What if the CVM is compromised?

How to deal with the intrusion of CVM? After confirming that our CVM has been compromised, we must not lose our footing. We can proceed step by step according to the following operations.

1. Change the password of the administrator account

It is recommended that the password length be no less than 8 digits and use a combination of uppercase letters, lowercase letters, numbers, and special characters.

2. Modify the remote login port

Turn on the firewall to restrict the IP addresses allowed to log in, and the firewall only opens specific service ports. It is recommended to implement source IP access control for services such as FTP, databases, and so on, which do not need to be open to all users.

3. Check whether any unauthorized ports are open.

If so, close the unauthorized ports of the CVM.

-Windows operating system: on the CMD command line, enter the netstat / ano command to check the port.

-Linux operating system: execute the netstat-anp command to view.

4. Check to see if there are any strange abnormal processes

If so, close the process and confirm with the server administrator whether the files used by the abnormal process can be deleted.

-Windows operating system check: select start > run, enter msinfo32, select Software Environment > running tasks, and check.

-Linux system check: check by executing the ps-ef or top command.

5. Install the software of checking and killing virus and anti-Trojan horse, and scan and kill the whole server.

If you need to delete an unknown account in the system, the Windows system also needs to check whether the SAM key in the registry has a hidden account. If there is a Web service, restrict the access of the Web running account to the file system, and only allow read-only permission.

As a senior professional cloud computing service provider and cloud security service provider in the industry, it is committed to providing cloud servers for Internet enterprise users and enterprise users in traditional industries. Its products have the characteristics and advantages of "security and stability, easy to use, high service availability, high performance-to-price ratio" and are designed to be customized for enterprises to meet the needs of rich and diversified application scenarios.