[Linux] 커널 보안 취약점 대처

실습> 커널 보안 취약점 대처하기

보안 취약점이 나오면 업데이트 파일이 나오고 리눅스 관리자는 반드시 업데이트를 해야한다. 

1. 보안 취약점 기사 확인
https://www.boho.or.kr/data/secNoticeList.do

 

2. 커널 버전 확인
[root@www ~]# uname -a
Linux www.server1.kr 3.10.0-1160.el7.x86_64 #1 SMP Mon Oct 19 16:18:59 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

 

3. 업데이트 확인
[root@www ~]# yum check-update
  :
  :(생략)
kernel.x86_64                                      3.10.0-1160.45.1.el7                        updates
kernel-tools.x86_64                                3.10.0-1160.45.1.el7                        updates
kernel-tools-libs.x86_64                           3.10.0-1160.45.1.el7                        updates
  :
  :(생략)
  
4. 패키지 업데이트
[root@www ~]# yum -y update

  :
  :(생략)

  rpm-libs.x86_64 0:4.11.3-46.el7_9                            rpm-python.x86_64 0:4.11.3-46.el7_9                           
  rsyslog.x86_64 0:8.24.0-57.el7_9.1                           selinux-policy.noarch 0:3.13.1-268.el7_9.2                    
  selinux-policy-targeted.noarch 0:3.13.1-268.el7_9.2          sudo.x86_64 0:1.8.23-10.el7_9.2                               
  systemd.x86_64 0:219-78.el7_9.3                              systemd-libs.x86_64 0:219-78.el7_9.3                          
  systemd-sysv.x86_64 0:219-78.el7_9.3                         tuned.noarch 0:2.11.0-11.el7_9                                
  tzdata.noarch 0:2021e-1.el7                                  vim-minimal.x86_64 2:7.4.629-8.el7_9                          
  virt-what.x86_64 0:1.18-4.el7_9.1                            wpa_supplicant.x86_64 1:2.6-12.el7_9.2                        
  zlib.x86_64 0:1.2.7-19.el7_9                                

Complete!

5. 서버 리부팅
[root@www ~]# reboot

리부팅 후 재접속하고 커널 버전을 확인한다.
[root@www ~]# uname -a
Linux www.server1.kr 3.10.0-1160.45.1.el7.x86_64 #1 SMP Wed Oct 13 17:20:51 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

6. 이전 커널 삭제
[root@www ~]# ls /boot
System.map-3.10.0-1160.45.1.el7.x86_64                   initramfs-3.10.0-1160.45.1.el7.x86_64.img
System.map-3.10.0-1160.el7.x86_64                        initramfs-3.10.0-1160.el7.x86_64.img
config-3.10.0-1160.45.1.el7.x86_64                       symvers-3.10.0-1160.45.1.el7.x86_64.gz
config-3.10.0-1160.el7.x86_64                            symvers-3.10.0-1160.el7.x86_64.gz
efi                                                      vmlinuz-0-rescue-5786abfd928d4259b13aea3e426fba89
grub                                                     vmlinuz-3.10.0-1160.45.1.el7.x86_64
grub2                                                    vmlinuz-3.10.0-1160.el7.x86_64
initramfs-0-rescue-5786abfd928d4259b13aea3e426fba89.img

커널 버전 확인
[root@www ~]# rpm -qf /boot/vmlinuz-3.10.0-1160.el7.x86_64
kernel-3.10.0-1160.el7.x86_64
[root@www ~]# rpm -qa | grep kernel
kernel-3.10.0-1160.el7.x86_64
kernel-headers-3.10.0-1160.45.1.el7.x86_64
kernel-3.10.0-1160.45.1.el7.x86_64
kernel-tools-libs-3.10.0-1160.45.1.el7.x86_64
kernel-tools-3.10.0-1160.45.1.el7.x86_64

7. 패키지 삭제
커널 패키지 삭제는 rpm or yum 이용해서 삭제한다.
[root@www ~]# rpm -e kernel-3.10.0-1160.el7.x86_64
   or 
[root@www ~]# yum -y remove kernel-3.10.0-1160.el7.x86_64
  :
  :(생략)
Running transaction
  Erasing    : kernel-3.10.0-1160.el7.x86_64                                                                              1/1 
  Verifying  : kernel-3.10.0-1160.el7.x86_64                                                                              1/1 

Removed:
  kernel.x86_64 0:3.10.0-1160.el7                                                                                             

Complete!

이전 버전의 취약한 패키지는 삭제가 되었다.
[root@www ~]# ls /boot
System.map-3.10.0-1160.45.1.el7.x86_64  initramfs-0-rescue-5786abfd928d4259b13aea3e426fba89.img
config-3.10.0-1160.45.1.el7.x86_64      initramfs-3.10.0-1160.45.1.el7.x86_64.img
efi                                     symvers-3.10.0-1160.45.1.el7.x86_64.gz
grub                                    vmlinuz-0-rescue-5786abfd928d4259b13aea3e426fba89
grub2                                   vmlinuz-3.10.0-1160.45.1.el7.x86_64

 

[root@www ~]# rpm -qa | grep kernel
kernel-headers-3.10.0-1160.45.1.el7.x86_64
kernel-3.10.0-1160.45.1.el7.x86_64
kernel-tools-libs-3.10.0-1160.45.1.el7.x86_64
kernel-tools-3.10.0-1160.45.1.el7.x86_64