第十周作业

编写脚本selinux.sh，实现开启或禁用SELinux功能

vim /etc/init.d/selinux
#!/bin/bash
#
# chkconfig: - 98 4
# description: selinux start|stop
setenforce 0 &> /dev/null || setenforce 1 &> /dev/null
if [ $? -ne 0 ];then
        echo "The system is not start selinux.service"
        exit
fi
if [ $# -ne 1 ];then
        echo "Input argument counts must be one"
        exit
fi
stop(){
        setenforce 0
        echo "Selinux is Permissive"
}
start(){
        setenforce 1
        echo "Selinux is Enforcing"
}
case $1 in
stop)
        stop
        ;;
start)
        start
        ;;
*)
        echo "Usage: `basename $0` stop|start"
        ;;
esac

chmod +x /etc/init.d/selinux
chkconfig --add selinux
chkconfig selinux on

统计/etc/fstab文件中每个文件系统类型出现的次数

awk '/^[^#]/{count[$3]++}END{for(i in count){print i,count[i]}}' /etc/fstab

提取出字符串Yd$C@M05MB%9&Bdh7dq+YVixp3vpw中的所有数字

// 方法一
echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw"|awk 'gsub(/[^0-9]/,"",$1)'
// 方法二
echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw"|tr -dc '[:digit:]'

解决DOS攻击生产案例:根据web日志或者或者网络连接数，监控当某个IP 并发连接数或者短时内PV达到100，即调用防火墙命令封掉对应的IP，监控频 率每隔5分钟。防火墙命令为:iptables -A INPUT -s IP -j REJECT

vim lockip.sh
#!/bin/bash
#
num=100
while :;do
        cat /dev/null > access.log
        ss -nt|sed -r 's@.*[: ](([0-9]+\.?){4}):.*@\1@p'|grep -v State|sort -nr|uniq -c > access.log
        while read count ip;do
                if [ $count -gt $num ];then
                        iptables -A INPUT -s $ip -j REJECT
                fi
        done < access.log
        sleep 300
done
chmod +x lockip.sh

测试


方法二

vim /scripts/lockip.sh
ss -nt|awk -F '[ :]+' '! /State/{count[$(NF-2)]++}END{for(i in count){if(count[i]>100){system("iptables -A INPUT -s "i" -j REJECT")}}}' 

crontab -e
*/5 * * * * /bin/bash /scripts/lockip.sh