모의해킹 침해대응 정보보안 전문가 양성과정 Day12

 

 

 

 

 

 

 

 

 

7. 부팅 과정

 

 

 

 

 

 

 

 

부팅단계

 

1) F/W 단계

2) GRUB 단계

3) 커널 단계

4) systemd 단계

 

 

 

 

 

 

1) F/W 단계

* POST(Power On Self Test)

* 부팅장치 순서결정(예: Disk -> Removable Device -> CD -> Net)

 

 

 

 

 

2) GRUB 단계

* /etc/default/grub -- grub2-mkconfig --> /boot/grub2/grub.cfg

/etc/grub.d/*

* grub2-mkconfig CMD(# grub2-mkconfig -o /boot/grub2/grub.cfg)

* grub2-install CMD(# grub2-install /dev/sda)

* grub2-setpassword CMD(# grub2-setpassword)

 

 

 

 

 

3) Kernel 단계

* /boot/vmlinuz*

* /etc/sysctl.conf

* sysctl CMD

# sysctl -w net.ipv4.ip_forward=1

# vi /etc/sysctl.conf(/etc/sysctl.d/*)

net.ipv4.ip_forward = 1

or

# vi /etc/sysctl.conf

net.ipv4.ip_forward = 1

# sysctl -p

 

 

 

 

 

4) systemd 단계

* systemd 특성

* systemctl CMD

(서비스 확인)

# systemctl list-unit-files | grep sshd

# systemctl -t help

# systemctl list-unit-files --type=service|socket|target

(서비스 제어)

# systemctl start|stop|restart|reload sshd

# systemctl status sshd

# systemctl is-enabled|is-active sshd

# systemctl --failed [--type=service]

 

(서비스 의존성 관계)

# systemctl list-dependencies sshd

# systemctl list-dependencies sshd --reverse

 

(mask/unmask)

# systemctl mask network

# systemctl mask iptables

# systemctl mask sendmail

(target)

# systemctl set-default multi-user.target|graphical.target

# systemctl isolate multi-user.target|graphical.target

 

 

 

 

 

 

[실무예] 부팅과정에서 문제가 생기는 경우 제어

1) rd.break => /etc/shadow(root 암호 초기화)

# mount -o remount,rw /sysroot

# chroot /sysroot

2) init=/bin/bash

# mount -o remount,rw /

3) systemd.unit=emergency.target => /etc/fstab

# mount -o remount,rw /

4) systemd.unit=rescue.target => /etc/fstab

 

 

 

 

 

[실무예] /etc/rc.d/rc.local(/etc/rc.local)

# chmod +x /etc/rc.d/rc.local

# vi /etc/rc.d/rc.local

 

 

 

 

[실무예] GRUB 암호 설정

(설정) # grub2-setpassword

(해제) # rm -f /boot/grub2/user.cfg

 

 

 

 

[실무예] 부팅시 문제가 생겨서 장애처리시 참고 사항

# dmesg | more

# journalctl -xn

# systemctl enable debug-shell.service (TTY9: <CTRL + ALT + F9>)

# systemctl disable debug-shell.service

 

 

 

 

[실무예] 중단된 작업 확인

# systemctl list-jobs

실행 도중 완료가 되지 못하고 일부만 실행되어 전체 작업이 실행되지 못한 경우 -> waiting 상태 확인

=> failed : systemctl --failed

=> **waiting : systemctl list-jobs

 

 

 

 

[실무예] GRUB 영역이 깨진 경우

* /boot/grub2/grub.cfg 이상 : grub2-mkconfig -o /boot/grub2/grub.cfg

* DISK 내의 GRUB 영역이 깨진 경우 : grub2-install /dev/sda

# dd if=/dev/zero of=/dev/sda bs=446 count=1

# reboot

CD 부팅

# chroot /mnt/sysimage

# cat /boot/grub2/grub.cfg

# fdisk -l /dev/sda

# grub2-install /dev/sda

# exit ; exit

 

 

 

 

[실무예] /etc/fstab 파일 생긴 경우

# mount -o remount,rw / (# mount | grep /dev/sda1)

# vi /etc/fstab

! ls -l /dev/vg1/lv1

! ls -ld /lv1

! tune2fs -l /dev/vg1/lv1, xfs_info /dev/vg1/lv1

# systemctl daemon-reload

# exit

 

 

 

 

[실무예] 새로운 서비스 등록 방법

(요청) oracle 관리자/was 관리자

-> 운영체제가 부팅이 될때 was/oracle 소프트웨어를 같이 기동 시켜 달라.

(요청) 소스 컴파일(EX: /usr/local/apache2)

-> (X) # /usr/local/apache2/bin/apachectl restart

-> (0) # systemctl enable apache2

# systemctl restart apache2

# vi /usr/lib/systemd/system/new.service

# systemctl enable new.service

# systemctl restart new.service

# systemctl stop new.service

# systemctl disable new.service

# rm -f /usr/lib/systemd/system/new.service

 

 

 

 

 

[실습]새로운 서비스 등록 실습

# vi /root/bin/new

---------------------------------------------

#!/bin/bash

 

echo -e "Test New Service is start." | logger -t TestNewService

 

while true

do

echo -e "Test new service start."

sleep 30

done

---------------------------------------------

# chmod 755 /root/bin/new

# /root/bin/new

<CTRL + C>

# cat /var/log/messages | grep TestNewService

# cd /usr/lib/systemd/system

# cp vsftpd.service new.service

# vi /usr/lib/systemd/system/new.service

-------------------------------------------------

[Unit]

Description=Test New Service

 

[Service]

Type=simple

ExecStart=/root/bin/new

Restart=on-failure

 

[Install]

WantedBy=multi-user.target

-------------------------------------------------

# systemctl enable new.service

# systemctl start new.service

# systemctl list-unit-files | grep new

# systemctl status new.service