网站被挂马

访问时uchome.c1gstudio.com卡巴斯基报木马,nod32和诺顿无反应。

寻找挂马方式 ie8+开发和用http_watch发现有挂马请求,ie6,ie7+flidder2,firefox 2和3+firebug无法发现请求. 请求地址为(实际地址已隐去，只作示例)

http://xxx.xxxw3.com/a.js

查看首页原码无此请求，但用dom查看器可以发现。制作一临时html文件，copy首页源代码放入，通过增删代码找到木马放在/source/script_common.js中 ftp到server查看该文件已被修改并在首行有以下请求代码。

document.writeln(“”);

在uchome.c1gstudio.com/下还有一x.php 十分可疑下载下来是加密过的,破解后为”黑狼PHP木马”. 文件上传日期为2009/04/20.

搜索文件其它域名根目录下也有此文件，立即将其改名禁止攻击者访问。

find /opt/htdocs -name ‘x.php’ -print

攻击者怎么把木马放上来的呢？ 搜索近期的web访问日志，看看攻击者都做了什么操作。

cat /opt/nging/logs/uchome.c1gstudio.com.log |grep /x.php

得到攻击者ip后，再查ip

cat /opt/nging/logs/uchome.c1gstudio.com.log |grep 125.70.209.110 125.70.209.110 – – [20/Apr/2009:10:12:16 +0800] “GET / HTTP/1.1” 200 5129 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [20/Apr/2009:10:12:17 +0800] “GET / HTTP/1.1” 200 5130 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [20/Apr/2009:10:12:22 +0800] “-” 400 0 “-” “-” – 125.70.209.110 – – [20/Apr/2009:10:12:35 +0800] “GET //x.php HTTP/1.1” 200 444 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [20/Apr/2009:10:12:35 +0800] “GET /favicon.ico HTTP/1.1” 200 3638 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” –

木马已上传，再换个日期查

cat /opt/nging/logs/uchome.c1gstudio.com.20090419.log |grep 125.70.209.110 125.70.209.110 – – [19/Apr/2009:19:25:01 +0800] “GET /../admin/index.asp HTTP/1.1” 400 170 “-” “-” – 125.70.209.110 – – [19/Apr/2009:19:25:09 +0800] “GET /../admin/default.asp HTTP/1.1” 400 170 “-” “-” – 125.70.209.110 – – [19/Apr/2009:19:25:12 +0800] “GET /../admin/manage.asp HTTP/1.1” 400 170 “-” “-” – 125.70.209.110 – – [19/Apr/2009:19:40:01 +0800] “GET / HTTP/1.1” 200 5234 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:40:48 +0800] “GET /do.php?ac=sendmail&rand=1240141201 HTTP/1.1” 200 35 “http://uchome.c1gstudio.com/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:40:48 +0800] “GET /favicon.ico HTTP/1.1” 200 3638 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:42:35 +0800] “GET /includes/class.Member.php HTTP/1.1” 404 526 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:42:36 +0800] “GET /favicon.ico HTTP/1.1” 304 0 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:42:45 +0800] “GET /includes/ HTTP/1.1” 404 526 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:42:46 +0800] “GET /favicon.ico HTTP/1.1” 304 0 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:43:19 +0800] “GET / HTTP/1.1” 200 5236 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:43:27 +0800] “GET /do.php?ac=sendmail&rand=1240141399 HTTP/1.1” 200 35 “http://uchome.c1gstudio.com/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:43:28 +0800] “GET /favicon.ico HTTP/1.1” 200 3638 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:44:17 +0800] “GET /x.php HTTP/1.1” 404 526 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:44:17 +0800] “GET /favicon.ico HTTP/1.1” 304 0 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” –

攻击者在扫描网站，但还未上传x.php，应该不是在这个域名下上传的。换个域名

125.70.209.110 – – [19/Apr/2009:19:25:36 +0800] “GET /DB%23steer/DBBACK/[email protected] HTTP/1.1” 404 3864 “-” “Mozilla/4.0” – 125.70.209.110 – – [19/Apr/2009:19:25:38 +0800] “GET //guanli/ HTTP/1.1” 302 5 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:25:38 +0800] “GET //guanli/login.php?gotopage=%2F%2Fguanli%2F HTTP/1.1” 200 984 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:25:42 +0800] “GET //include/vdimgck.php HTTP/1.1” 200 1304 “http://file.c1gstudio.com//guanli/login.php?gotopage=%2F%2Fguanli%2F” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:25:44 +0800] “GET /favicon.ico HTTP/1.1” 404 1803 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:25:51 +0800] “GET //guanli/ruletest.php HTTP/1.1” 200 1152 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:25:52 +0800] “GET /favicon.ico HTTP/1.1” 404 1803 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:25:59 +0800] “POST //guanli/ruletest.php HTTP/1.1” 200 48 “http://file.c1gstudio.com//guanli/ruletest.php” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:26:02 +0800] “GET //guanli/yhs.php HTTP/1.1” 200 35 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:26:03 +0800] “GET /favicon.ico HTTP/1.1” 404 1803 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:26:11 +0800] “GET /guanli/yhs.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42 HTTP/1.1” 200 2536 “http://file.c1gstudio.com//guanli/yhs.php” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:26:11 +0800] “GET /guanli/yhs.php?=PHPE9568F35-D428-11d2-A769-00AA001ACF42 HTTP/1.1” 200 2158 “http://file.c1gstudio.com//guanli/yhs.php” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:26:11 +0800] “POST //guanli/yhs.php HTTP/1.1” 200 8617 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:26:13 +0800] “POST //guanli/yhs.php HTTP/1.1” 200 77 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:26:40 +0800] “POST //guanli/yhs.php HTTP/1.1” 200 53 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:26:47 +0800] “GET //guanli/x.php HTTP/1.1” 200 444 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:26:48 +0800] “GET /favicon.ico HTTP/1.1” 404 1803 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:26:51 +0800] “POST //guanli/x.php HTTP/1.1” 200 159 “http://file.c1gstudio.com//guanli/x.php” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” – 125.70.209.110 – – [19/Apr/2009:19:26:54 +0800] “GET /guanli/x.php HTTP/1.1” 200 444 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727)” –

攻击方法 攻击者通过//guanli/ruletest.php 上传yhs.php 并上传x.php木马通过x.php对文件植入代码

系统漏洞 ruletest.php 为dede cms的安全漏洞

查找感杂文件 查找web文件夹中是否有挂马 find /opt/htdocs -name “.js” -exec grep -I -l “w3.com” {} \; find /opt/htdocs -name “.htm” -exec grep -I -l “w3.com” {} \; find /opt/htdocs -name “.html” -exec grep -I -l “w3.com” {} \; find /opt/htdocs -name “.php” -exec grep -I -l “w3.com” {} \;

查找web文件夹中是否还有后门 find /opt/htdocs -name “x.php” -print;

最近修改过的文件(后门可以自定文件修改时间，所以这个不可靠) find /opt/htdocs -mtime -1 -type f -exec ls -l {} \;

攻击者将多个挂马插入大部分html,js,php，404.htm等也有改名上传了多个木马在不同目录，并在原有程序上按插上传代码。

修复方法 由于感染太多就将原有web目录移除，并重新上传文件。删除dede的后台修改mysql,主机,web等管理密码。

Posted in 安全.

Tagged with 挂马, 木马.

rev="post-448" No comments

By C1G – 2009/04/23

nginx rewrite 参数和例子

推荐参考地址： Mailing list ARChives 官方讨论区 http://marc.info/?l=nginx

Nginx 常见应用技术指南[Nginx Tips] http://bbs.linuxtone.org/thread-1685-1-1.html

本日志内容来自互联网和平日使用经验，整理一下方便日后参考。

正则表达式匹配，其中：

* ~ 为区分大小写匹配 * ~* 为不区分大小写匹配 * !~和!~*分别为区分大小写不匹配及不区分大小写不匹配

文件及目录匹配，其中：

* -f和!-f用来判断是否存在文件 * -d和!-d用来判断是否存在目录 * -e和!-e用来判断是否存在文件或目录 * -x和!-x用来判断文件是否可执行

flag标记有：

* last 相当于Apache里的[L]标记，表示完成rewrite * break 终止匹配, 不再匹配后面的规则 * redirect 返回302临时重定向地址栏会显示跳转后的地址 * permanent 返回301永久重定向地址栏会显示跳转后的地址

一些可用的全局变量有，可以用做条件判断(待补全)

$args $content_length $content_type $document_root $document_uri $host $http_user_agent $http_cookie $limit_rate $request_body_file $request_method $remote_addr $remote_port $remote_user $request_filename $request_uri $query_string $scheme $server_protocol $server_addr $server_name $server_port $uri

结合QeePHP的例子

if (!-d $request_filename) { rewrite ^/([a-z-A-Z]+)/([a-z-A-Z]+)/?(.*)$ /index.php?namespace=user&controller=$1&action=$2&$3 last; rewrite ^/([a-z-A-Z]+)/?$ /index.php?namespace=user&controller=$1 last; break;

多目录转成参数 abc.domian.com/sort/2 => abc.domian.com/index.php?act=sort&name=abc&id=2

if ($host ~* (.*)\.domain\.com) { set $sub_name $1; rewrite ^/sort\/(\d+)\/?$ /index.php?act=sort&cid=$sub_name&id=$1 last; }

目录对换 /123456/xxxx -> /xxxx?id=123456

rewrite ^/(\d+)/(.+)/ /$2?id=$1 last;

例如下面设定nginx在用户使用ie的使用重定向到/nginx-ie目录下：

if ($http_user_agent ~ MSIE) { rewrite ^(.*)$ /nginx-ie/$1 break; }

目录自动加“/”

if (-d $request_filename){ rewrite ^/(.*)([^/])$ http://$host/$1$2/ permanent; }

禁止htaccess

location ~/\.ht { deny all; }

禁止多个目录

location ~ ^/(cron|templates)/ { deny all; break; }

禁止以/data开头的文件 可以禁止/data/下多级目录下.log.txt等请求;

location ~ ^/data { deny all; }

禁止单个目录 不能禁止.log.txt能请求

location /searchword/cron/ { deny all; }

禁止单个文件

location ~ /data/sql/data.sql { deny all; }

给favicon.ico和robots.txt设置过期时间; 这里为favicon.ico为99天,robots.txt为7天并不记录404错误日志

location ~(favicon.ico) { log_not_found off; expires 99d; break; } location ~(robots.txt) { log_not_found off; expires 7d; break; }

设定某个文件的过期时间;这里为600秒，并不记录访问日志

location ^~ /html/scripts/loadhead_1.js { access_log off; root /opt/lampp/htdocs/web; expires 600; break; }

文件反盗链并设置过期时间 这里的return 412 为自定义的http状态码，默认为403，方便找出正确的盗链的请求 “rewrite ^/ http://leech.c1gstudio.com/leech.gif;”显示一张防盗链图片 “access_log off;”不记录访问日志，减轻压力 “expires 3d”所有文件3天的浏览器缓存

location ~* ^.+\.(jpg|jpeg|gif|png|swf|rar|zip|css|js)$ { valid_referers none blocked *.c1gstudio.com *.c1gstudio.net localhost 208.97.167.194; if ($invalid_referer) { rewrite ^/ http://leech.c1gstudio.com/leech.gif; return 412; break; } access_log off; root /opt/lampp/htdocs/web; expires 3d; break; }

只充许固定ip访问网站，并加上密码

root /opt/htdocs/www; allow 208.97.167.194; allow 222.33.1.2; allow 231.152.49.4; deny all; auth_basic “C1G_ADMIN”; auth_basic_user_file htpasswd;

将多级目录下的文件转成一个文件，增强seo效果 /job-123-456-789.html 指向/job/123/456/789.html

rewrite ^/job-([0-9]+)-([0-9]+)-([0-9]+)\.html$ /job/$1/$2/jobshow_$3.html last;

将根目录下某个文件夹指向2级目录 如/shanghaijob/ 指向 /area/shanghai/ 如果你将last改成permanent，那么浏览器地址栏显是/location/shanghai/

rewrite ^/([0-9a-z]+)job/(.*)$ /area/$1/$2 last;

上面例子有个问题是访问/shanghai 时将不会匹配

rewrite ^/([0-9a-z]+)job$ /area/$1/ last; rewrite ^/([0-9a-z]+)job/(.*)$ /area/$1/$2 last;

这样/shanghai 也可以访问了，但页面中的相对链接无法使用，如./list_1.html真实地址是/area/shanghia/list_1.html会变成/list_1.html,导至无法访问。

那我加上自动跳转也是不行咯 (-d $request_filename)它有个条件是必需为真实目录，而我的rewrite不是的，所以没有效果

if (-d $request_filename){ rewrite ^/(.*)([^/])$ http://$host/$1$2/ permanent; }

知道原因后就好办了，让我手动跳转吧

rewrite ^/([0-9a-z]+)job$ /$1job/ permanent; rewrite ^/([0-9a-z]+)job/(.*)$ /area/$1/$2 last;

文件和目录不存在的时候重定向：

if (!-e $request_filename) { proxy_pass http://127.0.0.1; }

域名跳转

server { listen 80; server_name jump.c1gstudio.com; index index.html index.htm index.php; root /opt/lampp/htdocs/www; rewrite ^/ http://www.c1gstudio.com/; access_log off; }

多域名转向

server_name www.c1gstudio.com www.c1gstudio.net; index index.html index.htm index.php; root /opt/lampp/htdocs; if ($host ~ “c1gstudio\.net”) { rewrite ^(.*) http://www.c1gstudio.com$1 permanent; }

三级域名跳转

if ($http_host ~* “^(.*)\.i\.c1gstudio\.com$”) { rewrite ^(.*) http://top.c1gstudio.com$1; break; }

域名镜向

server { listen 80; server_name mirror.c1gstudio.com; index index.html index.htm index.php; root /opt/lampp/htdocs/www; rewrite ^/(.*) http://www.c1gstudio.com/$1 last; access_log off; }

某个子目录作镜向

location ^~ /zhaopinhui { rewrite ^.+ http://zph.c1gstudio.com/ last; break; }

discuz ucenter home (uchome) rewrite

rewrite ^/(space|network)-(.+)\.html$ /$1.php?rewrite=$2 last; rewrite ^/(space|network)\.html$ /$1.php last; rewrite ^/([0-9]+)$ /space.php?uid=$1 last;

discuz 7 rewrite

rewrite ^(.*)/archiver/((fid|tid)-[\w\-]+\.html)$ $1/archiver/index.php?$2 last; rewrite ^(.*)/forum-([0-9]+)-([0-9]+)\.html$ $1/forumdisplay.php?fid=$2&page=$3 last; rewrite ^(.*)/thread-([0-9]+)-([0-9]+)-([0-9]+)\.html$ $1/viewthread.php?tid=$2&extra=page\%3D$4&page=$3 last; rewrite ^(.*)/profile-(username|uid)-(.+)\.html$ $1/viewpro.php?$2=$3 last; rewrite ^(.*)/space-(username|uid)-(.+)\.html$ $1/space.php?$2=$3 last; rewrite ^(.*)/tag-(.+)\.html$ $1/tag.php?name=$2 last;

给discuz某版块单独配置域名

server_name bbs.c1gstudio.com news.c1gstudio.com; location = / { if ($http_host ~ news\.c1gstudio.com$) { rewrite ^.+ http://news.c1gstudio.com/forum-831-1.html last; break; } }

discuz ucenter 头像 rewrite 优化

location ^~ /ucenter { location ~ .*\.php?$ { #fastcgi_pass unix:/tmp/php-cgi.sock; fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; include fcgi.conf; } location /ucenter/data/avatar { log_not_found off; access_log off; location ~ /(.*)_big\.jpg$ { error_page 404 /ucenter/images/noavatar_big.gif; } location ~ /(.*)_middle\.jpg$ { error_page 404 /ucenter/images/noavatar_middle.gif; } location ~ /(.*)_small\.jpg$ { error_page 404 /ucenter/images/noavatar_small.gif; } expires 300; break; } }

jspace rewrite

location ~ .*\.php?$ { #fastcgi_pass unix:/tmp/php-cgi.sock; fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; include fcgi.conf; } location ~* ^/index.php/ { rewrite ^/index.php/(.*) /index.php?$1 break; fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; include fcgi.conf; }

wordpress rewrite

location / { index index.html index.php; if (-f $request_filename/index.html){ rewrite (.*) $1/index.html break; } if (-f $request_filename/index.php){ rewrite (.*) $1/index.php; } if (!-e $request_filename) { rewrite (.*) /index.php; } }

2010-1-11更新
discuzx 1.5 rewrite

rewrite ^([^\.]*)/topic-(.+)\.html$ $1/portal.php?mod=topic&topic=$2 last; rewrite ^([^\.]*)/article-([0-9]+)-([0-9]+)\.html$ $1/portal.php?mod=view&aid=$2&page=$3 last; rewrite ^([^\.]*)/forum-(\w+)-([0-9]+)\.html$ $1/forum.php?mod=forumdisplay&fid=$2&page=$3 last; rewrite ^([^\.]*)/thread-([0-9]+)-([0-9]+)-([0-9]+)\.html$ $1/forum.php?mod=viewthread&tid=$2&extra=page%3D$4&page=$3 last; rewrite ^([^\.]*)/group-([0-9]+)-([0-9]+)\.html$ $1/forum.php?mod=group&fid=$2&page=$3 last; rewrite ^([^\.]*)/space-(username|uid)-(.+)\.html$ $1/home.php?mod=space&$2=$3 last; rewrite ^([^\.]*)/([a-z]+)-(.+)\.html$ $1/$2.php?rewrite=$3 last; if (!-e $request_filename) { return 404; }

动态参数rewrite 以discuz7.2到discuzx1.5为例

if ($query_string ~* tid=([0-9]+)) { set $id $1; rewrite “^(.*)/viewthread.php$” $1/forum.php?mod=viewthread&tid=$id&extra=page%3D&page=1 last; } if ($query_string ~* gid=([0-9]+)) { set $id $1; rewrite “^(.*)/index.php$” $1/forum.php?gid=$id last; } rewrite ^([^\.]*)/archiver/$ $1/forum.php?archiver=1 last;

2011-4-21更新
nginx 嵌套if nginx不支持if and和多层嵌套if,让我头痛很久,需要通过其它方法实现. 下面是把访问镜像网站cnc.c1gstudio.com的爬虫转到www站.

set $needrewrite ”; if ($http_user_agent ~* (baiduspider|googlebot|soso|bing|sogou|yahoo|sohu-search|yodao|YoudaoBot|robozilla|msnbot|MJ12bot|NHN|Twiceler)) { set $needrewrite ‘o’; } if ($host ~ cnc\.c1gstudio\.com) { set $needrewrite “${needrewrite}k”; } if ($needrewrite = ok) { #return 403; rewrite ^(.*) http://www.c1gstudio.com$1 permanent; }

reload nginx后可以用curl来做测试 curl -I -A “soso” cnc.c1gstudio.com

2026-5-15 更新

以上rewrite规则需增加补获。如

if (-d $request_filename) {
    rewrite ^/(?
<path1>.*)(?<path2>[^/])$ $scheme://$host/${path1}${path2}/ permanent;
}

Nginx CVE‑2026‑42945高危漏洞 https://blog.c1gstudio.com/archives/2227

apache 转 nginx 规则工具 http://www.ubuntuset.com/apache2nginx

Posted in Nginx, 技术.

Tagged with nginx, rewrite.

rev="post-434" 8 comments

By C1G – 2009/04/16

linux查看io状态脚本

#查看占用io的进程

ps -eo pid,user,wchan=WIDE-WCHAN-COLUMN -o s,cmd|awk ‘ $4 ~ /D/ {print $0}’ #进程打开的文件 lsof -p $pid

使用block_dump

/etc/init.d/syslog stop echo 1 > /proc/sys/vm/block_dump sleep 60 dmesg | awk ‘/(READ|WRITE|dirtied)/ {process[$1]++} END {for (x in process) \ print process[x],x}’ |sort -nr |awk ‘{print $2 ” ” $1}’ | \ head -n 10 echo 0 > /proc/sys/vm/block_dump /etc/init.d/syslog start

以下为结果

Shutting down kernel logger: [ OK ] Shutting down system logger: [ OK ] kjournald(1860): 1156 pdflush(78): 716 kjournald(1861): 130 nginx(13571): 88 rm(21542): 85 find(21540): 67 nginx(13568): 65 nginx(13570): 41 php-cgi(13612): 37 nginx(13566): 34 Starting system logger: [ OK ] Starting kernel logger: [ OK ]

脚本下载 block_dump

Posted in shell, 技术.

Tagged with io, LINUX, shell.

rev="post-427" No comments

By C1G – 2009/03/24

baidu spider的log

将a.domain.com域名解析为127.0.0.1后的记录. 应用为ucenter home

以下为tail -n200 a.domain.com.log 220.181.50.208 – – [18/Mar/2009:09:48:40 +0800] “GET /space-809396.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.172 – – [18/Mar/2009:09:48:51 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.209 – – [18/Mar/2009:09:49:06 +0800] “GET /space-784092-do-album-id-203.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.212 – – [18/Mar/2009:09:50:12 +0800] “GET /space-779258.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.198 – – [18/Mar/2009:09:50:52 +0800] “GET /space-777376.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.217 – – [18/Mar/2009:09:52:00 +0800] “GET /space-6363.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.211 – – [18/Mar/2009:09:52:39 +0800] “GET /space-607982.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.221 – – [18/Mar/2009:09:53:44 +0800] “GET /space-599160.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.204 – – [18/Mar/2009:09:54:11 +0800] “GET /space-499254.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.205 – – [18/Mar/2009:09:54:37 +0800] “GET /space-497154.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.218 – – [18/Mar/2009:09:55:31 +0800] “GET /space-494593.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.221 – – [18/Mar/2009:09:55:57 +0800] “GET /space-492013.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.216 – – [18/Mar/2009:09:56:24 +0800] “GET /space-490297.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.197 – – [18/Mar/2009:09:57:19 +0800] “GET /space-486729.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.201 – – [18/Mar/2009:09:57:46 +0800] “GET /space-376054.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.205 – – [18/Mar/2009:09:58:13 +0800] “GET /space-374997.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.203 – – [18/Mar/2009:09:59:06 +0800] “GET /space-285986-do-album-id-118.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.223 – – [18/Mar/2009:09:59:20 +0800] “GET /space-262374.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 60.28.22.31 – – [18/Mar/2009:09:59:22 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.220 – – [18/Mar/2009:10:04:45 +0800] “GET /space-901853-do-album-id-598.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.249.203 – – [18/Mar/2009:10:17:06 +0800] “GET /space-345701-do-friend.html HTTP/1.1” 302 158 “-” “Mozilla/5.0 (compatible; YoudaoBot/1.0; http://www.youdao.com/help/webmaster/spider/; )” – 61.135.249.203 – – [18/Mar/2009:10:17:24 +0800] “GET /space-525947-do-album-id-98.html HTTP/1.1” 302 158 “-” “Mozilla/5.0 (compatible; YoudaoBot/1.0; http://www.youdao.com/help/webmaster/spider/; )” – 61.135.168.42 – – [18/Mar/2009:10:28:42 +0800] “GET /space-447579.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:10:47:09 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:10:51:12 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:10:51:45 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:10:51:47 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:10:51:51 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:10:52:20 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:10:52:22 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:10:52:38 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:10:52:55 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:10:53:31 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.219 – – [18/Mar/2009:10:53:40 +0800] “GET /space-mtag-id-6.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:10:53:48 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.212 – – [18/Mar/2009:10:54:43 +0800] “GET /space.php?uid=552470 HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.196 – – [18/Mar/2009:10:55:24 +0800] “GET /space-736983-do-album-id-208.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.219 – – [18/Mar/2009:10:56:03 +0800] “GET /space-460034.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:10:57:09 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.197 – – [18/Mar/2009:11:10:34 +0800] “GET /space-770485.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.165.155 – – [18/Mar/2009:11:35:30 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.165.155 – – [18/Mar/2009:11:35:30 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 220.181.3.108 – – [18/Mar/2009:11:35:31 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 220.181.3.108 – – [18/Mar/2009:11:35:31 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.166.30 – – [18/Mar/2009:11:35:31 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.166.30 – – [18/Mar/2009:11:35:31 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.166.30 – – [18/Mar/2009:11:35:31 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.166.30 – – [18/Mar/2009:11:35:31 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 220.181.5.33 – – [18/Mar/2009:11:35:32 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 220.181.5.33 – – [18/Mar/2009:11:35:32 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.162.17 – – [18/Mar/2009:11:35:32 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.162.17 – – [18/Mar/2009:11:35:32 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 220.181.3.109 – – [18/Mar/2009:11:35:33 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 220.181.3.109 – – [18/Mar/2009:11:35:33 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.166.30 – – [18/Mar/2009:11:35:33 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.166.30 – – [18/Mar/2009:11:35:33 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.190.216 – – [18/Mar/2009:11:42:34 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.214 – – [18/Mar/2009:11:43:16 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.208 – – [18/Mar/2009:11:43:30 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:11:53:18 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.32.77 – – [18/Mar/2009:11:58:58 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.32.77 – – [18/Mar/2009:11:59:13 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.217 – – [18/Mar/2009:11:59:15 +0800] “GET /space.php?do=mtag&tagid=15 HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.220 – – [18/Mar/2009:11:59:55 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.220 – – [18/Mar/2009:11:59:56 +0800] “GET /space-mtag-tagid-45.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.215 – – [18/Mar/2009:12:00:09 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.196 – – [18/Mar/2009:12:00:23 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.201 – – [18/Mar/2009:12:01:02 +0800] “GET /space-918840.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.205 – – [18/Mar/2009:12:02:07 +0800] “GET /space-916580.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.214 – – [18/Mar/2009:12:02:46 +0800] “GET /space-913229.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.215 – – [18/Mar/2009:12:03:14 +0800] “GET /space-541060-do-album-id-498.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.202 – – [18/Mar/2009:12:03:56 +0800] “GET /space-826180.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.206 – – [18/Mar/2009:12:04:22 +0800] “GET /space-821639.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.205 – – [18/Mar/2009:12:04:35 +0800] “GET /space-806785-do-album-id-451.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.208 – – [18/Mar/2009:12:04:48 +0800] “GET /space-780475.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.203 – – [18/Mar/2009:12:05:01 +0800] “GET /space-774338.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.220 – – [18/Mar/2009:12:05:27 +0800] “GET /space-751722-do-friend-view-visitor.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.207 – – [18/Mar/2009:12:05:48 +0800] “GET /space-751722-do-doing-doid-245-goto-yes.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.207 – – [18/Mar/2009:12:06:03 +0800] “GET /space-733073.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.210 – – [18/Mar/2009:12:06:18 +0800] “GET /space-729185-do-blog-id-836.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.199 – – [18/Mar/2009:12:06:33 +0800] “GET /space-686324.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.204 – – [18/Mar/2009:12:06:48 +0800] “GET /space-669486.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.212 – – [18/Mar/2009:12:07:19 +0800] “GET /space-644815.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.213 – – [18/Mar/2009:12:07:35 +0800] “GET /space-543575.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.215 – – [18/Mar/2009:12:07:50 +0800] “GET /space-443334-do-doing-doid-306.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.196 – – [18/Mar/2009:12:08:05 +0800] “GET /space-430428.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.223 – – [18/Mar/2009:12:08:21 +0800] “GET /space-388418.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.218 – – [18/Mar/2009:12:08:37 +0800] “GET /space-2862-do-doing-view-me.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.200 – – [18/Mar/2009:12:09:08 +0800] “GET /space-2862-do-doing-doid-601-goto-yes.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.200 – – [18/Mar/2009:12:09:23 +0800] “GET /space-2862-do-blog-id-648.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.197 – – [18/Mar/2009:12:10:54 +0800] “GET /space-119671-do-blog-id-571.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.32.77 – – [18/Mar/2009:12:16:00 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.32.77 – – [18/Mar/2009:12:16:04 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.32.77 – – [18/Mar/2009:12:16:07 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.214 – – [18/Mar/2009:12:17:30 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.165.155 – – [18/Mar/2009:12:18:12 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.165.155 – – [18/Mar/2009:12:18:12 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.166.30 – – [18/Mar/2009:12:18:13 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.166.30 – – [18/Mar/2009:12:18:13 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.165.155 – – [18/Mar/2009:12:18:13 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.165.155 – – [18/Mar/2009:12:18:13 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 220.181.5.33 – – [18/Mar/2009:12:18:14 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 220.181.5.33 – – [18/Mar/2009:12:18:14 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.162.17 – – [18/Mar/2009:12:18:14 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.162.17 – – [18/Mar/2009:12:18:14 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.166.30 – – [18/Mar/2009:12:18:15 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 220.181.5.67 – – [18/Mar/2009:12:18:15 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.166.30 – – [18/Mar/2009:12:18:15 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 220.181.5.67 – – [18/Mar/2009:12:18:15 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 220.181.3.109 – – [18/Mar/2009:12:18:18 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 220.181.3.109 – – [18/Mar/2009:12:18:18 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.190.206 – – [18/Mar/2009:12:23:28 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:12:30:18 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:12:30:20 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:12:31:42 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:12:32:02 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:12:32:21 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.198 – – [18/Mar/2009:12:33:17 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.219 – – [18/Mar/2009:12:33:31 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.199 – – [18/Mar/2009:12:33:46 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.199 – – [18/Mar/2009:12:33:57 +0800] “GET /space-787124-do-album-id-565.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.200 – – [18/Mar/2009:12:34:00 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.223 – – [18/Mar/2009:12:34:14 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.210 – – [18/Mar/2009:12:34:30 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.42 – – [18/Mar/2009:12:50:32 +0800] “GET /space-105598.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.32.77 – – [18/Mar/2009:12:50:36 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 58.61.124.223 – – [18/Mar/2009:12:58:05 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB5; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506)” – 58.61.124.223 – – [18/Mar/2009:12:58:06 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB5; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506)” – 61.135.190.217 – – [18/Mar/2009:13:07:25 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.207 – – [18/Mar/2009:13:07:41 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.204 – – [18/Mar/2009:13:07:56 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.202 – – [18/Mar/2009:13:08:27 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:13:12:57 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:13:16:19 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 221.238.193.47 – – [18/Mar/2009:13:22:04 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0” – 61.135.168.42 – – [18/Mar/2009:13:23:38 +0800] “GET /exam/ HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.42 – – [18/Mar/2009:13:35:29 +0800] “GET /space-516643-do-blog-id-714.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.207 – – [18/Mar/2009:13:40:27 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.221 – – [18/Mar/2009:13:40:41 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.198 – – [18/Mar/2009:13:40:55 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.198 – – [18/Mar/2009:13:41:23 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.219 – – [18/Mar/2009:14:10:58 +0800] “GET /space-824406.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.196 – – [18/Mar/2009:14:11:18 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.196 – – [18/Mar/2009:14:11:59 +0800] “GET /space-822943-do-album-id-297.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.196 – – [18/Mar/2009:14:12:44 +0800] “GET /space-819218-do-blog-id-713.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.198 – – [18/Mar/2009:14:13:30 +0800] “GET /space-817806.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.219 – – [18/Mar/2009:14:13:32 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.216 – – [18/Mar/2009:14:13:47 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.214 – – [18/Mar/2009:14:14:02 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.205 – – [18/Mar/2009:14:14:17 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.222 – – [18/Mar/2009:14:14:32 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.222 – – [18/Mar/2009:14:14:46 +0800] “GET /space-776343.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.204 – – [18/Mar/2009:14:14:47 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.206 – – [18/Mar/2009:14:15:17 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.200 – – [18/Mar/2009:14:15:33 +0800] “GET /space-771638.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.197 – – [18/Mar/2009:14:16:04 +0800] “GET /space-710456.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.222 – – [18/Mar/2009:14:16:27 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.210 – – [18/Mar/2009:14:16:35 +0800] “GET /space-690048.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 220.181.50.220 – – [18/Mar/2009:14:17:20 +0800] “GET /space-552470-do-thread-id-58.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.42 – – [18/Mar/2009:14:30:35 +0800] “GET /space-443334.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.196 – – [18/Mar/2009:14:46:30 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.223 – – [18/Mar/2009:14:46:45 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.205 – – [18/Mar/2009:14:46:59 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.199 – – [18/Mar/2009:14:47:13 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.222 – – [18/Mar/2009:14:47:27 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.201 – – [18/Mar/2009:14:47:41 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.219 – – [18/Mar/2009:14:48:09 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.208 – – [18/Mar/2009:14:48:37 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.42 – – [18/Mar/2009:14:54:56 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.170 – – [18/Mar/2009:15:29:04 +0800] “GET /robots.txt HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.168.42 – – [18/Mar/2009:15:33:23 +0800] “GET /space-790405.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.141.98.2 – – [18/Mar/2009:15:34:15 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0(compatible; MSIE 5.0; Windows 98; DigExt)” – 61.135.168.42 – – [18/Mar/2009:15:38:47 +0800] “GET /space-525947.html HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.209 – – [18/Mar/2009:15:53:11 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.165.155 – – [18/Mar/2009:16:06:15 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.165.155 – – [18/Mar/2009:16:06:15 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 220.181.3.108 – – [18/Mar/2009:16:06:16 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 220.181.3.108 – – [18/Mar/2009:16:06:16 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 220.181.5.59 – – [18/Mar/2009:16:06:16 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 220.181.5.59 – – [18/Mar/2009:16:06:16 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.166.30 – – [18/Mar/2009:16:06:20 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.166.30 – – [18/Mar/2009:16:06:20 +0800] “GET / HTTP/1.1” 302 158 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; baidu Transcoder;)” – 61.135.190.214 – – [18/Mar/2009:16:22:05 +0800] “GET /blog/blog_article.php?Id=1146 HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 60.28.17.35 – – [18/Mar/2009:16:33:02 +0800] “GET /album/photo_show.php HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.215 – – [18/Mar/2009:16:41:51 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.196 – – [18/Mar/2009:16:42:05 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.205 – – [18/Mar/2009:16:42:20 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.204 – – [18/Mar/2009:16:42:34 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.211 – – [18/Mar/2009:16:42:48 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.198 – – [18/Mar/2009:16:43:02 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.207 – – [18/Mar/2009:16:43:30 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 60.28.17.35 – – [18/Mar/2009:16:45:35 +0800] “GET /album/photo_show.php?Id=811 HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.214 – – [18/Mar/2009:17:31:19 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.223 – – [18/Mar/2009:17:31:33 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.203 – – [18/Mar/2009:17:31:47 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.197 – – [18/Mar/2009:17:32:01 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.222 – – [18/Mar/2009:17:32:15 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.209 – – [18/Mar/2009:17:32:29 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.215 – – [18/Mar/2009:17:32:57 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” – 61.135.190.216 – – [18/Mar/2009:17:33:57 +0800] “GET / HTTP/1.1” 302 158 “-” “Baiduspider+(+http://www.baidu.com/search/spider.htm)” –

Posted in 其它, 分析报告.

Tagged with baidu, spider.

rev="post-417" No comments

By C1G – 2009/03/18

修复discuz误删分类

同事在discuz后台不小心将贴子分类全部删除。

解压今日凌晨的备份

cd /home/backup tar -xvf discuz.tar #discuz后台出公告后，关闭discuz /opt/lemp stopmysql #备份当前discuz cd /opt/mysql/var tar -cvf discuz090316.tar ./discuz mkdir discuz2 chown mysql:mysql discuz2 mv /home/backup/opt/mysql/var/discuz/* ./discuz2/ /opt/lemp startmysql

#进入phpmyadmin 导出discuz2库的threadtypes结构的数据+droptable，导入discuz库执行sql

update discuz.cdb_forumfields,discuz2.cdb_forumfields set discuz.cdb_forumfields.threadtypes=discuz2.cdb_forumfields.threadtypes where discuz.cdb_forumfields.fid=discuz2.cdb_forumfields.fid; update discuz.cdb_threads,discuz2.cdb_threads set discuz.cdb_threads.typeid=discuz2.cdb_threads.typeid where discuz.cdb_threads.tid=discuz2.cdb_threads.tid;

完成

Posted in Mysql, 技术.

Tagged with discuz, mysql.

rev="post-414" No comments

By C1G – 2009/03/16

用phpmyadmin+editplus快速导出discuz贴子列表

进入phpmyadmin中discuz所在库，执行下面语句

SELECT subject,CONCAT(‘http://bbs.domain.comthread-‘,tid,’-1-1.html’) FROM `cdb_threads` WHERE fid=55 order by tid desc

以静态链接方式显示，其中bbs.domain.com改成你的域名；fid=55改成所需版块id

比较旧的phpmyadmin

我们为谁工作？http://bbs.domain.com/thread-146744-1-1.html 致某些公司：应届生不是农民工，大学不是工地，不会无缘无故给公司当苦力 http://bbs.domain.com/thread-146730-1-1.html

新的phpmyadmin会显示成下面样子

我们为谁工作？[BINARY – 46字节] 致某些公司：应届生不是农民工，大学不是工地，不会无缘无故给公司当苦力[BINARY – 46字节]

点击数据列表左上方的+ Options,选中”显示 BINARY”,就可以出url。

把内容贴至editplus来美化下。 ctrl+v ctrl+h 查找内容”http” 替换内容“ http“ 全部替换,查找内容”html” 替换内容“html\n“ 全部替换。

完成

phpmyadmin+临时表来显示序号

# 第一步，建立表 CREATE TABLE `copy_temp` ( `id` INT NOT NULL AUTO_INCREMENT PRIMARY KEY , `subject` VARCHAR( 255 ) NOT NULL , `url` VARCHAR( 255 ) NOT NULL ) ENGINE = MYISAM AUTO_INCREMENT=1; #第二步，执行并显示 insert into copy_temp(subject,url) select subject ,CONCAT(‘http://bbs.domain.com/thread-‘,tid,’-1-1.html’) FROM `cdb_threads` where fid=55; SELECT id-1,subject,url FROM copy_temp; # 第三步，收尾清空表 TRUNCATE TABLE `copy_temp` ;

Posted in 技术.

Tagged with editplus, phpmyadmin.

rev="post-408" 2 comments

By C1G – 2009/03/12

RedHat 常见守护进程一览

Linux服务器在启动时需要启动很多系统服务，它们向本地和网络用户提供了Linux的系统功能接口，直接面向应用程序和用户。提供这些服务的程序是由运行在后台的守护进程（daemons）来执行的。守护进程是生存期长的一种进程。它们独立于控制终端并且周期性的执行某种任务或等待处理某些发生的事件。他们常常在系统引导装入时启动，在系统关闭时终止。linux系统有很多守护进程，大多数服务器都是用守护进程实现的。同时，守护进程完成许多系统任务，比如，作业规划进程crond、打印进程lqd等。有些书籍和资料也把守护进程称作：“服务”。选择运行哪些守护进程，要根据具体需求决定。查看系统可以提供的守护进程对应的服务，使用下面方法，以root权限运行：

#ntsysv

界面如图1所示的窗口，下面详细介绍一下各项系统服务的功能。以英文字母为序：一、Linux守护进程简介 1. alsasound ：Alsa声卡驱动守护程序。Alsa声卡驱动程序本来是为了一种声卡Gravis UltraSound(GUS)而写的，该程序被证明很优秀，于是作者就开始为一般的声卡写驱动程序。 Alsa和OSS/Free 及OSS/Linux兼容，但是有自己的接口，甚至比OSS优秀。 2. acpid：acpid（Advanced Configuration and Power Interface）是为替代传统的APM电源管理标准而推出的新型电源管理标准。通常笔记本电脑需要启动电源进行管理。 3. atalk：AppleTalk网络守护进程。注意不要在后台运行该程序，该程序的数据结构必须在运行其他进程前先花一定时间初始化。 4. amd：自动安装NFS守护进程。 5. anacron：一个自动化运行任务守护进程。Red Hat Linux 随带四个自动化任务的工具：cron、 anacron、at、和 batc。当你的Linux服务器并不是全天运行，这个anacron就可以帮你执行在”crontab”设定的时间内没有执行的工作。 6. apmd：apmd（Advanced Power Management）是高级电源管理。传统的电源管理标准，对于笔记本电脑比较有用，可以了解系统的电池电量信息。并将相关信息通过syslogd 写入日志。也可以用来在电源不足时关机。 7. arptables_jf ：为arptables网络的用户控制过滤的守护进程。 8. arpwatch：记录日志并构建一个在LAN接口上看到的以太网地址和IP地址对数据库。 atd：at和batch命令守护进程，用户用at命令调度的任务。Batch用于在系统负荷比较低时运行批处理任务。 9. autofs：自动安装管理进程automount，与NFS相关，依赖于NIS服务器。 10. bootparamd：引导参数服务器，为LAN上的无盘工作站提供引导所需的相关信息。 11. bluetooch：蓝牙服务器守护进程。 12. crond ：cron是Unix下的一个传统程序，该程序周期地运行用户调度的任务。比起传统的Unix版本，Linux版本添加了不少属性，而且更安全，配置更简单。类似计划任务。 13. chargen：使用tcp协议的chargen server，chargen（Character Generator Protocol）是一种网络服务，主要功能是提供类似远程打字的功能。 14. chargen-udp：使用UDP协议的chargen server。 15. cpuspeed：监测系统空闲百分比，降低或加快CPU时钟速度和电压从而在系统空闲时将能源消耗降为最小，而在系统繁忙时最大化加快系统执行速度。 16. dhcpd：动态主机控制协议(Dynamic Host Control Protocol)的服务守护进程。 17. cups： cups(Common UNIX Printing System)是通用UNIX打印守护进程，为Linux提供第三代打印功能。 18. cups－config－daemons：cups打印系统切换守护进程。 19. cups-lpd：cups行打印守护进程。 20. daytime：使用TCP 协议的Daytime守护进程，该协议为客户机实现从远程服务器获取日期和时间的功能。预设端口：13。 21. daytime-udp：使用UDP 协议的Daytime守护进程。 22. dc_server：使用SSL安全套接字的代理服务器守护进程。 23. dc_client：使用SSL安全套接字的客户端守护进程。 24. diskdump：服务器磁盘备份守护进程。 25. echo：服务器回显客户数据服务守护进程。 26. echo-udp：使用UDP协议的服务器回显客户数据服务守护进程。 27. eklogin：接受rlogin会话鉴证和用kerberos5加密的一种服务的守护进程。 28. gated ：网关路由守护进程。它支持各种路由协议，包括RIP版本1和2、DCN HELLO协议、 OSPF版本2以及EGP版本2到4。 29. gpm：gpm（General Purpose Mouse Daemon ）守护进程为文本模式下的Linux程序如mc(Midnight Commander)提供了鼠标的支持。它也支持控制台下鼠标的拷贝，粘贴操作以及弹出式菜单。 30. gssftp：使用kerberos 5认证的ftp守护进程 31. httpd：Web服务器Apache守护进程，可用来提供HTML文件以及CGI动态内容服务。 32. inetd ：因特网操作守护程序。监控网络对各种它管理的服务的需求，并在必要的时候启动相应的服务程序。在Redhat 和Mandrake linux中被xinetd代替。Debian, Slackware, SuSE仍然使用。 33. innd：Usenet新闻服务器守护进程。 34. iiim：中文输入法服务器守护进程。 35. iptables：iptables防火墙守护进程。 36. irda：红外端口守护进程。 37. isdn：isdn启动和中止服务守护进程。 38. krb5－telnet:使用kerberos 5认证的telnet守护进程。 39. klogin：远程登陆守护进程。 40. keytable：该进程的功能是转载在/etc/sysconfig/keyboards里定义的键盘映射表，该表可以通过kbdconfig工具进行选择。您应该使该程序处于激活状态。 41. irqbalance：对多个系统处理器环境下的系统中断请求进行负载平衡的守护程序。如果你只安装了一个CPU，就不需要加载这个守护程序。 42. kshell ：kshell守护进程。 43. kudzu：硬件自动检测程序，会自动检测硬件是否发生变动，并相应进行硬件的添加、删除工作。当系统启动时，kudzu会对当前的硬件进行检测，并且和存储在 /etc/sysconfig/hwconf中的硬件信息进行对照，如果某个硬件从系统中被添加或者删除时，那么kudzu就会察觉到，并且通知用户是否进行相关配置，然后修改etc/sysconfig/hwconf，使硬件资料与系统保持同步。如果/etc/sysconfig/hwconf这个文件不存在，那么kudzu将会从/etc/modprobe.conf，/etc/sysconfig/network-scripts/和 etc/X11/XF86Config中探测已经存在的硬件。如果你不打算增加新硬件，那么就可以关闭这个启动服务，以加快系统启动时间。 44. ldap：ldap（Lightweight Directory Access Protocol）目录访问协议服务器守护进程。 45. lm_seroems：检测主板工作情况守护进程。 46. lpd ：lpd是老式打印守护程序，负责将lpr等程序提交给打印作业。 47. mdmonitor：RAID相关设备的守护程序。 48. messagebus：D-BUS是一个库，为两个或两个以上的应用程序提供一对一的通讯。 dbus-daemon-1是一个应用程序，它使用这个库来实现messagebus守护程序。多个应用程序通过连接messagebus守护程序可以实现与其他程序交换信息。 49. microcode_ctl：可编码以及发送新的微代码到内核以更新Intel IA32系列处理器守护进程。 50. mysqld：一个快速高效可靠的轻型SQL数据库引擎守护进程。 51. named：DNS（BIND）服务器守护进程。 52. netplugd：netplugd（network cable hotplug management daemon）守护程序，用于监控一个或多个网络接口的状态，当某些事件触发时运行一个外部脚本程序。 53. netdump：远程网络备份服务器守护进程。 54. netfs：Network Filesystem Mounter，该进程安装和卸载NFS、SAMBA和NCP网络文件系统。 55. nfs：网络文件系统守护进程。 56. nfslock：NFS是一个流行的通过TCP/IP网络共享文件的协议，此守护进程提供了NFS文件锁定功能。 57. ntpd：Network time Protocol daemon（网络时间校正协议）。ntpd是用来使系统和一个精确的时间源保持时间同步的协议守护进程。 58. network：激活/关闭启动时的各个网络接口守护进程。 59. psacct：该守护进程包括几个工具用来监控进程活动的工具，包括ac,lastcomm, accton 和sa。 60. pcmcia：主要用于支持笔记本电脑接口守护进程。 61. portmap：该守护进程用来支持RPC连接，RPC被用于NFS以及NIS 等服务。 62. postgresql: PostgreSQL 关系数据库引擎。 63. proftpd: proftpd 是Unix下的一个配置灵活的ftp服务器的守护程序。 64. pppoe：ADSL连接守护进程。 65. random ：保存和恢复系统的高质量随机数生成器，这些随机数是系统一些随机行为提供的。 66. rawdevices：在使用集群文件系统时用于加载raw设备的守护进程。 67. readahead、readahead_early：readahead和readahead_early是在Fedora core 2中最新推出的两个后台运行的守护程序。其作用是在启动系统期间，将启动系统所要用到的文件首先读取到内存中，然后在内存中进行执行，以加快系统的启动速度。 68. rhnsd：Red Hat 网络服务守护进程。通知官方的安全信息以及为系统打补丁。 69. routed ：该守护程序支持RIP协议的自动IP路由表维护。RIP主要使用在小型网络上，大一点的网络就需要复杂一点的协议。 70. rsync：remote sync远程数据备份守护进程。 71. rsh ：远程主机上启动一个shell，并执行用户命令。 72. rwhod：允许远程用户获得运行rwho守护程序的机器上所有已登录用户的列表。 73. rstatd：一个为LAN上的其它机器收集和提供系统信息的守候进程。 74. ruserd：远程用户定位服务，这是一个基于RPC的服务，它提供关于当前记录到LAN上一个机器日志中的用户信息 75. rwalld：激活rpc.rwall服务进程，这是一项基于RPC的服务，允许用户给每个注册到LAN机器上的其他终端写消息。 76. rwhod：激活rwhod服务进程，它支持LAN的rwho和ruptime服务。 77. saslauthd：使用SASL的认证守护进程。 78. sendmail：邮件服务器sendmail守护进程。 79. smb：Samba文件共享/打印服务守护进程。 80. snmpd：本地简单网络管理守护进程。 81. squid：代理服务器squid守护进程。 82. sshd：OpenSSH服务器守护进程。Secure Shell Protocol可以实现安全地远程管理主机。 83. smartd：Self Monitor Analysis and Reporting Technology System，监控你的硬盘是否出现故障。 84. syslog：一个让系统引导时起动syslog和klogd系统日志守候进程的脚本。 85. time ：该守护进程从远程主机获取时间和日期，采用TCP协议。 86. time-udp：该守护进程从远程主机获取时间和日期，采用UDP协议。 87. tux：在Linux内核中运行apache服务器的守护进程。 88. vsftpd：vsftpd服务器的守护进程。 89. vncserver： VNC （Virtual Network Computing，虚拟网络计算），它提供了一种在本地系统上显示远程计算机整个”桌面”的轻量型协议。 90. xfs：X Window字型服务器守护进程，为本地和远程X服务器提供字型集。 91. xinetd：支持多种网络服务的核心守护进程。 92. ypbind：为NIS（网络信息系统）客户机激活ypbind服务进程。 93. yppasswdd：NIS口令服务器守护进程。 94. ypserv：NIS主服务器守护进程。 95. yum：RPM操作系统自动升级和软件包管理守护进程。

Posted in LINUX, 技术.

Tagged with LINUX, process, redhat.

rev="post-405" No comments

By C1G – 2009/03/11

Linux操作系统下SSH默认22端口修改方法

摘自互联网

NO 1：

01假如要改SSH的默认端口（22），那么你只要修改：/etc/ssh/sshd_config中Port 22，这里把22改成自己要设的端口就行了，不过千万别设和现已有的端口相同哦，以防造成未知后果。

02假如要限制SSH登陆的IP，那么可以如下做：

先：修改/etc/hosts.deny，在其中加入sshd:ALL

然后：修改：/etc/hosts.allow，在其中进行如下设置：sshd:192.168.0.155

这样就可以限制只有192.168.0.155的IP通过SSH登陆上LINUX机器了。当然在做为服务器方面，我都不装gnome和KDE的，而且很多东东都不装，这样增加安全系数。

NO 2：

首先修改配置文件

vi /etc/ssh/sshd_config

找到#Port 22一段，这里是标识默认使用22端口，修改为如下：

Port 22

Port 6022

然后保存退出

执行/etc/init.d/sshd restart 或 kill -HUP `cat /var/run/sshd.pid`

ssh只要你已经连上了，无论重启ssh还是改端口，还是关闭ssh服务，当前已经连上的连接都不会断的。这点和远程配置防火墙是不一样的。因此，远程重启ssh、改ssh端口，甚至暂时关闭ssh都是安全的。

这样SSH端口将同时工作与22和6022上。

现在编辑防火墙配置： vi /etc/sysconfig/iptables 如果有 -A RH-Firewall-1-INPUT -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT 增加一条 -A RH-Firewall-1-INPUT -m state –state NEW -m tcp -p tcp –dport 6022 -j ACCEPT 或

iptables -A INPUT -p tcp --dport 6022 -j ACCEPT
iptables -A OUTPUT -p udp --sport 6022 -j ACCEPT

启用6022端口。

执行/etc/init.d/iptables save (千万别忘了,不然重启后可能不能登录)

执行/etc/init.d/iptables restart

重启sshd服务后，netstat -lnp看一下

现在请使用ssh工具连接6022端口，来测试是否成功。如果连接成功了，则再次编辑sshd_config的设置，将里边的Port22删除，即可。

之所以先设置成两个端口，测试成功后再关闭一个端口，是为了方式在修改conf的过程中，万一出现掉线、断网、误操作等未知情况时候，还能通过另外一个端口连接上去调试以免发生连接不上必须派人去机房，导致问题更加复杂麻烦。

当使用 rsync 远程备份 rsync -lptv /home/andy/localfile -e ‘ssh -p 6022’ sshuser@sshhost:remotefolder

端口转发方法（未测试） iptables -I INPUT -p tcp –dport 22 -j DROP iptables -t nat -I PREROUTING -d 你的IP -p tcp –dport 22 -j DNAT –to 127.0.0.1:新端口

做完可以再用nmap扫一下

防御暴力破解SSH攻击 http://coolerfeng.blog.51cto.com/133059/50947

Posted in LINUX, 安全, 技术.

Tagged with LINUX, ssh.

rev="post-399" 1 comment

By C1G – 2009/03/06

阻止ssh暴力破解的简单方法

某个肉鸡奋斗了几天几夜猜我的密码查看ssh的log并把相关IP放入iptable中来封杀

#屏蔽单个IP iptables -I INPUT -s 221.3.131.110 -j DROP #屏蔽最后一段 iptables -I INPUT -s 221.3.131.0/24 -j DROP #屏蔽最后二段 iptables -I INPUT -s 221.3.0.0/16 -j DROP #删除屏蔽单个IP iptables -D INPUT -s 221.3.131.110 -j DROP #删除INPUT链中第三条规则 iptables -D INPUT 3 #查看iptalbes iptables -L

#防火墙规则只在计算机处于开启状态时才有效。如果系统被重新引导，这些规则就会自动被清除并重设。要保存规则以便今后载入，请使用以下命令

/sbin/service iptables save #查看ssh登录记录 cat /var/log/messages|grep rhost #统计ssh登录记录 cat /var/log/messages|grep rhost|wc -l #显示ssh登录大于1次的ip及数量 cat /var/log/messages|grep rhost| awk ‘{print $13}’|awk ‘BEGIN { FS=”=” } { Num[$2]++ } END { for(i in Num) if(Num[i]>1) { print i,Num[i]} }’ #显示ssh登录大于15次的ip cat /var/log/messages|grep rhost| awk ‘{print $13}’|awk ‘BEGIN { FS=”=” } { Num[$2]++ } END { for(i in Num) if(Num[i]>15) { print i} }’ #禁止ssh登录大于15次的ip（慎用，不要把自已的ip放进去） cat /var/log/messages|grep rhost| awk ‘{print $13}’|awk ‘BEGIN { FS=”=” } { Num[$2]++ } END { for(i in Num) if(Num[i]>15) { print i} }’|xargs -i[] iptables -I INPUT -s [] -j DROP #查看rhel5的ssh登录 cat /var/log/audit/audit.log|grep authentication

暂时缓解方法： iptables -I INPUT -p tcp –dport 22 -m state –state NEW -m limit –limit 5/sec -j DROP iptables -I INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT

脚本： 来自cu的cn_jhz : http://linux.chinaunix.net/bbs/thread-909381-1-4.html

#!/bin/bash MONITOR_FILE=”/var/log/messages” MONITOR_LOG_FILE=”/var/crontab/anti_scan.log” TABLES=”/tmp/anti_scan.pid” tmp=”/tmp/anti_scan.pid.tmp” test -e $TABLES || touch $TABLES test -e $TABLES || touch $tmp while read line do str=`echo $line | grep “authentication failure” | grep -v “grep” | awk ‘{for(x=1;x> $TABLES else echo $str > $TABLES fi cat $TABLES | awk ‘{print $2}’ | sort | uniq -c | sort -rn | xargs -l | \ while read amount ip do if [ $amount -gt 6 ]; then iptables -A INPUT -s $ip -j DROP sed ‘/$ip/d’ $TABLES > $tmp cat $tmp > $TABLES fi done fi done<`tail -f $MONITOR_FILE`

来自cu的platinum http://linux.chinaunix.net/bbs/thread-909563-1-1.html

#! /bin/bash SCANNER=  grep "\date \”+ %d %H:%M\” -d \”-1min\”`” /var/ log /secure|awk ‘/Failed/{print $(NF-3)}’ | sort |uniq –c|awk ‘{print $1″=”$2;}’ `

Name: blockscanner.sh by Platinum

for i in $ SCANNER do NUM= echo $ i |awk -F= '{print $1}'  IP= echo $ i |awk -F= '{print $2}'  echo $ NUM echo $ IP if [ $ NUM – gt 10 ] & & [ –z “iptables -vnL INPUT|grep $IP“ ] then iptables –I INPUT –s $ IP –m state – –state NEW,RELATED,ESTABLISHED –j DROP echo “date $IP($NUM)” > > /var/ log /scanner. log fi done

脚本下载 blockscanner

其它工具： 你也可以使用fail2ban 自动封IP来解决这个问题。 denyhosts sshblack 使用iptable来ban ip总有一天会满的。

其它改善的方法： 如果你是从固定ip使用ssh,用hosts.deny 和hosts.allow配合使用限制IP登陆使用key文件认证修改默认端口

Posted in LINUX, shell, 安全, 技术.

Tagged with iptables, LINUX, shell, ssh.

rev="post-392" No comments

By C1G – 2009/03/05

一个防简单的防ddos工具

http://deflate.medialayer.com/

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

网站被挂马

nginx rewrite 参数和例子

linux查看io状态脚本

baidu spider的log

修复discuz误删分类

用phpmyadmin+editplus快速导出discuz贴子列表

RedHat 常见守护进程一览

Linux操作系统下SSH默认22端口修改方法

阻止ssh暴力破解的简单方法

Name: blockscanner.sh by Platinum

一个防简单的防ddos工具

About C1G军火库

分类

归档

其他操作

近期文章

近期评论

AI

博客互联

安全

我的

技术论坛

收藏夹

架构研发

设计体验

Name: blockscanner.sh by Platinum

Subscribe

About C1G军火库

分类

归档

其他操作

近期文章

近期评论

标签

AI

博客互联

安全

我的

技术论坛

收藏夹

架构研发

设计体验