\u6765\u6e90\uff1a<\/span>http:\/\/laoxiege.blog.sohu.com<\/span><\/a>
\n\u9996\u5148\u6211\u5148\u7f16\u8bd1\u4e00\u4e2assh\u540e\u95e8\uff0c\u8fd9\u4e2assh\u540e\u95e8\u4f1a\u5728\/tmp\/xxxxxx\u8bb0\u5f55\u6240\u6709\u7684\u767b\u5f55\u5bc6\u7801<\/span><\/span>\u3000\u3000\u542f\u52a8\u4ed6<\/p>\n

QUOTE:
\nroot@laptop:\/usr\/local\/openssh2\/sbin# ps aux | grep sshd
\nroot 13619 0.0 0.3 7432 1752 ? Ss 23:44 0:00 .\/sshd -p 1234
\nroot 13707 0.0 0.2 4292 1328 pts\/3 R+ 23:58 0:00 grep sshd<\/p>\n

\u4e0b\u9762\u6211\u4eec\u7528strace\u8ddf\u8e2a\u4e00\u4e0bpid\u4f4d13619\u7684ssh\u8fdb\u7a0b\uff0c\u5176\u4e2d-ff\u53c2\u6570\u5f88\u91cd\u8981\uff0c\u53ef\u4ee5\u8ddf\u8e2afork\u7684\u5b50\u8fdb\u7a0b\u3002<\/p>\n

QUOTE:
\nroot@laptop:\/usr\/local\/openssh2\/sbin# strace -o aa -ff -p 13619<\/p>\n

\u7136\u540e\u6211\u4eec\u767b\u5f55ssh\uff0c\u6210\u529f\u767b\u5f55\u4e4b\u540e\uff0c\u6211\u4eec\u770b\u770b\u5f53\u524d\u76ee\u5f55\uff0c\u751f\u6210\u4e86strace\u7684\u8f93\u51fa<\/p>\n

QUOTE:
\nroot@laptop:\/usr\/local\/openssh2\/sbin# ls
\naa aa.13636 aa.13638 aa.13640 aa.13642 aa.13644 aa.13646 aa.13648 aa.13650 aa.13652 aa.13654 aa.13656 sshd
\naa.13635 aa.13637 aa.13639 aa.13641 aa.13643 aa.13645 aa.13647 aa.13649 aa.13651 aa.13653 aa.13655 aa.13657
\n\u6211\u4eecgrep\u4e00\u4e0bopen\u7cfb\u7edf\u8c03\u7528\uff0c\u7136\u540e\u8fc7\u6ee4\u6389\u9519\u8bef\u4fe1\u606f\u548c\/dev\/null\u4fe1\u606f\uff0c\u4ee5\u53cadenied\u4fe1\u606f\uff0c\u5e76\u4e14\u627eWR\u7684\uff0c\u5c31\u662f\u8bfb\u5199\u6a21\u5f0f\u6253\u5f00\u7684\uff0c\u56e0\u4e3a\u8981\u628a\u8bb0\u5f55\u7684\u5bc6\u7801\u5199\u5165\u6587\u4ef6\uff0c\u80af\u5b9a\u8981\u662f\u4ee5\u5199\u65b9\u5f0f\u6253\u5f00\u7684\u6587\u4ef6\uff0c\u5927\u81f4\u7684\u770b\u770b\uff0c\u5f88\u5bb9\u6613\u627e\u5230\u5f02\u5e38\u6587\u4ef6\/tmp\/xxxxxx<\/p>\n

QUOTE:
\nroot@laptop:\/usr\/local\/openssh2\/sbin# grep open aa* | grep -v -e No -e null -e denied| grep WR
\naa.13635:open(“\/tmp\/xxxxxx”, O_WRONLY|O_APPEND|O_CREAT|O_LARGEFILE, 0666) = 3
\naa.13635:open(“\/dev\/ptmx”, O_RDWR) = 3
\naa.13635:open(“\/dev\/pts\/5”, O_RDWR|O_NOCTTY) = 6
\naa.13635:open(“\/var\/run\/utmp”, O_RDWR) = 7
\naa.13635:open(“\/var\/log\/wtmp”, O_WRONLY) = 7
\naa.13635:open(“\/var\/log\/lastlog”, O_RDWR|O_CREAT|O_LARGEFILE, 02000) = 7
\naa.13635:open(“\/var\/run\/utmp”, O_RDWR) = 6
\naa.13635:open(“\/var\/log\/wtmp”, O_WRONLY) = 6
\naa.13638:open(“\/dev\/pts\/5”, O_RDWR|O_LARGEFILE) = 7
\naa.13638:open(“\/dev\/tty”, O_WRONLY|O_LARGEFILE) = 8
\naa.13638:open(“\/dev\/tty”, O_RDWR|O_NONBLOCK|O_LARGEFILE) = 3
\naa.13640:open(“\/dev\/tty”, O_RDWR|O_NONBLOCK|O_LARGEFILE) = 3
\naa.13657:open(“\/dev\/tty”, O_RDWR) = 3
\n\u901a\u8fc7\u4e0a\u9762\u7684\u65b9\u6cd5\uff0c\u6211\u4eec\u53ef\u4ee5\u5927\u81f4\u7684\u8bca\u65ad\u4e00\u4e0b\u6211\u4eec\u7684sshd\u662f\u5426\u88ab\u653e\u4e86\u540e\u95e8\uff0c\u4f46\u662f\u56e0\u4e3asshd\u540e\u95e8\u591a\u79cd\u591a\u6837\uff0c\u4e0a\u9762\u6211\u8bf4\u5230\u7684sshd\u540e\u95e8\u662f\u6bd4\u8f83\u4f18\u79c0\u7684\u4e00\u79cd\uff0c\u4ed6\u53ef\u4ee5\u8bbe\u7f6e\u662f\u5426\u8bb0\u5f55\u5bc6\u7801\uff0c\u5982\u679c\u8bbe\u7f6e\u4e0d\u8bb0\u5f55\u5bc6\u7801\uff0c\u90a3\u4e48\u6211\u4eec\u7528strace\u4f30\u8ba1\u662f\u53d1\u73b0\u4e0d\u5230\u4ed6\u7684\uff0c\u4f46\u662f\u8fd8\u662f\u6709\u4e00\u4e9bssh\u540e\u95e8\u8fd8\u8981\u7528\u7279\u6b8a\u7684\u914d\u7f6e\u6587\u4ef6\uff0c\u8bfb\u53d6\u7279\u6b8a\u7684\u5bc6\u7801\u6587\u4ef6\uff0c\u8fd9\u79cd\u6211\u4eec\u7528strace\u5c31\u5341\u5206\u5bb9\u6613\u53d1\u73b0\u4ed6\u4eec\u4e86\u3002<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\u6765\u6e90\uff1ahttp:\/\/laoxiege.blog.sohu.com \u9996\u5148\u6211\u5148\u7f16\u8bd1\u4e00 …<\/p>\n

\u7ee7\u7eed\u9605\u8bfb »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[130,129],"class_list":["post-195","post","type-post","status-publish","format-standard","hentry","tag-ssh","tag-strace"],"views":841,"_links":{"self":[{"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/posts\/195","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/comments?post=195"}],"version-history":[{"count":0,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/posts\/195\/revisions"}],"wp:attachment":[{"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/media?parent=195"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/categories?post=195"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/tags?post=195"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}