第十一周

标签：攻击   off   end   bash   ESS   cas   取出   pts   opp   

1、编写脚本selinux.sh，实现开启或禁用SELinux功能

[root@centos7 scripts]# cat selinux.sh
#!/bin/bash

. /etc/init.d/functions

STATUS=`getenforce`

start(){
    [ $STATUS != Disabled ] && { setenforce 1;echo "Selinux is already started";return 10; }
    sed -i ‘s/SELINUX=disabled/SELINUX=enforcing/‘ /etc/selinux/config
    action "starting selinux ..."
    echo "You need to restart the system for the changes to take effect."
}

stop(){
    [ $STATUS = Disabled ] && { echo "Selinux is already stopped";return 20; }
    sed -i ‘s/SELINUX=enforcing/SELINUX=disabled/‘ /etc/selinux/config
    action "stopping selinux ..."
    echo "You need to restart the system for the changes to take effect."
    echo "You can also use ‘setenforce 0‘ to turn off selinux temporarily"
}
status(){
    getenforce
}

case $* in
start)
        start
        ;;
stop)
        stop
        ;;
status)
        status
        ;;
*)
        echo "Usage:$0 {start|stop|status}"
        exit 100
        ;;
esac



# 执行结果
[root@centos7 scripts]# ./selinux.sh status
Disabled

[root@centos7 scripts]# ./selinux.sh start
starting selinux ...                                       [  OK  ]
You need to restart the system for the changes to take effect.

[root@centos7 scripts]# ./selinux.sh stop
Selinux is already stopped

[root@centos7 scripts]#./selinux.sh status
Enforcing

[root@centos7 scripts]#./selinux.sh stop
stopping selinux ...                                       [  OK  ]
You need to restart the system for the changes to take effect.
You can also use ‘setenforce 0‘ to turn off selinux temporarily

2、统计/etc/fstab文件中每个文件系统类型出现的次数

[root@centos7 ~]# awk ‘/^[^# ]/{fsys[$3]++}END{for(n in fsys)print n,fsys[n]}‘ /etc/fstab
swap 1
ext4 1
xfs 3

3、提取出字符串Yd$C@M05MB%9&Bdh7dq+YVixp3vpw中的所有数字

[root@centos7 ~]# echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw" | awk -F "" ‘{for(n=1;n<=NF;n++){if($n ~ /[0-9]/)print $n}}‘
0
5
9
7
3

[root@centos7 ~]# echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw" | tr -dc "[0-9]"
05973[root@centos7 ~]# 

4、解决DOS攻击生产案例:根据web日志或者或者网络连接数，监控当某个IP 并发连接数或者短时内PV达到100，即调用防火墙命令封掉对应的IP，监控频 率每隔5分钟。防火墙命令为:iptables -A INPUT -s IP -j REJECT

[root@centos7 ~]# crontab -l
*/5 * * * * /usr/bin/awk ‘{IP[$1]++}END{for(n in IP){if(IP[n]>100)system("/usr/sbin/iptables -A INPUT -s " n " -j REJECT")}}‘ /var/log/httpd/access_log

第十一周

标签：攻击   off   end   bash   ESS   cas   取出   pts   opp   

原文地址：https://www.cnblogs.com/kfscott/p/13205075.html