Amagciwane ku-GNU / Linux: Iqiniso noma Inganekwane?

Noma nini lapho impikiswano mayelana igciwane y I-GNU / Linux Akuthathi isikhathi eside ukuthi umsebenzisi avele (imvamisa iWindows) uthini:

«KuLinux awekho amagciwane ngoba abadali balezi zinhlelo ezinonya abachithi isikhathi benza okuthile ngohlelo olusebenzayo olungasebenzisi muntu »

Engihlale ngiphendula kukho:

"Inkinga akuyona leyo, kepha abasunguli balezi zinhlelo ezinonya ngeke bachithe isikhathi ngokwakha okuthile okuzolungiswa ngokuvuselelwa kokuqala kohlelo, ngisho nangaphansi kwamahora angama-24"

Futhi bengingenaphutha, njengoba lo mbhalo omuhle kakhulu ushicilele ku Inombolo 90 (Unyaka 2008) kusuka kuTodo Linux Magazine. Umlingisi wakhe UDavid Santo Orcero isinikeza ngendlela yezobuchwepheshe (kepha kulula ukuyiqonda) incazelo yokuthi kungani I-GNU / Linux ayinalo lolu hlobo lwe-software enobungozi.

Kunconywe i-100%. Manje bazoba nezinto ezingaphezu kokukholisa ukuthulisa noma ngubani okhuluma ngaphandle kwesisekelo esiqinile ngale ndaba.

Landa i-Article (PDF): Izinganekwane Namaqiniso: I-Linux namaGciwane

KUHLELWE:

Nayi i-athikili ebhaliwe, njengoba sibheka ukuthi kukhululeke kakhulu ukufunda ngale ndlela:

======================================================================================== ======================

Impikiswano yeLinux negciwane ayiyintsha. Njalo lapho sibona i-imeyili ohlwini sibuza ukuthi akhona yini amagciwane eLinux; futhi ngokuzenzakalela othile uphendula ngokuqinile futhi athi uma zingathandwa kakhulu kungenxa yokuthi iLinux ayandile njengaseWindows. Kukhona nokukhishwa njalo kwabezindaba kusuka kubathuthukisi be-antivirus abathi bakhulula izinhlobo zamagciwane e-Linux.

Ngokwami, ngike ngaba nengxoxo ngezikhathi ezithile nabantu abahlukahlukene ngeposi, noma ngohlu lokusabalalisa, maqondana nodaba lokuthi amagciwane akhona noma cha ku-Linux. kuyinganekwane, kepha kuyinkimbinkimbi ukudiliza inganekwane noma, kunalokho, yinkohliso, ikakhulukazi uma kubangelwa intshisekelo yezomnotho. Othile unesifiso sokudlulisa umbono wokuthi uma iLinux ingenazo lezi zinhlobo zezinkinga, kungenxa yokuthi bambalwa kakhulu abantu abayisebenzisayo.

Ngesikhathi sokushicilela lo mbiko, bengizothanda ukubhala umbhalo ocacile ngokuba khona kwamagciwane eLinux. Ngeshwa, lapho inkolelo-ze nezintshisekelo zomnotho zidla lubi, kunzima ukwakha okuthile okucacayo.
Kodwa-ke, sizozama ukwenza impikiswano ephelele lapha ukuvimbela ukuhlaselwa kwanoma ngubani ofuna ukukuphikisa.

Liyini igciwane?

Okokuqala nje, sizoqala ngokuchaza ukuthi liyini igciwane. Kuluhlelo oluzikopisha lona futhi luzisebenzele, futhi oluhlose ukushintsha ukusebenza okujwayelekile kwekhompyutha, ngaphandle kwemvume yomsebenzisi noma ulwazi. Ukwenza lokhu, amagciwane athatha indawo yamafayela asebenzisekayo afakwe amanye angenwe yikhodi yawo. Incazelo ijwayelekile, futhi isifinyezo somugqa owodwa wokufakwa kwe-Wikipedia kumagciwane.
Ingxenye ebaluleke kakhulu yale ncazelo, naleyo ehlukanisa igciwane kwamanye ama-malware, ukuthi igciwane liyazifaka, ngaphandle kwemvume noma ulwazi lomsebenzisi. uma ingazifaki, ayilona igciwane: kungaba i-rootkit, noma iTrojan.

I-rootkit isichibi se-kernel esikuvumela ukuthi ufihle izinqubo ezithile kusuka kuzinsiza zendawo yomsebenzisi. Ngamanye amagama, kungukuguqulwa kwekhodi yomthombo we-kernel inhloso yayo ukuthi izinsiza ezisivumela ukuthi sibone okwenziwayo ngaso sonke isikhathi azibonisi ngenqubo ethile, noma umsebenzisi othile.

ITrojan iyafana: kuwukuguqulwa kwekhodi yomthombo yesevisi ethile ukufihla umsebenzi othile wokukhwabanisa. Kuzona zozimbili lezi zimo, kuyadingeka ukuthola ikhodi yomthombo yenguqulo ngqo efakwe emshinini we-Linux, ubambe ikhodi, uyiqoqe kabusha, uthole amalungelo okuphatha, ufake okufakwayo okungasetshenziswa, futhi uqalise insizakalo - esimweni seTrojan- noma uhlelo olusebenzayo. ephelele - esimweni se-
impande-. Inqubo, njengoba sibona, akuyona into encane, futhi akekho noyedwa ongakwenza konke lokhu "ngephutha". Zombili zidinga ekufakweni kwazo ukuthi umuntu onamalungelo okuphatha, ngokwazi, enze uchungechunge lwezinyathelo ezenza izinqumo zobuchwepheshe.

Okungeyona i-semantic nuance engabalulekile: ukuze igciwane lizifake ngokwalo, kwanele ngathi ukuthi siqhube uhlelo olunegciwane njengomsebenzisi ojwayelekile. Ngakolunye uhlangothi, ukufaka i-rootkit noma iTrojan, kubalulekile ukuthi umuntu onobungozi afake i-akhawunti yezimpande zomshini, futhi ngendlela engeyona ezenzakalelayo, enze uchungechunge lwezinyathelo ezingabonakala. igciwane lisakazeka ngokushesha nangempumelelo; i-rootkit noma iTrojan idinga ukuthi zisikhombe ngqo.

Ukudluliswa kwamagciwane ku-Linux:

Indlela yokudlulisela igciwane, ngakho-ke, iyilona eliyichaza kanjalo, futhi iyisisekelo sobukhona bayo. uhlelo olusebenzayo luzwela kakhulu kumagciwane kuba lula kakhulu ukwakha indlela yokudlulisa esebenza kahle futhi ezenzakalelayo.

Ake sithi sinegciwane elifuna ukuzisabalalisa. Ake sithi yethulwe ngumsebenzisi ojwayelekile, ngokungenacala, lapho yethula uhlelo. Leli gciwane linezindlela ezimbili kuphela zokudlulisa:

• Ukuziphindaphinda ngokuthinta inkumbulo yezinye izinqubo, ukuzilengisa kuzo ngesikhathi sokusebenza.
• Ukuvula okuphumelelayo kokusebenza kwefayela, nokungeza ikhodi yabo - ukulayishwa- kokusebenzisekayo.

Onke amagciwane esingawabheka njengale okungenani anenye yezindlela ezimbili zokudlulisa. O Ababili. Azisekho izindlela.
Mayelana nomshini wokuqala, masikhumbule ukwakheka kwememori ebonakalayo yeLinux nokuthi amaprosesa we-Intel asebenza kanjani. Lawa anamasongo amane, abalwa kusuka ku-0 kuye ku-3; ukwehla kwenombolo, kukhulu namalungelo ekhodi egijima kulelo ring analo. Lezi zindandatho zihambelana nezigaba zeprosesa, ngakho-ke, ngalokho okungenziwa ngohlelo olukwindandatho ethile. I-Linux isebenzisa i-ring 0 ye-kernel, ne-ring 3 ngezinqubo. ayikho ikhodi yenqubo egijima eringini 0, futhi ayikho ikhodi ye-kernel egijima eringini 3. Kunendawo eyodwa yokungena ku-kernel kusuka eringini 3: ukuphazamiseka okungu-80h, okukuvumela ukuthi weqe ukusuka endaweni lapho yikhodi yomsebenzisi endaweni lapho ikhodi ye-kernel ikhona.

Ukwakhiwa kwe-Unix ngokujwayelekile neLinux ikakhulukazi akukwenzi ukuthi ukusabalala kwamagciwane kwenzeke.

I-kernel ngokusebenzisa imemori ebonakalayo yenza inqubo ngayinye ikholelwe ukuthi inememori ngokwayo. Inqubo –okusebenza eringini 3– ingabona kuphela imemori ebonakalayo eyakhelwe yona, yeringi esebenza kuyo. Akukhona ukuthi inkumbulo yezinye izinqubo ivikelwe; ukuthi ngenqubo eyodwa inkumbulo yezinye ingaphandle kwesikhala sekheli. Ukube inqubo ibizoshaya wonke amakheli ememori, ibingakwazi ngisho nokubhekisa ikheli lememori lenye inqubo.

Kungani lokhu kungakhohliswa?
Ukuguqula ukuphawula - ngokwesibonelo, khiqiza amaphuzu wokungena ku-ring 0, shintsha ukuphazamisa ama-vectors, shintsha imemori ebonakalayo, shintsha i-LGDT ... - kungenzeka kuphela kusuka ku-ring 0.
Lokho wukuthi, ngenqubo ezokwazi ukuthinta inkumbulo yezinye izinqubo noma i-kernel, kufanele ibe yinhlamvu uqobo lwayo. Futhi iqiniso lokuthi kunephuzu elilodwa lokungena nokuthi amapharamitha adluliswa kumarejista kuxaka isicupho - empeleni, kudluliswa kwirejista kuze kube yilapho kwenziwa, okuzobe sekuqaliswa njengecala enkambisweni yokunaka. 80h ukuphazamiseka.
Esinye isimo yisimo sezinhlelo zokusebenza ezinamakholi amaningi angenawo amaphepha okushaya u-0, lapho lokhu kungenzeka khona - kungahlala kunekholi ekhohliwe engasetshenziswanga kahle lapho kungakhiwa khona isicupho - kepha esimweni sohlelo lokusebenza olunjalo indlela elula yesinyathelo, akunjalo.

Ngalesi sizathu, ukwakheka kwememori ebonakalayo kuvimbela le ndlela yokudlulisa; azikho izinqubo - ngisho nalabo abanamalungelo empande - banendlela yokufinyelela kwimemori yabanye. Singasho ukuthi inqubo ingabona i-kernel; ibalazwe kusuka kukheli layo lememori elinengqondo 0xC0000000. Kepha, ngenxa yendandatho yeprosesa esebenza kuyo, awukwazi ukuyiguqula; kuzokhiqiza isicupho, ngoba kuyizindawo zememori ezingokwenye indandatho.

"Isixazululo" kungaba uhlelo olushintsha ikhodi ye-kernel uma iyifayela. Kepha iqiniso lokuthi lezi ziphinde zavuselelwa likwenza kube nzima. I-kanambambili ayikwazi ukumakwa, njengoba kunezigidi zezinhlamvu ezahlukene kanambambili emhlabeni. Mane nje lapho beyiphinda babebeke noma basuse okuthile ku-kernel ephathekayo, noma babeshintshe usayizi wamanye amalebula akhomba uhlobo lokuhlanganiswa - okuthile okwenziwa kungahlosiwe - isichibi se-kanambambili besingasetshenziswa. Enye indlela kungaba ukulanda ikhodi yomthombo kwi-Intanethi, ukuyinamathisela, ukuyilungiselela i-hardware efanelekile, ukuyihlanganisa, ukuyifaka, bese uqala kabusha umshini. Konke lokhu kufanele kwenziwe ngohlelo, ngokuzenzakalela. Kuyinselelo impela emkhakheni we-Artificial Intelligence.
Njengoba sibona, ngisho negciwane njengezimpande lingeqa lo mgoqo. Ukuphela kwesixazululo esisele ukuhanjiswa phakathi kwamafayela asebenzayo. Okungasebenzi futhi njengoba sizobona ngezansi.

Okuhlangenwe nakho kwami ​​njengomlawuli:

Eminyakeni engaphezu kweyishumi bengiphethe iLinux, ngokufakwa emakhulwini emishini ezikhungweni zedatha, emalabhorethri abafundi, ezinkampanini, njll.

• Angikaze "ngilithole" igciwane
• Angikaze ngihlangane nomuntu oke
• Angikaze ngihlangane nomuntu oke wahlangana nomuntu oke wehlelwa nguyena

Ngazi abantu abaningi ababone iLoch Ness Monster kunababone amagciwane e-Linux.
Ngokwami, ngiyavuma ukuthi ngibe budedengu, futhi sengisungule izinhlelo eziningi labo abazibiza "ngochwepheshe" abazibiza ngokuthi "amagciwane weLinux" - kusukela manje kuqhubeke, ngizozibiza ngamagciwane, hhayi ukwenza umbhalo ube yisisekelo -, kusuka ku-akhawunti yami ejwayelekile emelene nomshini wami, ukubona ukuthi kungenzeka yini ukuthi litheleleke igciwane: zombili igciwane le-bash elizungeza lapho - futhi, ngasendleleni, elingazange lithelele amafayela - negciwane eladuma kakhulu, lavela emaphephandabeni. Ngizamile ukuyifaka; futhi ngemuva kwemizuzu engamashumi amabili yokusebenza, ngiyekile lapho ngibona ukuthi enye yezimfuno zakhe ukuthi abe nomkhombandlela we-tmp esehlukanisweni sohlobo lwe-MSDOS. Ngokwami, angazi noma ngubani odala ukwahlukanisa okuthile kwe-tmp bese eyihlela ku-FAT.
Eqinisweni, amanye okuthiwawawagciwane engiwahlolele i-Linux adinga ulwazi olusezingeni eliphezulu ne-password yezimpande ukuthi ifakwe. Singafaneleka, okungenani, njenge- "crappy" igciwane uma lidinga ukungenelela kwethu ukuthelela umshini. Ngaphezu kwalokho, kwezinye izimo zidinga ulwazi olunzulu lwe-UNIX ne-password eyimpande; okukude kakhulu nokufakwa okuzenzakalelayo okufanele kube yikho.

Ukungenela okuphumelelayo ku-Linux:

Ku-Linux, inqubo ingamane yenze lokho okuvunyelwa ngumsebenzisi wayo neqembu elisebenzayo. Kuyiqiniso ukuthi kunezindlela zokushintshanisa umsebenzisi wangempela ngemali, kepha okunye okunye. Uma sibheka lapho okufezekiswa khona, sizobona ukuthi yimpande kuphela enamalungelo okubhala kulezi zinkomba nakumafayela aqukethwe. Ngamanye amagama, yimpande kuphela engaguqula amafayela anjalo. Lokhu kunjalo e-Unix kusukela ngama-70s, kuLinux kusukela imvelaphi yayo, nakuhlelo lwefayela olusekela amalungelo, alikho iphutha elivele livele elivumela okunye ukuziphatha. Ukwakheka kwamafayela asebenzayo e-ELF kuyaziwa futhi kubhalwe kahle, ngakho-ke kungenzeka ukuthi ifayela lalolu hlobo lilayishe umthwalo okhokhelwayo kwelinye ifayela le-ELF ... inqobo nje uma umsebenzisi osebenza kahle weqembu langaphambili noma iqembu elisebenzayo langaphambili enamalungelo okufinyelela. ukufunda, ukubhala nokwenza ku-file yesibili. Mangaki ama-executable wesistimu yefayela engayithelela njengomsebenzisi ojwayelekile?
Lo mbuzo unempendulo elula, uma sifuna ukwazi ukuthi mangaki amafayela "esingawatheleleka", sethula umyalo:

$ find / -type f -perm -o=rwx -o \( -perm -g=rwx -group `id -g` \) -o \( -perm -u=rwx -user `id -u` \) -print 2> /dev/null | grep -v /proc

Sikhipha umkhombandlela we-proc ngoba iyi-fileystem ebonakalayo ekhombisa imininingwane yokuthi uhlelo lokusebenza lusebenza kanjani. Amafayela ohlobo lwefayela anamalungelo wokusebenzisa esizowathola awanankinga, ngoba imvamisa izixhumanisi ezibonakalayo ezibonakala zifundwa, zibhalwa futhi zenziwa, futhi uma umsebenzisi ezama, akusebenzi. Siphinde siwagwebe amaphutha, maningi - ngoba, ikakhulukazi ku / proc kanye / nasekhaya, kunezinkomba eziningi lapho umsebenzisi ojwayelekile engakwazi ukungena khona - Lo mbhalo uthatha isikhathi eside. Esimweni sethu esithile, emshinini lapho kusebenza abantu abane, impendulo ibithi:

/tmp/.ICE-unix/dcop52651205225188
/tmp/.ICE-unix/5279
/home/irbis/kradview-1.2/src
/kradview

Okukhiphayo kukhombisa amafayela amathathu abengatheleleka uma ngabe kuqhutshwa igciwane lokucabanga. Eyokuqala emibili ngamafayela ohlobo lwesokhethi e-Unix ayasuswa ekuqaleni - futhi angeke athintwe yigciwane-, kanti eyesithathu yifayela lohlelo olusathuthukayo, elisuswa njalo lapho liphindwa. Leli gciwane, ngokombono osebenzayo, lalingeke lisabalale.
Ngokwalokho esikubonayo, okuwukuphela kwendlela yokusabalalisa umthwalo okhokhelwayo ngokuba yimpande. Kulokhu, ukuze igciwane lisebenze, abasebenzisi kumele bahlale benamalungelo okuphatha. Uma kunjalo, ingathelela amafayela. Kepha nakhu kufika ukubamba: ukudlulisa ukutheleleka, udinga ukuthatha okunye okuphumelelayo, ukukuthumela komunye umsebenzisi osebenzisa kuphela umshini njengezimpande, bese uphinda inqubo.
Kuzinhlelo zokusebenza lapho kudingeka khona ukuba ngumlawuli wemisebenzi ejwayelekile noma ukwenza izinhlelo eziningi zansuku zonke, lokhu kungaba njalo. Kepha ku-Unix kuyadingeka ukuthi ube ngumlawuli ukumisa umshini futhi uguqule amafayela wokumisa, ngakho-ke inani labasebenzisi i-akhawunti yezimpande elibasebenzisa njenge-akhawunti yansuku zonke lincane. Kungaphezulu; okunye ukusatshalaliswa kwe-Linux akunayo i-akhawunti yezimpande enikwe amandla. Cishe kuzo zonke, uma ufinyelela imvelo enjengaleyo, ingemuva liyashintsha libe bomvu kakhulu, futhi nemiyalezo ephindaphindwayo iyaphindwa ekhumbuza ukuthi le akhawunti akufanele isetshenziswe.
Ekugcineni, konke okumele kwenziwe njengezimpande kungenziwa ngomyalo weSudo ngaphandle kwengozi.
Ngalesi sizathu, ku-Linux okusebenzisekayo akukwazi ukuthelela abanye inqobo nje uma singasebenzisi i-akhawunti yezimpande njenge-akhawunti ejwayelekile yokusebenzisa; Futhi yize izinkampani zama-antivirus ziphikelela zisho ukuthi kukhona amagciwane weLinux, empeleni into esondele kakhulu engadalwa kuLinux yiTrojan endaweni yomsebenzisi. Ukuphela kwendlela la maTrojans angathinta ngayo okuthile ohlelweni ukuluqhuba njengezimpande nangamalungelo adingekayo. Uma imvamisa sisebenzisa umshini njengabasebenzisi abajwayelekile, akunakwenzeka ngenqubo ethulwe ngumsebenzisi ojwayelekile ukuthelela uhlelo.

Izinganekwane namanga:

Sithola izinganekwane eziningi, amanga, namanga alula nje mayelana nama-virus ku-Linux. Masenze uhlu lwazo ngokuya ngengxoxo eyenzeka esikhathini esithile esidlule nommeleli womenzi we-antivirus yeLinux owacasulwa kakhulu yindatshana eyashicilelwa kulo magazini ofanayo.
Leyo ngxoxo iyisibonelo esihle senkomba, njengoba ithinta zonke izici zamagciwane ku-Linux. Sizobuyekeza zonke lezi zinganekwane ngamunye ngamunye njengoba kuxoxwe ngazo kuleyo ngxoxo ethile, kepha eziphindaphindwe kaningi kwezinye izinkundla.

Inganekwane 1:
"Akuzona zonke izinhlelo ezinonya, ikakhulukazi ama-virus, ezidinga amalungelo ezimpande ukuthelela, ikakhulukazi esimweni esithile segciwane elisebenzisekayo (ifomethi ye-ELF) elithelela okunye okuphumelelayo".

Impendulo:
Noma ngubani owenza isimangalo esinjalo akazi ukuthi uhlelo lwamalungelo e-Unix lusebenza kanjani. Ukuze kuthinteke ifayela, igciwane lidinga ilungelo lokufundwa –kumele lifundwe ukuze liguqulwe–, bese kubhalwa –kufanele kubhalelwe ukuguqulwa ukuze kuvumeleke- kufayela elisebenzisekayo elifuna ukulisebenzisa.
Lokhu kuhlala kunjalo, ngaphandle kokuhlukile. Futhi ku-distro ngayinye, abasebenzisi okungezona izimpande abanawo la malungelo. Ngemuva kwalokho ngokungabi yimpande, ukutheleleka akunakwenzeka. Ukuvivinywa kwamandla: Esigabeni esedlule sabona umbhalo olula wokubheka ububanzi bamafayela angathinteka ukutheleleka. Uma siyethula emshinini wethu, sizobona ukuthi incane kanjani, futhi maqondana namafayela wohlelo, null. Futhi, ngokungafani nezinhlelo zokusebenza ezifana neWindows, awudingi ukuba namalungelo okuphatha ukwenza imisebenzi ejwayelekile ngezinhlelo ezisetshenziswa kakhulu ngabasebenzisi abajwayelekile.

Inganekwane 2:
"Futhi akudingeki babe yimpande yokufaka isistimu ukude, esimweni seSlapper, isibungu, esisebenzisa ubungozi ku-Apache's SSL (izitifiketi ezivumela ukuxhumana okuphephile), yakha inethiwekhi yayo yemishini ye-zombie ngoSepthemba 2002.".

Impendulo:
Lesi sibonelo asisho igciwane, kepha isibungu. Umehluko ubaluleke kakhulu: isibungu wuhlelo olusebenzisa insiza ye-Intanethi ukuzithumela yona. Akuthinti izinhlelo zasendaweni. Ngakho-ke, kuthinta kuphela amaseva; hhayi kwimishini ethile.
Izikelemu bezilokhu zimbalwa kakhulu futhi zibe nezigameko ezingezinhle. Abathathu ababaluleke ngempela bazalwa ngeminyaka yama-80s, isikhathi lapho i-Intanethi yayingenacala, futhi wonke umuntu wayethemba wonke umuntu. Masikhumbule ukuthi yibo abathinte i-sendmail, i-fingerd ne-rexec. Namuhla izinto seziyinkimbinkimbi. Yize singekuphike ukuthi ahlala nokuthi, uma engalawulwa, ayingozi enkulu. Kepha manje, izikhathi zokuphendula kwizikelemu zifushane kakhulu. Lokhu kuyisimo seSlapper: isibungu esenziwe ngobungozi obutholakele - futhi sanakwa - ezinyangeni ezimbili ngaphambi kokuvela kwesibungu uqobo.
Ngisho nokucabanga ukuthi wonke umuntu osebenzisa i-Linux ufake i-Apache futhi isebenza ngaso sonke isikhathi, ukumane uvuselele amaphakheji nyangazonke bekungaba ngaphezu kokwanele ukuthi ungalokothi ube sengozini.
Kuyiqiniso ukuthi i-SSL bug eyenziwe nguSlapper ibibucayi - empeleni isiphazamisi esikhulu kunazo zonke esitholakala kuwo wonke umlando we-SSL2 ne-SSL3 - futhi ngenxa yalokho salungiswa emahoreni ambalwa. Ukuthi izinyanga ezimbili ngemuva kokuthi inkinga itholakele yaxazululwa, othile wenza isibungu ephutheni eselivele selilungisiwe, nokuthi lesi yisibonelo esinamandla kunazo zonke esinganikezwa njengobucayi, okungenani kuyakuqinisekisa.
Njengomthetho ojwayelekile, ikhambi lezikelemu akukhona ukuthenga i-antivirus, ukuyifaka nokuchitha isikhathi sekhompyutha ukuyigcina ihlala. Isixazululo ukusebenzisa uhlelo lokuvuselela ukuphepha lokusatshalaliswa kwethu: ukusatshalaliswa kokusatshalaliswa, ngeke kube nezinkinga. Ukwenza izinsiza esizidingayo kuphela kuwumqondo omuhle ngezizathu ezimbili: sithuthukisa ukusetshenziswa kwezinsizakusebenza, futhi sigwema izinkinga zokuphepha.

Inganekwane 3:
"Angicabangi ukuthi umnyombo awunakuhlaselwa. Eqinisweni, kuneqembu lezinhlelo ezinonya ezibizwa nge-LRK (Linux Rootkits Kernel), ezisuselwe ngqo ekuxhaphazeni ukuba sengozini kumamojula we-kernel nokufaka esikhundleni sezinambuzane zohlelo.".

Impendulo:
I-rootkit ngokuyisisekelo i-kernel patch ekuvumela ukuthi ufihle ubukhona babasebenzisi abathile nezinqubo kusuka kumathuluzi ajwayelekile, ngenxa yokuthi ngeke zivele kumkhombandlela we / proc. Into ejwayelekile ukuthi bayisebenzisa ekugcineni kokuhlaselwa, kwasekuqaleni, bazosebenzisa ubungozi obukude ukuthola ukufinyelela kumshini wethu. Ngemuva kwalokho bazokwenza ukulandelana kokuhlaselwa, ukukhulisa amalungelo kuze kube bane-akhawunti yezimpande. Inkinga uma beyithola ukuthi bangayifaka kanjani insiza emshinini wethu ngaphandle kokutholwa: kulapho kungena khona i-rootkit. Umsebenzisi wenziwe ozoba umsebenzisi osebenzayo wensizakalo esifuna ukuyifihla, bafaka i-rootkit, futhi bafihla bobabili umsebenzisi osetshenzisiwe nazo zonke izinqubo zomsebenzisi osetshenzisiwe.
Ukufihla ukuthi ukhona umsebenzisi kusebenziseka ku-virus yinto esingaxoxa ngayo isikhathi eside, kepha igciwane elisebenzisa i-rootkit ukuzifaka ngokwalo libukeka limnandi. Ake sicabange ngemishini yegciwane (ku-pseudocode):
1) Igciwane lingena ohlelweni.
2) Thola ikhodi yomthombo we-kernel. Uma kungenjalo, uzifaka ngokwakhe.
3) Lungiselela i-kernel ngezinketho zehadiwe ezisebenza kumshini okukhulunywa ngawo.
4) Hlanganisa inhlamvu.
5) Faka i-kernel entsha; ukulungisa i-LILO noma i-GRUB uma kunesidingo.
6) Qalisa kabusha umshini.

Izinyathelo (5) no (6) zidinga amalungelo ezimpande. Kuyindida ngandlela thize ukuthi izinyathelo (4) no (6) azitholwa ngabangenwe yilesi sifo. Kepha into ehlekisayo ukuthi kukhona umuntu okholelwa ukuthi kunohlelo olungenza igxathu (2) kanye (3) ngokuzenzakalela.
Njengomphumela, uma sihlangana nomuntu ositshela ukuthi "uma kunemishini eminingi ye-Linux kuzoba namagciwane amaningi", futhi ancoma ukuthi "kufakwe i-antivirus futhi uyivuselele njalo", mhlawumbe ihlobene nenkampani emaketha i-antivirus nezibuyekezo . Yiba nokusola, mhlawumbe umnikazi ofanayo.

Igciwane le-Linux:

Kuyiqiniso ukuthi kune-antivirus enhle yeLinux. Inkinga ukuthi, abenzi lokho abaphikisi bama-antivirus abaphikisana ngakho. Umsebenzi wawo ukuhlunga imeyili edlula isuka ku-malware nama-virus iye ku-Windows, kanye nokuqinisekisa ubukhona bama-virus e-Windows kumafolda akhishwe nge-SAMBA; ngakho-ke uma sisebenzisa umshini wethu njengesango leposi noma njenge-NAS yemishini yeWindows, singabavikela.

I-Clam-AV:

Ngeke siwuqede umbiko wethu ngaphandle kokukhuluma nge-antivirus eyinhloko ye-GNU / Linux: ClamAV.
IClamAV iyi-antivirus enamandla kakhulu ye-GPL ehlanganisa iningi le-Unix etholakala emakethe. Yenzelwe ukuhlaziya okunamathiselwe ukuthumela imilayezo edlula esiteshini bese uyihluza amagciwane.
Lolu hlelo lokusebenza luhlangana ngokuphelele ne-sendmail ukuvumela ukuhlunga kwama-virus angagcinwa kumaseva we-Linux ahlinzeka ngeposi ezinkampanini; ukuba ne-database yamagciwane evuselelwa nsuku zonke, ngokuxhaswa kwedijithali. Isizindalwazi sivuselelwa kaningana ngosuku, futhi siyiphrojekthi enempilo futhi ethakazelisa kakhulu.
Lolu hlelo olunamandla luyakwazi ukuhlaziya amagciwane noma kokunamathiselwe kumafomethi anzima kakhulu ukuvula, njenge-RAR (2.0), i-Zip, i-Gzip, i-Bzip2, i-Tar, i-MS OLE2, amafayela we-MS Cabinet, i-MS CHM (i-HTML COprinted), ne-MS SZDD.
I-ClamAV futhi isekela amafayili weposi we-mbox, Maildir, ne-RAW, namafayela aphathekayo aphathekayo acindezelwe nge-UPX, FSG, nePetite. I-Clam AV ne-spamassassin pair yizimbhangqwana ezifanele ukuvikela amaklayenti ethu eWindows kumaseva weposi we-Unix.

ISIPHETHO

Kumbuzo Ingabe kukhona ukuba sengozini ezinhlelweni zeLinux? Impela impendulo inguyebo.
Akekho engqondweni yabo efanele ongabazayo; I-Linux akuyona i-OpenBSD. Enye into iwindi lokuba sengozini lapho uhlelo lwe-Linux libuyekezwa kahle. Uma sizibuza, ngabe akhona amathuluzi okusizakala ngalezi zimbobo zokuphepha, futhi sibaxhaphaze? Yebo, yebo, kepha lawa akuwona amagciwane, angukuxhaphaza.

Igciwane kufanele linqobe ubunzima obuningi obulokhu bubekwe njengephutha / inkinga ye-Linux ngabavikeli beWindows, futhi okwenza kube nzima ukuba khona kwamagciwane angempela - izinhlamvu ezibuyisiwe, izinhlobo eziningi zezinhlelo zokusebenza eziningi, ukusabalalisa okuningi, izinto ezingekho ngokuzenzakalela kudluliselwe ngokusobala kumsebenzisi, njll. Ama- "virus" wamanje okucatshangwa ukuthi kufanele afakwe ngesandla kusuka ku-akhawunti yezimpande. Kepha lokho ngeke kuthathwe njengegciwane.
Njengoba ngihlala ngitshela abafundi bami: ngicela ningangikholwa. Landa bese ufaka i-rootkit emshinini. Futhi uma ufuna okuningi, funda ikhodi yomthombo yama- "virus" emakethe. Iqiniso likukhodi yomthombo. Kunzima ukuthi igciwane "elizimemezele" liqhubeke nokuliqamba ngaleyo ndlela ngemuva kokufunda ikhodi yalo. Futhi uma ungayazi ukuthi ungayifunda kanjani ikhodi, isilinganiso esisodwa esilula sokuphepha engisincomayo: sebenzisa i-akhawunti yezimpande ukuphatha umshini kuphela, futhi ugcine izibuyekezo zokuphepha zisesikhathini.
Ngalokho kukodwa nje, akunakwenzeka ukuthi amagciwane angene kuwe futhi mancane kakhulu amathuba okuthi izibungu noma othile azohlasela ngempumelelo umshini wakho.