一、编写脚本selinux.sh，实现开启或禁用SELinux功能
#!/bin/bash
read -p "NOW selinux status `getenforce` Do you want to continue change the status [Y/N]:" option
if [ "$option" == "Y" ];then
if [ "$(getenforce)" == "Enforcing" ];then
setenforce 0
echo "selinux is closed"
elif [ "$(getenforce)" == "Disabled" ];then
setenforce 1
echo "selinux is started"
elif [ "$(getenforce)" == "Permissive" ];then
setenforce 1
echo "selinux is started"
fi
else
echo "byebye"
fi
二、统计/etc/fstab文件中每个文件系统类型出现的次数
grep -Ev "(^#|^$)" /etc/fstab |awk '{print $3}' |sort |uniq -c
或则
grep -Ev "(^#|^$)" /etc/fstab |awk '{a[$3]++} END{for(i in a) print i,a[i]}'
三、提取出字符串Yd$C@M05MB%9&Bdh7dq+YVixp3vpw中的所有数字
echo 'Yd$C@M05MB%9&Bdh7dq+YVixp3vpw' |awk -F "" '
> {
> for(i=1;i<=NF;i++)
> {
> if ($i ~ /[[:digit:]]/)
> {
> str=$i
> str1=(str1 str)
> }
> }
> print str1
> }'
四、解决DOS攻击生产案例:根据web日志或者或者网络连接数，监控当某个IP 并发连接数或者短时内PV达到100，即调用防火墙命令封掉对应的IP，监控频 率每隔5分钟。防火墙命令为:iptables -A INPUT -s IP -j REJECT
#!/bin/bash
IPADDR=(`netstat -ant |grep 'ESTABLISHED' |awk '{print $5}' |awk -F ":" '{print $1}' |sort |uniq -c |awk '{print $2}'`)
for i in ${IPADDR[@]};do
PV=`netstat -ant |grep 'ESTABLISHED' |awk '{print $5}' |awk -F ":" '{print $1}' |sort |uniq -c |grep $i |awk '{print $1}'`
if [ $PV -gt 100 ];then
echo "WARNING:$i connection number $PV" > /tmp/pvwarning.log
mail -s "$HOSTNAME PVWARNING" xxx@qq.com < /tmp/pvwarning.log
iptables -A INPUT -s $i -j REJECT
fi
done
制定脚本执行周期
crontab -e
* */5 * * * > /data/pv.sh
