记一次linux(被)入侵，服务器变矿机~

• What is the difference when I put crontab entry in crontab -e (the default location is : /var/spool/cron/username ) and in /etc/crontab?

The difference is that the crontab command is the interface provided by the system for users to manipulate their crontabs. The /etc/crontab file is a special case file used to implement a system-wide crontab. /var/spool/cron/crontabs/$USER (or whatever the path happens to be) is an implementation detail.
If you can schedule jobs using the crontab command, you should do so.
Manually editing the contents of /etc/crontab (a) requires root access, and (b) is more error-prone. You can mess up your system that way.
If the jobs are to be run under your own user account, there's no need to use root access.
Even if the jobs are to run as root, it probably still makes more sense to use the crontab command. (For one thing, it should detect syntax errors in the file.)
Personally, I don't use crontab -e. Instead, I have a crontab file that I keep in a source control system, and I use the crontab filename form of the command to install it. That way, if I mess something up, it's easy to revert to an earlier version.

• https://zhuanlan.zhihu.com/p/34587314?utm_source=wechat_session&utm_medium=social

ps eho command -p 23374
不加-的是BSD风格，加一个-的是POSTIX风格，两个-的是GNU风格
e      Show the environment after the command.
h      No header.  (or, one header per screen in the BSD
              personality).  The h option is problematic.  Standard BSD ps
              uses this option to print a header on each page of output, but
              older Linux ps uses this option to totally disable the header.
              This version of ps follows the Linux usage of not printing the
              header unless the BSD personality has been selected, in which
              case it prints a header on each page of output.  Regardless of
              the current personality, you can use the long options
              --headers and --no-headers to enable printing headers each
              page or disable headers entirely, respectively.

-o format
              User-defined format.  format is a single argument in the form
              of a blank-separated or comma-separated list, which offers a
              way to specify individual output columns.  The recognized
              keywords are described in the STANDARD FORMAT SPECIFIERS
              section below.  Headers may be renamed (ps -o pid,
              ruser=RealUser -o comm=Command) as desired.  If all column
              headers are empty (ps -o pid= -o comm=) then the header line
              will not be output.  Column width will increase as needed for
              wide headers; this may be used to widen up columns such as
              WCHAN (ps -o pid,wchan=WIDE-WCHAN-COLUMN -o comm).  Explicit
              width control (ps opid,wchan:42,cmd) is offered too.  The
              behavior of ps -o pid=X,comm=Y varies with personality; output
              may be one column named "X,comm=Y" or two columns named "X"
              and "Y".  Use multiple -o options when in doubt.  Use the
              PS_FORMAT environment variable to specify a default as
              desired; DefSysV and DefBSD are macros that may be used to
              choose the default UNIX or BSD columns.
o和-o，--format是一样的

• http://man7.org/linux/man-pages/man1/ps.1.html
• more messages 是指 vim /var/log/messages
• setenforce 0关闭SELinux
• crontab -r删除原来的定时任务
• bash -c

       -c string If the -c option is present, then commands are read from string.  If there are arguments  after  the  string,  they  are
                 assigned to the positional parameters, starting with $0.

• echo 1 > .watch和echo 1> .watch是不一样的
• ps x | awk '!/awk/ && /redisscan|ebscan|redis-cli/ {print $1}' | xargs kill -9 2>/dev/null注意xargs的用法
  类似可以ll | xargs -n 1 vim
• ssh "$(awk '/4/ {print $0}' mycluster.txt)"
• awk '/4/ {print $0}' mycluster.txt|xargs -n 1 ssh
• if ! [ -x "$(command -v masscan)" ];

man command
/command
command [-pVv] command [arg ...]
              Run command with args suppressing the normal shell function lookup. Only builtin commands or commands found in the PATH are
              executed.  If the -p option is given, the search for command is performed using a default value for PATH that is guaranteed
              to find all of the standard utilities.  If either the -V or -v option is supplied, a description  of  command  is  printed.
              The  -v  option  causes  a  single  word indicating the command or file name used to invoke command to be displayed; the -V
              option produces a more verbose description.  If the -V or -v option is supplied, the exit status is 0 if command was found,
              and  1  if  not.   If  neither option is supplied and an error occurred or command cannot be found, the exit status is 127.
              Otherwise, the exit status of the command builtin is the exit status of command.

• while read -r h p;
• http://blog.sina.com.cn/s/blog_605f5b4f0101b0sd.html
• /var/log/wtmp，/var/log/lastlog，/var/log/btmp
• https://blog.csdn.net/xin_y/article/details/53440707
• ida是一个反编译的工具
• https://www.cnblogs.com/caibirdy1985/archive/2011/10/17/4232968.html