Linux’da Diğer Kullanıcılardan Processleri Gizleme
Yönettiğimiz sistemde tanımlı birçok kullanıcı olabilir. Çoğu kullanıcı ssh ile kaynaklara erişebilir. Fakat Debian/Ubuntu/RHEL/CentOS Linux sunucuya erişen kullanıların kendilerine ait olmayan süreçleri görmesini engelleyebiliriz.
Eğer, Linux kernel version 3.2+ (veya Debian (unstable)/Ubuntu 14.04/RHEL/CentOS v6.5+ üstü) sürümleri kullanıyorsanız, root user dışındaki diğer kullanıcılardan süreçleri(process) gizleyebilirsiniz.
Linux’da Processleri Gizleme işlemi hayatımıza yukarda belirttiğim kernel versiyonu ile hayatımıza giren hidepid ile yapabiliyoruz
hidepid, procfs (/proc) için yeni bir mount seçeneğidir. hidepid seçenekleri aşağıdaki gibidir.
hidepid = 0 (default) Varsayılan seçenek 0’dır. Herkes tüm süreçleri gözlemleyebilir.
hidepid = 1 Etkin,Tüm süreçler gizlidir fakat /proc/<PID> süreç kimliklerini görmek mümkün.
hidepid = 2 Etkin, Tüm süreçler gizlidir ve /proc/<PID> süreç kimliklerini görmek mümkün değil.
|
1 |
# mount -o remount,rw,hidepid=2 /proc |
Değişikliğin kalıcı olması için
|
1 2 |
# vim /etc/fstab proc /proc proc defaults,hidepid=2 0 0 |
Belli gruba ayrıcalık tanımlayabiliriz.
|
1 |
# mount -o remount,rw,hidepid=2,gid=groupid /proc |
|
1 2 |
# vim /etc/fstab proc /proc proc defaults,hidepid=2,gid=admin 0 0 |
|
1 2 3 4 5 6 7 8 9 10 11 |
[root@omeroner ~]$uname -mrs Linux 2.6.32-431.29.2.el6.x86_64 x86_64 [root@omeroner ~]$mount | grep proc proc on /proc type proc (rw,hidepid=0) none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw) [root@omeroner ~]$mount -o remount,rw,hidepid=2 /proc [root@omeroner ~]$mount | grep proc proc on /proc type proc (rw,hidepid=2) none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw) [root@omeroner ~]$su omer [omer@omeroner ~]$top |
|
1 2 3 4 5 6 7 8 9 10 11 |
top - 23:14:39 up 103 days, 59 min, 5 users, load average: 1.00, 0.94, 0.58 Tasks: 4 total, 1 running, 3 sleeping, 0 stopped, 0 zombie Cpu(s): 0.0%us, 0.7%sy, 0.0%ni, 99.0%id, 0.0%wa, 0.0%hi, 0.3%si, 0.0%st Mem: 1922260k total, 1847764k used, 74496k free, 43612k buffers Swap: 1048572k total, 628k used, 1047944k free, 876008k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 26782 omer 20 0 105m 1920 1524 S 0.0 0.1 0:00.00 bash 27284 omer 20 0 105m 1892 1504 S 0.0 0.1 0:00.00 bash 28020 omer 20 0 105m 1880 1496 S 0.0 0.1 0:00.00 bash 28034 omer 20 0 14896 1200 988 R 0.0 0.1 0:00.00 top |
syslnx grubuna(gid=syslnx )üye olan omer kullanıcısına ayrıcalık tanımlıyoruz.
|
1 2 3 4 5 6 |
[root@omeroner ~]$mount -o remount,rw,hidepid=2,gid=syslnx /proc [root@omeroner ~]$mount | grep proc proc on /proc type proc (rw,hidepid=2,gid=497) none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw) [root@omeroner ~]$su omer [omer@omeroner /root]$top |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 |
top - 23:23:47 up 103 days, 1:08, 4 users, load average: 1.00, 0.97, 0.75 Tasks: 152 total, 1 running, 151 sleeping, 0 stopped, 0 zombie Cpu(s): 0.2%us, 0.7%sy, 0.0%ni, 99.0%id, 0.0%wa, 0.0%hi, 0.2%si, 0.0%st Mem: 1922260k total, 1848688k used, 73572k free, 43680k buffers Swap: 1048572k total, 628k used, 1047944k free, 876024k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 27632 root 20 0 165m 67m 544 D 1.3 3.6 0:23.78 rm 26455 root 20 0 174m 3612 2804 S 0.3 0.2 64:42.99 vmtoolsd 28237 omer 20 0 15028 1336 988 R 0.3 0.1 0:00.01 top 1 root 20 0 19356 1392 1104 S 0.0 0.1 0:02.12 init 2 root 20 0 0 0 0 S 0.0 0.0 0:00.48 kthreadd 3 root RT 0 0 0 0 S 0.0 0.0 0:07.40 migration/0 4 root 20 0 0 0 0 S 0.0 0.0 0:13.72 ksoftirqd/0 5 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/0 6 root RT 0 0 0 0 S 0.0 0.0 0:17.00 watchdog/0 7 root RT 0 0 0 0 S 0.0 0.0 0:05.23 migration/1 8 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/1 9 root 20 0 0 0 0 S 0.0 0.0 0:23.66 ksoftirqd/1 10 root RT 0 0 0 0 S 0.0 0.0 0:10.41 watchdog/1 11 root 20 0 0 0 0 S 0.0 0.0 9:18.17 events/0 12 root 20 0 0 0 0 S 0.0 0.0 12:07.14 events/1 13 root 20 0 0 0 0 S 0.0 0.0 0:00.00 cgroup 14 root 20 0 0 0 0 S 0.0 0.0 0:00.00 khelper 15 root 20 0 0 0 0 S 0.0 0.0 0:00.00 netns 16 root 20 0 0 0 0 S 0.0 0.0 0:00.00 async/mgr 17 root 20 0 0 0 0 S 0.0 0.0 0:00.00 pm 18 root 20 0 0 0 0 S 0.0 0.0 0:40.23 sync_supers 19 root 20 0 0 0 0 S 0.0 0.0 0:54.24 bdi-default 20 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kintegrityd/0 21 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kintegrityd/1 22 root 20 0 0 0 0 S 0.0 0.0 0:19.65 kblockd/0 23 root 20 0 0 0 0 S 0.0 0.0 0:12.47 kblockd/1 24 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kacpid 25 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kacpi_notify 26 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kacpi_hotplug 27 root 20 0 0 0 0 S 0.0 0.0 0:00.00 ata_aux 28 root 20 0 0 0 0 S 0.0 0.0 0:00.00 ata_sff/0 29 root 20 0 0 0 0 S 0.0 0.0 0:00.00 ata_sff/1 30 root 20 0 0 0 0 S 0.0 0.0 0:00.00 ksuspend_usbd 31 root 20 0 0 0 0 S 0.0 0.0 0:00.00 khubd 32 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kseriod 33 root 20 0 0 0 0 S 0.0 0.0 0:00.00 md/0 34 root 20 0 0 0 0 S 0.0 0.0 0:00.00 md/1 35 root 20 0 0 0 0 S 0.0 0.0 0:00.00 md_misc/0 36 root 20 0 0 0 0 S 0.0 0.0 0:00.00 md_misc/1 37 root 20 0 0 0 0 S 0.0 0.0 0:00.00 linkwatch |
So, what do you think ?