我有一个Django Web 应用程序，其中 Web 应用程序和postgresql数据库托管在两个独立的基于 Ubuntu 的机器上。
在我的数据库机器（而不是我的 Web 应用程序）上，如果我运行sudo netstat -4plunt，我会得到如下输出：
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 *.*.*.*:16001 0.0.0.0:* LISTEN 831/python
tcp 0 0 127.0.0.1:29131 0.0.0.0:* LISTEN 46329/mdsd
tcp 0 0 0.0.0.0:1270 0.0.0.0:* LISTEN 1582/omiserver
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1160/sshd
tcp 0 0 0.0.0.0:5432 0.0.0.0:* LISTEN 55903/postgres
udp 0 0 0.0.0.0:51802 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:35637 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:36013 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:52523 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:36139 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:52618 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:36340 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:53408 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:53711 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:53774 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:53899 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:54031 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:54054 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:54275 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:54375 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:38157 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:38468 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:55391 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:39133 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:55708 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:39963 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:40181 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:56780 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:40441 0.0.0.0:* 63911/facebook
udp 0 0 0.0.0.0:56992 0.0.0.0:* 63911/facebook
如果我运行sudo strace -p 63911，我会得到以下信息：
Process 63911 attached
[ Process PID=63911 runs in 32 bit mode. ]
select(17, [16], NULL, NULL, {15, 76647}) = 1 (in [16], left {14, 911022})
recv(16, "1", 4096, 0) = 1
select(17, [16], NULL, NULL, {20, 0}) = 1 (in [16], left {14, 953682})
recv(16, "1", 4096, 0) = 1
select(17, [16], NULL, NULL, {20, 0}) = 1 (in [16], left {14, 910776})
recv(16, "1", 4096, 0)
这看起来有点像 postgresql 查询，但我不能确切地说。
如果我运行ps -p 63911 -o pid,vsz=MEMORY -o user,group=GROUP -o comm,args=ARGS，我会得到：
PID MEMORY USER GROUP COMMAND ARGS
63911 3742124 postgres postgres facebook /tmp/facebook
在/tmp/我看到两个文件。一个是名为facebook（大小：1.3MB）的可执行文件，另一个是名为gameover.so（大小：8KB）的可执行文件。
接下来chkrootkit我在我的机器上运行。我得到了一个积极的结果：Searching for Suckit rootkit... Warning: /sbin/init INFECTED。然而，这是一个广为人知的误报chkrootkit。不能确定，所以我要重建系统。
然而，我不想在没有确定我当前的漏洞并相应改进的情况下这样做。那么，任何人都可以告诉我这gameover.so是什么，以及我可以做些什么来防范未来的这些攻击？我的防火墙可能很弱（如何阻止所有不需要的端口），但我还没有安装rkhunter（或类似 Tripwire 的东西）。
顺便说一句，我使用该iptables-persistent软件包，并且 /etc/iptables/rules.v4 包含以下内容：
*filter
# Allow all outgoing, but drop incoming and forwarding packets by default
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
# Custom per-protocol chains
:UDP - [0:0]
:TCP - [0:0]
:ICMP - [0:0]
# Acceptable UDP traffic
# Acceptable TCP traffic
-A TCP -p tcp --dport 22 -j ACCEPT
-A TCP -p tcp --dport 5432 -i eth0 -j ACCEPT
# Acceptable ICMP traffic
# Boilerplate acceptance policy
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i lo -j ACCEPT
# Drop invalid packets
-A INPUT -m conntrack --ctstate INVALID -j DROP
# Pass traffic to protocol-specific chains
## Only allow new connections (established and related should already be handled)
## For TCP, additionally only allow new SYN packets since that is the only valid
## method for establishing a new TCP connection
-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
-A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
-A INPUT -p icmp -m conntrack --ctstate NEW -j ICMP
# Reject anything that's fallen through to this point
## Try to be protocol-specific w/ rejection message
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
# Commit the changes
COMMIT
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*security
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
运行strings /tmp/gameover.so | less产量：
__gmon_start__
_init
_fini
_ITM_deregisterTMCloneTable
_ITM_registerTMCloneTable
__cxa_finalize
_Jv_RegisterClasses
Pg_magic_func
text_ptr_to_char_ptr
malloc
chr_ptr_to_text_ptr
pg_finfo_sys_exec
pg_detoast_datum
system
pfree
pg_finfo_sys_eval
popen
realloc
strncpy
fgets
pclose
pg_finfo_sys_bineval
fork
sysconf
mmap
waitpid
pg_finfo_sys_fileread
fopen
fseek
ftell
fclose
fread
libc.so.6
_edata
__bss_start
_end
GLIBC_2.2.5
fffff.
[]A\
AUATUH
H;] t
Y[]A\D
AWAVAUATUSAQH
<(Ic
[]A\A]A^A_
ATUSH
[]A\
AUATUSH
[]A\A]A^
0123456789ABCDEF
;*3$"
GCC: (Debian 4.7.2-5) 4.7.2
.shstrtab
.note.gnu.build-id
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rela.dyn
.rela.plt
.init
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.jcr
.dynamic
.got
.got.plt
.data
.bss
.comment
运行strings /tmp/facebook | less产生我不明白的命名法：
PTRhP
QVh0
[^_]
<;t 9u
,[^_]
,[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
\[^_]
[^_]
WVS1
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
P[^]
[^_]
XXXX
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
0[^]
amp.
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
ffffff.
9Qhu
9Qhu
ffff.
fff.
B`@c
Bd@c
[^_]
,[^_]
[^_]
[^_]
[^_]
CdHc
[^_]