1、編寫腳本selinux.sh，實現(xiàn)開啟或禁用SELinux功能
腳本如下：
#!/bin/bash
case "$1" in
on)
sed -i '/^SELINUX=/c\SELINUX=enforcing' /etc/selinux/config && echo "executed successfully, please reboot"
;;
off)
sed -i '/^SELINUX=/c\SELINUX=disabled' /etc/selinux/config && echo "executed successfully, please reboot"
;;
*)
echo "Usage: $0 on|off"
;;
esac
執(zhí)行結(jié)果如下：
[21:48:26 root@centos7-2 data]#./selinux.sh on
executed successfully, please reboot
[21:48:32 root@centos7-2 data]#./selinux.sh off
executed successfully, please reboot
[21:48:36 root@centos7-2 data]#./selinux.sh aa
Usage: ./selinux.sh on|off
2、統(tǒng)計/etc/fstab文件中每個文件系統(tǒng)類型出現(xiàn)的次數(shù)
/etc/fstab文件內(nèi)容如下：
[21:56:30 root@centos7 ~]#cat /etc/fstab
#
# /etc/fstab
# Created by anaconda on Fri May 15 16:26:08 2020
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
UUID=5323ffc1-3434-41b0-b8ec-909403493a60 / xfs defaults 0 0
UUID=edd1490f-a15a-4a21-82dc-928bc1c04b38 /boot xfs defaults 0 0
UUID=5d56a0d4-150b-4827-8f82-763868b561c7 /data xfs defaults 0 0
UUID=ed5d5d57-d87f-48e8-90df-c962f78230d9 swap swap defaults 0 0
UUID=b73bf8f8-7c53-4abc-8d67-ea8d1f446fa8 /mnt/sda6 ext3 defaults 0 0
UUID=1d138cbd-a684-4be1-9939-27132163d631 /mnt/sda7 ext3 defaults 0 0
UUID=03fd63d6-d79a-4b95-83e6-6bf7df3cf764 /mnt/sda8 ext3 defaults 0 0
UUID=360479c3-3bc0-4c7e-859d-f72f98366fac /mnt/sda9 ext4 defaults 0 0
使用AWK命令統(tǒng)計，結(jié)果如下：
[22:45:19 root@centos7 ~]#awk -F " " /^UUID/'{ FileSystem[$3]++ }BEGIN{print "FileSystem NUM\n---------------"}END{for (i in FileSystem ){printf "%-11s %d\n",i,FileSystem[i] }}' /etc/fstab
FileSystem NUM
---------------
swap 1
ext3 3
ext4 1
xfs 3
3端三、提取出字符串Yd$C@M05MB%9&Bdh7dq+YVixp3vpw中的所有數(shù)字
利用awk自帶函數(shù)gsub，用法如下：
gsub(r,s,[t])：對t字符串進行搜索r表示的模式匹配的內(nèi)容鹃彻，并全部替換為s所表示的內(nèi)容
處理結(jié)果如下：
[22:53:53 root@centos7 ~]#echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw" | awk 'gsub(/[^0-9]/,"",$0)'
05973
4技肩、解決DOS攻擊生產(chǎn)案例:根據(jù)web日志或者或者網(wǎng)絡(luò)連接數(shù)，監(jiān)控當(dāng)某個IP 并發(fā)連接數(shù)或者短時內(nèi)PV(頁面瀏覽量)達到100，即調(diào)用防火墻命令封掉對應(yīng)的IP虚婿，監(jiān)控頻率每隔5分鐘旋奢。防火墻命令為:iptables -A INPUT -s IP -j REJECT
先編寫腳本：
#!/bin/bash
awk '{ip[$1]++}END{for(i in ip){if(ip[i]>100)print i}}' /var/log/httpd/access_log > /tmp/hosts.txt
while read ip; do
iptables -A INPUT -s $ip -j REJECT
done < /tmp/hosts.txt
腳本執(zhí)行如下：
[23:35:50 root@centos7-2 data]#bash -x ddos_monitor.sh
+ awk '{ip[$1]++}END{for(i in ip){if(ip[i]>100)print i}}' /var/log/httpd/access_log
+ read ip
+ iptables -A INPUT -s 192.168.23.17 -j REJECT
+ read ip
給該腳本添加執(zhí)行權(quán)限，并將該腳本加入定時任務(wù)然痊，結(jié)果如下：
[23:40:31 root@centos7-2 data]#crontab -l
*/5 * * * * ./data/ddos_monitor.sh
