1、编写脚本selinux.sh,实现开启或禁用SELinux功能。
#!/bin/bash
#function:enable or disable the selinux
SELINUX_CONFIG="/etc/selinux/config"
function menu()
{
echo "1 - Enable the selinux"
echo "2 - Disable the selinux"
return 0
}
function enable_selinux()
{
local ret1
local ret2
systemctl start firewalld.service
ret1=$?
sed -i 's/^SELINUX=.*/SELINUX=disable/g' ${SELINUX_CONFIG}
ret2=$?
if [ ${ret1} -eq 0 ] && [ ${ret2} -eq 0 ]
then
echo -e "\033[32mEnable the selinux success\033[0m"
else
echo -e "\033[31mEnable the selinux fail\033[0m"
return 1
fi
return 0
}
function disable_selinux()
{
local ret1
local ret2
systemctl stop firewalld.service
ret1=$?
sed -i 's/^SELINUX=.*/SELINUX=enforcing/g' ${SELINUX_CONFIG}
ret2=$?
if [ ${ret1} -eq 0 ] && [ ${ret2} -eq 0 ]
then
echo -e "\033[32mDisable the selinux success\033[0m"
else
echo -e "\033[31mDisable the selinux fail\033[0m"
return 1
fi
return 0
}
function user_choice()
{
local choice
menu
while true
do
read -p "Please select enable or disable the selinux:(1|2)" choice
if [ -n "${choice}" ] && [ "${choice}" -eq 1 -o "${choice}" -eq 2 ]
then
break
continue
fi
done
case ${choice} in
1)
enable_selinux
;;
2)
disable_selinux
;;
*)
#usage
;;
esac
return 0
}
function main()
{
user_choice || return $?
return 0
}
main
MAIN_RET=$?
exit ${MAIN_RET}
2、统计/etc/fstab文件中每个文件系统类型出现的次数。
awk 'BEGIN {print "Filesystemtype","\t","Number"} /^[^# ]/ {filesystem[$3]++} END {for (i in filesystem) print i,"\t\t",filesystem[i]}' /etc/fstab
3、提取出字符串Yd$C@M05MB%9&Bdh7dq+YVixp3vpw中的所有数字。
echo 'Yd\$C@M05MB%9&Bdh7dq+YVixp3vpw' | grep -o '[0-9]'
4、解决DOS攻击生产案例:根据web日志或者或者网络连接数,监控当某个IP 并发连接数或者短时内PV达到100,即调用防火墙命令封掉对应的IP,监控频率每隔5分钟。防火墙命令为:iptables -A INPUT -s IP -j REJECT。
#!/bin/bash
#function:Check the tcp establshed more than 100 of any ip every 300s and add the ip to iptables rule
while true
do
echo "Begin to check the tcp connect..."
result=$(netstat -an | grep -w ESTABLISHED | awk -F'[ :]+' '{ip[$6]++} END {for (i in ip) print i,ip[i]}')
echo "${result}" | while read line
do
ip=$(echo ${line} | awk '{print $1}')
number=$(echo ${line} | awk '{print $2}')
[ ${number} -ge 100 ] && iptables -A INPUT -s ${ip} -j REJECT && echo "Add the ${ip} to iptables rule success"
done
sleep 300
done
可以使用