背景：某高校客户检测出 5000 端口有中危漏洞告警。

用 netstat 命令看下这个5000端口是什么进程号

netstat -anop|grep 5000

再用ps命令查看具体进程

[root@server107 ~]# ps -ef|grep 7759

root       7759      1  0  2020 ?        6-00:36:00 /u01/oracle/grid/crs_1/jdk/jre/bin/java -Xms128m -Xmx512m oracle.rat.tfa.TFAMain /u01/oracle/grid/crs_1/tfa/server107/tfa_home

发现是日志分析收集工具 TFA ，可以关闭来避免漏洞检测

Oracle的 TFA（Trace File Analyzer Collector）是一款由Oracle官方提供的自动化诊断信息收集工具，专为简化Oracle环境（尤其是数据库、集群、Exadata等）的故障排查流程而设计，若是关闭，对生产系统并无影响。

先将TFA在线关闭，对生产无影响

[root@server107 ~]# /u01/oracle/grid/crs_1/bin/tfactl stop

Stopping TFA 
from 
the Command Line

Stopped OSWatcher

TFA 
is 
running  - Will wait 5 seconds (up 
to 
3 times)  

TFA-00002 : Oracle Trace File Analyzer (TFA) 
is 
not 
running

TFA Stopped Successfully

. . .

Successfully stopped TFA..

[root@server107 ~]# /u01/oracle/grid/crs_1/bin/tfactl status

TFA-00002 Oracle Trace File Analyzer (TFA) is not running

检查关闭情况

[root@server107 ~]# netstat -anop|grep 5000

udp        0      0 0.0.0.0:15000               0.0.0.0:*                               7384/klnagent       
off 
(0.00/0/0)

udp        0      0 127.0.0.1:50007             0.0.0.0:*                               213038/oracleIP1    
off 
(0.00/0/0)

udp   262528      0 169.254.70.90:50007         0.0.0.0:*                               213038/oracleIP1    
off 
(0.00/0/0)

udp        0      0 :::15000                    :::*                                    7384/klnagent       
off 
(0.00/0/0)

最后再禁止TFA开机自启就完成了

[root@server107 ~]# /u01/oracle/grid/crs_1/bin/tfactl disable

TFA autostart has been disabled ..

ITPub博客

TFA引起的端口漏洞处理

最新文章