-rootkit okanye iTrojan ifuna ukuba zisilandele ngokuthe ngqo.

Ukuhanjiswa kwentsholongwane kwiLinux:

Inkqubo yokuhambisa intsholongwane, ke, yeyona nto iyichazayo, kwaye sisiseko sobukho babo. Inkqubo yokusebenza inovakalelo ngakumbi kwintsholongwane kokukhona kulula ukuphuhlisa indlela yokuhambisa esebenzayo kunye nokuzenzekelayo.

Masithi sinentsholongwane efuna ukusasazeka. Masithi isungulwe ngumsebenzisi oqhelekileyo, imsulwa, xa kusungulwa inkqubo. Le ntsholongwane ineendlela ezimbini zokuhambisa kuphela:

• Ukuziphindaphinda ngokuchaphazela imemori yezinye iinkqubo, ukuziqinisa kubo ngexesha lokusebenza.
• Ukuvula indlela ephunyeziweyo yenkqubo yefayile, kunye nokudibanisa ikhowudi -payload- yabo ekuphumezayo.

Zonke iintsholongwane esinokuzijonga ngolu hlobo zinenye yezi ndlela zimbini zosasazo. O Zimbini. Azisekho iindlela.
Ngokubhekisele kwindlela yokuqala, masikhumbule uyilo lwenkumbulo ebonakalayo yeLinux kunye nendlela esebenza ngayo iprosesa ye-Intel. Ezi zineeringi ezine, ezibhalwe ukusuka ku-0 ukuya ku-3; elisezantsi inani, kokukhona lukhulu amalungelo ekhowudi ebaleka kuloo msesane. Ezi zangqa ziyahambelana neprosesa, kwaye ke, yintoni enokwenziwa ngenkqubo ekwisangqa esithile. I-Linux isebenzisa umsesane we-0 kwikernel, kunye ne-ring 3 yeenkqubo. akukho khowudi yenkqubo ebaleka kumsesane 0, kwaye akukho khowudi yekerneli ibaleka kwindandatho 3. Kukho indawo enye yokungena kwikernel ukusuka kwindandatho yesi-3: ukuphazamiseka okungama-80h, okukuvumela ukuba utsibe kwindawo ekuyo ikhowudi yomsebenzisi kwindawo apho ikhowudi yekernel ikhona.

Uyilo lwe-Unix ngokubanzi kunye neLinux ngokukodwa ayenzi ukuba ukusasazeka kweentsholongwane kwenzeke.

I-kernel ngokusebenzisa imemori ebonakalayo yenza ukuba inkqubo nganye ikholelwe ukuba inememori kuyo yonke. Inkqubo-esebenza kwindandatho yesi-3- inokubona kuphela imemori ebonakalayo elungiselelwe yona, kwindandatho esebenza kuyo. Ayisiyo into yokuba inkumbulo yezinye iinkqubo ikhuselwe; kukuba kwinkqubo enye inkumbulo yezinye ingaphandle kwendawo yedilesi. Ukuba inkqubo ibinokubetha zonke iidilesi zememori, ngekhe ibenakho ukubhekisa kwidilesi yememori yenye inkqubo.

Kutheni le nto ingenakuqhathwa?
Ukulungisa oko kuphawuliweyo- umzekelo, yenza iindawo zokungena kwi-ring 0, lungisa ukuphazamisa iivenkile, uguqule imemori ebonakalayo, uguqule i-LGDT… - inokwenzeka kuphela kwi-ring 0.
Oko kukuthi, ukuze inkqubo ikwazi ukubamba imemori yezinye iinkqubo okanye i-kernel, kufanele ukuba ibe yi-kernel uqobo. Kwaye inyani yokuba inqaku elinye lokungena kunye nokuba iiparameter zigqityiwe kwiirejista zenza umgibe-enyanisweni, idluliswa kwirejista kude kube yinto ekufuneka yenziwe, ethi ke iphunyezwe njengemeko yesiqhelo sokuqwalaselwa. 80h ukuphazamiseka.
Enye imeko yimeko yeenkqubo ezisebenzayo ezinamakhulu eefowuni ezingabhaliswanga ukuba zibethe 0, apho oku kunokwenzeka - kunokuhlala kukho umnxeba olityelweyo ongalunganga ongaphuhliswa ngumgibe- kodwa kwimeko yenkqubo yokusebenza kunye Inkqubo elula kangaka, ayisiyiyo.

Ngesi sizathu, uyilo lwenkumbulo ebonakalayo ithintela le ndlela yokuhambisa; akukho nkqubo-nditsho nkqu nezo zinamalungelo engcambu-zinendlela yokufikelela kwimemori yabanye. Singatsho ukuba inkqubo iyayibona ikernel; Inemephu evela kwidilesi yememori yayo enengqiqo 0xC0000000. Kodwa, ngenxa yomsesane weprosesa oqhubayo, awungekhe uguqule; iya kuvelisa umgibe, kuba ziindawo zenkumbulo ezizezenye iringi.

"Isisombululo" iya kuba yinkqubo eguqula ikhowudi yekernel xa iyifayile. Kodwa inyani yokuba ezi zinto ziphindwaphindwa yenza kube nzima. I-binary ayinakushicilelwa, njengoko kukho izigidi zeenkozo ezahlukeneyo emhlabeni. Ngokulula xa beyiphinda babebeke okanye basuse into kwi-kernel ephunyeziweyo, okanye batshintshe ubungakanani wenye yeelebheli ezichonga uhlobo lokudityaniswa- into eyenziweyo nokuba ayibandakanyekanga- isichibi sokubini asinakusetyenziswa. Enye indlela iya kuba kukukhuphela ikhowudi yemvelaphi kwi-Intanethi, ukuyipakisha, ukuyilungiselela izixhobo ezifanelekileyo zekhompyutha, ukuyidibanisa, ukuyifaka kunye nokuwuqalisa kwakhona umatshini. Konke oku kufuneka kwenziwe yinkqubo, ngokuzenzekelayo. Ucelomngeni olukhulu kwicandelo lobuGcisa bobuGcisa.
Njengoko sibona, nkqu nentsholongwane njengengcambu ayinatsiba lo mqobo. Isisombululo esishiyekileyo kuphela kukuhambisa phakathi kweefayile ezinokuphunyezwa. Engasebenziyo njengoko siza kubona ngezantsi.

Amava am njengomlawuli:

Kwiminyaka engaphezu kweshumi bendi lawula iLinux, ngokufakwa kumakhulu oomatshini kumaziko edatha, iilebhu zabafundi, iinkampani, njl.

• Andizange "ndiyifumane" intsholongwane
• Andizange ndidibane nomntu owakhe
• Andizange ndadibana nomntu owakhe wadibana nomntu okhe wehlela kuye

Ndazi abantu abaninzi ababone iLoch Ness Monster kunokuba babone iintsholongwane zeLinux.
Ngokwam, ndiyavuma ukuba ndingenankathalo, kwaye ndisungule iinkqubo ezininzi ezibizwa ngokuba "ziingcali" ezizibiza ngokuba "ziintsholongwane zeLinux" - ukusukela ngoku, ndiza kubabiza ngokuba ziintsholongwane, hayi ukwenza isicatshulwa esisisiseko -, kwiakhawunti yam yesiqhelo ngokuchasene nomatshini wam, ukubona ukuba intsholongwane inokwenzeka na: zombini intsholongwane ye-bash ejikeleza apho-kwaye, ngendlela, khange ichaphazele naziphi na iifayile- kunye nentsholongwane eyaduma kakhulu, kwaye yavela kumaphephandaba. Ndizamile ukuyifaka; kwaye emva kwemizuzu engamashumi amabini yokusebenza, ndayeka xa ndabona ukuba enye yeemfuno zakhe yayikukuba ne-tmp directory kwicandelo lohlobo lwe-MSDOS. Ngokwam, andazi ukuba ngubani na owenza isahlulelo esithile se-tmp kwaye asenze kwifomathi.
Ngapha koko, ezinye ezibizwa ngokuba ziintsholongwane endiye ndazivavanya kwiLinux zifuna inqanaba eliphezulu lolwazi kunye negama elinegama eligqithisiweyo ekufuneka lifakiwe. Singafaneleka, ubuncinci, njenge- "crappy" intsholongwane ukuba ifuna ungenelelo lwethu olusebenzayo ukosulela umatshini. Ngapha koko, kwezinye iimeko zifuna ulwazi olubanzi lwe UNIX kunye negama eligqithisiweyo eliyingcambu; okukude kakhulu kufakelo oluzenzekelayo olucingelwa ukuba lukhona.

Ukuchaphazela ukuphunyezwa kwiLinux:

Kwi-Linux, inkqubo inokwenza ngokulula oko kuvunyelwe ngumsebenzisi kunye neqela elisebenzayo. Kuyinyani ukuba kukho iindlela zokutshintshisa oyena msebenzisi ngemali, kodwa enye into encinci. Ukuba sijonga apho zikhona izinto eziphunyeziweyo, siya kubona ukuba yingcambu kuphela enamalungelo okubhala kwezi zikhombisi nakwiifayile eziqulathwe. Ngamanye amagama, yingcambu kuphela enokuguqula ezo fayile. Injalo imeko kwi-Unix ukusukela nge-70s, kwiLinux ukusukela kwimvelaphi yayo, nakwinkqubo yefayile exhasa amalungelo, akukho mpazamo ivelileyo evumela enye indlela yokuziphatha. Ubume beefayile ezisebenzisekayo ze-ELF ziyaziwa kwaye zibhalwe kakuhle, ke ngoko kunokwenzeka ukuba ifayile yolu hlobo ilayishe umthwalo kwenye ifayile ye-ELF ... ukuba nje umsebenzisi osebenzayo weqela langaphambili okanye iqela elisebenzayo labo bangaphambili banamalungelo okufikelela. ukufunda, ukubhala kunye nokwenza kwifayile yesibini. Zingaphi iinkqubo eziphunyeziweyo ezinokuthi zisulele njengomsebenzisi oqhelekileyo?
Lo mbuzo unempendulo elula, ukuba sifuna ukwazi ukuba zingaphi iifayile esinokuthi "sizosulele", sazisa lo myalelo:

$ find / -type f -perm -o=rwx -o \( -perm -g=rwx -group `id -g` \) -o \( -perm -u=rwx -user `id -u` \) -print 2> /dev/null | grep -v /proc

Asibandakanyi umkhombandlela we / proc kuba yifayile ebonakalayo ebonisa ulwazi malunga nendlela esebenza ngayo inkqubo yokusebenza. Iifayile zohlobo lwefayile ezinamalungelo okuphumeza esiya kuzifumana azinangxaki, kuba zihlala zinamakhonkco abonakala ngathi afundwe, abhaliwe kwaye ayenziwa, kwaye ukuba umsebenzisi uyazama, ayisebenzi. Sikwalela ngaphandle kweempazamo, zininzi- kuba, ngakumbi kwi / proc kunye / nasekhaya, zininzi iikhowudi apho umsebenzisi oqhelekileyo engenakungena khona.Iskripthi sithatha ixesha elide. Kwimeko yethu, kumatshini apho kusebenza abantu abane, impendulo yayi:

/tmp/.ICE-unix/dcop52651205225188
/tmp/.ICE-unix/5279
/home/irbis/kradview-1.2/src
/kradview

Iziphumo zibonisa iifayile ezintathu ezinokosuleleka ukuba isifo sentsholongwane siqhutywa. Ezokuqala zimbini ziifayile zesiseko se-Unix ezisusiweyo ekuqaleni-kwaye azinakuchaphazeleka yintsholongwane-, kwaye eyesithathu yifayile yenkqubo kuphuhliso, ethi icinywe ngalo lonke ixesha iphinda yenziwe. Intsholongwane, ngokwembono ebonakalayo, ayinakusasazeka.
Ukusuka kwinto esiyibonayo, ekuphela kwendlela yokusasaza umthwalo ohlawulelwayo kukuba yingcambu. Kule meko, ukuze intsholongwane isebenze, abasebenzisi kufuneka basoloko benamalungelo olawulo. Kwimeko apho, inokuchaphazela iifayile. Kodwa naku kuza ukubamba: ukuhambisa usulelo, kuya kufuneka uthathe enye into ephumelelayo, uyithumele komnye umsebenzisi osebenzisa umatshini njengengcambu kuphela, kwaye uphinde inkqubo.
Kwiinkqubo zokusebenza apho kunyanzelekile ukuba ube ngumlawuli wemisebenzi eqhelekileyo okanye ukuqhuba usetyenziso lwemihla ngemihla, kunokuba njalo. Kodwa kwi-Unix kunyanzelekile ukuba ube ngumlawuli ekuqwalaseleni umatshini kwaye uguqule iifayile zoqwalaselo, ke inani labasebenzisi elisetyenziswa yiakhawunti yengcambu njengeakhawunti yemihla ngemihla lincinci. Ingakumbi; Olunye ulwabiwo lweLinux alunayo iakhawunti yengcambu enikwe amandla. Phantse kuzo zonke, ukuba ufikelela kwimizobo enjalo, imvelaphi iyatshintsha ibe bomvu, kwaye imiyalezo eqhubekayo iyaphindaphindwa ekhumbuza ukuba le akhawunti mayingasetyenziswa.
Okokugqibela, yonke into ekufuneka yenziwe njengengcambu inokwenziwa ngomyalelo weSudo ngaphandle komngcipheko.
Ngesi sizathu, kwiLinux ephunyeziweyo ayinakho ukosulela abanye ukuba nje asisebenzisi iakhawunti yengcambu njengeakhawunti eqhelekileyo; Kwaye nangona iinkampani ze-antivirus zifuna ukuba kukho iintsholongwane zeLinux, eyona nto ikufutshane enokwenziwa kwiLinux yiTrojan kwindawo yomsebenzisi. Ekuphela kwendlela ezi Trojans ezinokuthi zichaphazele ngayo into kwinkqubo kukuyiqhuba njengengcambu kunye namalungelo afanelekileyo. Ukuba sihlala sisebenzisa umatshini njengabasebenzisi abaqhelekileyo, ayinakwenzeka inkqubo eqaliswe ngumsebenzisi oqhelekileyo ukosulela inkqubo.

Iintsomi nobuxoki:

Sifumana uninzi lweentsomi, ubuqhetseba, kunye nobuxoki obucacileyo malunga neentsholongwane kwiLinux. Masenze uluhlu lwazo ngokusekwe kwingxoxo eyenzeka ngexesha elidlulileyo kunye nommeli womenzi we-antivirus yeLinux owayekhubeke kakhulu linqaku elipapashwe kwakweli phephancwadi.
Le ngxoxo ngumzekelo olungileyo wesalathiso, njengoko uchukumisa kuyo yonke imiba yentsholongwane kwiLinux. Siza kuzijonga zonke ezi ntsomi nganye nganye njengoko ziye zavakaliswa kule ngxoxo, kodwa iphindaphindwe amaxesha amaninzi kwezinye iiforamu.

Intsomi 1:
"Ayizizo zonke iinkqubo ezinobungozi, ngakumbi intsholongwane, ezifuna amalungelo engcambu ukosulela, ngakumbi kwimeko yeentsholongwane eziphumezayo (ifomathi ye-ELF) echaphazela ezinye izinto".

Impendulo:
Nabani na owenza ibango elinjalo akazi ukuba isebenza njani inkqubo yelungelo le-Unix. Ukuze ichaphazele ifayile, intsholongwane ifuna ilungelo lokufunda- kufuneka ifundwe ukuyiguqula-, kwaye ukubhala -kuya kubhalwa ukuze kugunyaziswe usebenze- kwifayile ephumezayo efuna ukuyenza.
Oku kuhlala kunjalo, ngaphandle kokukhetha. Kwaye kwi-distro nganye, abasebenzisi abangasebenzisi ngcambu abanamalungelo. Ke ngokulula ngokungabi yingcambu, usulelo alunakwenzeka. Uvavanyo lwe-Empirical: Kwicandelo elidlulileyo sabona iskripthi esilula sokujonga uluhlu lweefayile ezinokuchaphazeleka kusulelo. Ukuba siyisungule kumatshini wethu, siza kubona ukuba ayinamsebenzi kangakanani, kwaye ngokubhekisele kwiifayile zenkqubo, null. Kwakhona, ngokungafaniyo neenkqubo zokusebenza ezinje ngeWindows, awudingi malungelo olawulo ukwenza imisebenzi eqhelekileyo kunye neenkqubo ezisetyenziswa ngabasebenzisi abaqhelekileyo.

Intsomi 2:
"Kwaye akukho mfuneko yokuba babe yingcambu yokungena kwinkqubo kude, kwimeko yeSlapper, umbungu othi, ukuxhaphaza ubungozi kwi-SSL ye-Apache (izatifikethi ezivumela unxibelelwano olukhuselekileyo), yenze uthungelwano lwayo ngoomatshini be-zombie ngoSeptemba 2002.".

Impendulo:
Lo mzekelo awubhekiseli kwintsholongwane, kodwa umbungu. Umahluko ubaluleke kakhulu: umbungu yinkqubo exhaphaza inkonzo kwi-Intanethi ukuba izithumele. Ayichaphazeli iinkqubo zasekhaya. Ke ngoko, ichaphazela kuphela iiseva; hayi koomatshini abathile.
Iimpethu bezisoloko zimbalwa kakhulu kwaye zingenzeki kwaphela. Abathathu ababaluleke ngokwenene bazalwe nge-80s, ixesha apho i-Intanethi yayimsulwa, kwaye wonke umntu wayethembele wonke umntu. Masikhumbule ukuba ngabo bachaphazela i-sendmail, i-fingerd kunye ne-rexec. Namhlanje izinto zintsonkothile. Nangona singenakukhanyela ukuba zisekhona kwaye, ukuba ziyekwe zingangqinisiswa, ziyingozi kakhulu. Kodwa ngoku, amaxesha okusabela kwiintshulube amafutshane kakhulu. Le yimeko yeSlapper: umbungu owenziwe kubuthathaka obufunyenweyo- kwaye wabambeka- kwiinyanga ezimbini phambi kokuvela kwempethu ngokwayo.
Nokuba ucinga ukuba wonke umntu osebenzisa iLinux wayene-Apache efakiweyo kwaye eqhuba ngalo lonke ixesha, ngokuhlaziya nje iiphakheji zanyanga zonke kunokuba ngaphezulu ngokwaneleyo ukuba kungaze kusebenze mngcipheko.
Kuyinyani ukuba i-SSL bug eyabangelwa nguSlapper yayiyeyona ibalulekileyo- enyanisweni, eyona bug yayifunyenwe kwimbali yonke ye-SSL2 kunye ne-SSL3 -kwaye yalungiswa ngaphakathi kweeyure. Ezinyanga zimbini emva kokuba le ngxaki ifunyenwe kwaye isonjululwe, umntu othile wenza umbungu kwimpazamo esele ilungisiwe, kwaye lo ngowona mzekelo unamandla onokunikwa njengobuthathaka, ubuncinci uyaqinisekisa.
Njengomgaqo ngokubanzi, isisombululo kwiintshulube asikuko ukuthenga i-antivirus, ukuyifaka, kunye nokuchitha ixesha lekhompyuter ukuyigcina ihlala. Isisombululo kukusebenzisa inkqubo yohlaziyo lokhuseleko losasazo lwethu: ukuba unikezelo luhlaziyiwe, akusayi kubakho ngxaki. Ukuqhuba kuphela iinkonzo esizifunayo kukwaluvo olulungileyo ngezizathu ezibini: siphucula ukusetyenziswa kwezixhobo, kwaye siyaziphepha iingxaki zokhuseleko.

Intsomi 3:
"Andiqondi ukuba undoqo awunakuhlaselwa. Ngapha koko, kukho iqela leenkqubo ezinobungozi ezibizwa ngokuba yi-LRK (Linux Rootkits Kernel), esekwe ngokuchanekileyo kwinyani yokuba baxhaphaza ukuba semngciphekweni kwiimodyuli ze-kernel kwaye bathathe indawo yeendlela ezimbini.".

Impendulo:
Ingcambu ye-rootkit sisiseko se-kernel esikuvumela ukuba ufihle ubukho babasebenzisi abathile kunye neenkqubo kwizixhobo eziqhelekileyo, enkosi kwinto yokuba abayi kuvela kulawulo lwe / proc. Into eqhelekileyo kukuba bayisebenzise ekugqibeleni kuhlaselo, kwasekuqaleni, baya kuxhaphaza ukuba semngciphekweni okude ukufikelela kumatshini wethu. Emva koko baya kwenza ulandelelwano lohlaselo, ukunyusa amalungelo de babe ne-akhawunti yengcambu. Ingxaki xa besenza yindlela yokufaka inkonzo kumatshini wethu ngaphandle kokufunyanwa: kulapho kungena khona ingcambu. Umsebenzisi wenziwe oza kuba ngumsebenzisi osebenzayo wenkonzo esifuna ukuyifihla, bafaka i-rootkit, kwaye bafihla bobabini umsebenzisi kunye nazo zonke iinkqubo zomsebenzisi.
Indlela yokufihla ubukho bomsebenzisi iluncedo kwintsholongwane yinto esinokuxoxa ngayo ubude, kodwa intsholongwane esebenzisa i-rootkit ukuzifaka ibonakala imnandi. Masicingele ubuchwephesha bentsholongwane (kwi-pseudocode):
1) Intsholongwane ingena kwinkqubo.
2) Khangela ikhowudi yomthombo wekernel. Ukuba ayisiyiyo, uyifaka ngokwakhe.
3) Qwalasela i-kernel kukhetho lwe-Hardware olusebenza kumatshini ekubhekiswa kuwo.
4) Qokelela i-kernel.
5) Faka i-kernel entsha; ukulungisa i-LILO okanye i-GRUB ukuba kukho imfuneko.
6) Qalisa umatshini kwakhona.

Amanyathelo (5) kunye (6) afuna amalungelo engcambu. Kunzima ukuba amanyathelo (4) kunye (6) angafunyanwa ngabosulelekileyo. Kodwa into ehlekisayo kukuba kukho umntu okholelwa ukuba kukho inkqubo enokwenza inyathelo (2) kunye (3) ngokuzenzekelayo.
Njengomphetho, ukuba sidibana nomntu osixelelayo "xa kukho oomatshini abaninzi beLinux kuya kubakho ii-virus ezininzi", kwaye ucebisa ukuba "kufakwe i-antivirus kwaye uyihlaziye rhoqo", mhlawumbi inxulumene nenkampani ethengisa i-antivirus kunye nohlaziyo . Lumka, mhlawumbi ungumnikazi omnye.

Intsholongwane kwiLinux:

Kuyinyani ukuba kukho i-antivirus elungileyo yeLinux. Ingxaki kukuba, abenzi oko kuthethwa ngabameli be-antivirus. Umsebenzi wayo kukucoca iposi esuka kwi-malware kunye neentsholongwane ziye kwiWindows, kunye nokuqinisekisa ubukho beentsholongwane zeWindows kwifolda ezithunyelwa ngaphandle ngeSAMBA; Ke ukuba sisebenzisa umatshini wethu njengesango leposi okanye njenge-NAS yoomatshini beWindows, sinokubakhusela.

I-Clam-AV:

Asizukuyigqiba ingxelo yethu ngaphandle kokuthetha nge-antivirus ephambili yeGNU / Linux: ClamAV.
I-ClamAV yintsholongwane enamandla kakhulu ye-GPL eqokelela uninzi lwe-Unix ekhoyo kwintengiso. Yenzelwe ukuhlalutya izinamathiselo kwimiyalezo yeposi edlula kwisitishi kwaye uyihluze kwiintsholongwane.
Esi sicelo sidityaniswa ngokugqibeleleyo nesendmail ukuvumela ukucoca iintsholongwane ezinokugcinwa kwiiseva zeLinux ezinikezela ngeposi kwiinkampani; ukuba nesiseko sedatha sentsholongwane esihlaziywa mihla le, ngenkxaso yedijithali. Isiseko sedatha sihlaziywa amaxesha ngamaxesha ngemini, kwaye siyiprojekthi enomdla kwaye inomdla kakhulu.
Le nkqubo inamandla iyakwazi ukuhlalutya intsholongwane nkqu nakwiziqhoboshelo kwifomathi ezintsonkothileyo ukuvula, ezinje ngeRAR (2.0), Zip, Gzip, Bzip2, Tar, MS OLE2, iifayile zeKhabhinethi yeMS, iMS MSM (HTML Ikhutshiwe), kunye neMS SZDD .
I-ClamAV ikwaxhasa i-mbox, i-Maildir, kunye neefayile zeposi ze-RAW, kunye neefayile eziSebenzayo eziSebenzayo ezixinzelelweyo nge-UPX, FSG, kunye nePetite. I-Clam AV kunye nesibini se-spamassassin zizibini ezifanelekileyo zokukhusela abathengi bethu beWindows kwiiseva zeposi ze-Unix.

ISIQINISEKISO

Kumbuzo Ngaba bukhona ubungozi kwiinkqubo zeLinux? ngokuqinisekileyo impendulo ngu-ewe.
Akukho mntu kwingqondo yakhe efanelekileyo uyakuthandabuza; I-Linux ayisiyi-OpenBSD. Enye into iwindows yokuba sesichengeni kwenkqubo yeLinux ehlaziywe ngokufanelekileyo. Ukuba siyazibuza, ngaba zikhona izixhobo zokusebenzisa le mingxunya yokhuseleko, kwaye siyisebenzise kakubi? Ewe, ewe, kodwa ezi ayizizo intsholongwane, zizo ukuxhaphaza.

Intsholongwane kufuneka yoyise ubunzima obuninzi obuhlala bubekwa njenge-Linux flaw / ingxaki ngabakhuseli beWindows, kwaye obenza nzima ubukho beentsholongwane zokwenyani- iinkozo eziphindwayo, iinguqulelo ezininzi zezicelo ezininzi, uninzi lwezinto ezisasazwayo, izinto ezingekhoyo ngokuzenzekelayo kudluliselwe elubala kumsebenzisi, njl. Iintsholongwane zethiyori yangoku kufuneka zifakelwe ngesandla kwiakhawunti yengcambu. Kodwa oko akunakuthathwa njengentsholongwane.
Njengoko ndihlala ndixelela abafundi bam: sukundikholelwa, nceda. Khuphela kwaye ufake i-rootkit kumatshini. Kwaye ukuba ufuna ngaphezulu, funda ikhowudi yemithombo ye "virus" kwintengiso. Inyaniso ikhowudi yemvelaphi. Kunzima ukuba intsholongwane "ivakalise ngokwakho" ukuba iqhubeke ithiya njalo emva kokufunda ikhowudi yayo. Kwaye ukuba awuyazi ukuba ungayifunda njani ikhowudi, umlinganiso omnye wokhuselo olula endicebisayo: sebenzisa i-akhawunti yengcambu kuphela ukulawula umatshini, kwaye ugcine uhlaziyo lokhuseleko lusexesheni.
Kuphela kungenakwenzeka ukuba iintsholongwane zingene kuwe kwaye akunakulindeleka ukuba iintshulube okanye umntu ahlasele umatshini wakho ngempumelelo.