1、編寫腳本selinux.sh瓦胎，實(shí)現(xiàn)開啟或禁用SELinux功能
#!/bin/bash
if [ $1 == "on" ];then
sed -i '7s/.*/SELINUX=enforcing/g' /etc/selinux/config
[ $? -eq 0 ] && /sbin/setenforce 1 > /dev/null 2>&1
echo "SELinux is enforcing."
elif [ $1 == "off" ];then
sed -i '7s/.*/SELINUX=disabled/g' /etc/selinux/config
[ $? -eq 0 ] && /sbin/setenforce 0 > /dev/null 2>&1
echo "SELinux is disabled."
else
echo "argv error, please input <on|off>"
exit 1
fi
2秃踩、統(tǒng)計(jì)/etc/fstab文件中每個(gè)文件系統(tǒng)類型出現(xiàn)的次數(shù)
cat /etc/fstab | awk '/^UUID*/{filetype[$3]++} END {
for (i in filetype)
{print i,filetype[i]}
}'
3、提取出字符串Yd$C@M05MB%9&Bdh7dq+YVixp3vpw中的所有數(shù)字
echo 'Yd$C@M05MB%9&Bdh7dq+YVixp3vpw' | awk 'gsub(/[^0-9]/,"",$0)'
4买喧、解決DOS攻擊生產(chǎn)案例:根據(jù)web日志或者或者網(wǎng)絡(luò)連接數(shù)捻悯，監(jiān)控當(dāng)某個(gè)IP 并發(fā)連接數(shù)或者短時(shí)內(nèi)PV達(dá)到100，即調(diào)用防火墻命令封掉對(duì)應(yīng)的IP淤毛，監(jiān)控頻 率每隔5分鐘今缚。防火墻命令為:iptables -A INPUT -s IP -j REJECT
#!/bin/bash
[ -n "$1" ] || { echo "Usage:`basename $0` file.log";exit 1; }
file=$1
while true ; do
awk '{print $1}' $1|grep -v "^$"|sort|uniq -c > /tmp/tmp.log
exec < /tmp/tmp.log
while read line ; do
ip=`echo $line|awk '{print $2}'`
count=`echo $line|awk '{print $1}'`
if [ $count -gt 100 ] && [ `iptables -vnL|grep "$ip"|wc -l` -lt 1 ];then
iptables -A INPUT -s $IP -j REJECT
echo "$ip is rejected" > /tmp/droplist_$(date +%F).log
fi
done
sleep 300
done
