0027-ssh-tunnel-存在ssh隧道¶

Rule ID¶

• 0027-ssh-tunnel

Category¶

• network

Severity¶

• critical

Compatible Versions¶

• Linux

Description¶

• Monitor whether the host has an SSH tunnel

Scan Frequency¶

• 1 */5 * * *

Rationale¶

• An SSH tunnel is an SSH port forwarding that establishes a tunnel between the SSH client and the SSH server, forwarding network data through the tunnel to a specified port for network communication. SSH tunnels automatically provide corresponding encryption and decryption services, ensuring the security of data transmission. If an unknown SSH tunnel exists on the host, the host faces the risk of data leakage, so it should be within the audit scope.

Risk Items¶

• Hacker intrusion

• Data leakage

• Network security

• Mining risk

• Zombie risk

Audit Method¶

• Verify the host process list and check whether there is a process with cmdline sshd: root@notty. You can run the following command to verify:

ps -ef | grep -v grep| grep "sshd: root@notty"

Remediation¶

• If an unknown process with cmdline sshd: root@notty exists, run kill -9 隧道pid to terminate the dangerous process.

Impact¶

• None

Default Value¶

• By default, processes with cmdline sshd: root@notty are not allowed.

References¶

• Hacker Intrusion Emergency Investigation Ideas && Process (Unofficial)

• Record of a Real Mining Intrusion Investigation Analysis (Unofficial)

CIS Controls¶

• None