Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

natpass 被用于黑客攻击,如何侦测 ？ #64

Open
woshidama323 opened this issue Jan 16, 2023 · 3 comments
Open

natpass 被用于黑客攻击,如何侦测 ？ #64

woshidama323 opened this issue Jan 16, 2023 · 3 comments
Labels
question Further information is requested

Comments

@woshidama323
Copy link

Decription

目前我们服务器被攻击，发现natpass-cli 启用6145 作为端口，

问题

如何侦测通过natpass 进程服务？
@lwch lwch added the question Further information is requested label Jan 16, 2023
@lwch
Copy link
Owner

lwch commented Jan 16, 2023 •
edited
Loading

natpass创建连接时有一次握手的过程，内容可通过握手报文进行识别，如果未进行tls加密的话可通过这个握手报文进行阻断。

@lwch
Copy link
Owner

lwch commented Jan 16, 2023

另外建议修改或加强common.yaml中的密钥长度提高安全性

@lwch
Copy link
Owner

lwch commented Jan 16, 2023

另外可以通过修改/etc/systemd/system/np-cli.service中的User字段使其运行在一个低身份的用户下，比如nobody

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
question Further information is requested
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@lwch @woshidama323