自动开关selinux脚本、awk练习

1、编写脚本selinux.sh，实现开启或禁用SELinux功能

read -p "please input character set selinux for {start|stop} :" SE
SEC=$(sed -rn 's@^SELINUX=(.*)@\1@'p /etc/selinux/config)
if [ $SE == 'start' ];then
	if [ $SEC == 'enforcing' ];then
    		echo "selinux current status is enforcing"
	elif [ $SEC == 'disabled' ];then
    		sed -ri 's@^SELINUX=(.*)@SELINUX=enforcing@' /etc/selinux/config && echo "selinux start succeed"
	fi
elif [ $SE == 'stop' ];then
    	if [ $SEC == 'disabled' ];then
         	echo "selinux current status is disabled"
    	elif [ $SEC == 'enforcing' ];then
         	sed -ri 's@^SELINUX=(.*)@SELINUX=disabled@' /etc/selinux/config && echo "selinux stop succeed"
    	fi
fi

2、统计/etc/fstab文件中每个文件系统类型出现的次数

grep "^[(UUID)|/]" /etc/fstab | awk -F" " '{print $3}' | uniq -c

cat /etc/fstab | awk '/^UUID/{sys[$3]++}END{for(i in sys){print i,sys[i]}}'

3、提取出字符串Yd$C@M05MB%9&Bdh7dq+YVixp3vpw中的所有数字

echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw" | awk 'gsub(/[^[:digit:]]/," ",$0)'

4、解决DOS攻击生产案例:根据web日志或者或者网络连接数，监控当某个IP 并发连接数或者短时内PV达到100，即调用防火墙命令封掉对应的IP，监控频 率每隔5分钟。防火墙命令为:iptables -A INPUT -s IP -j REJECT

crontab -l
*/5 * * * * /root/bin/deny.sh $> /dev/null
cat deny.sh
awk '{ip[$1]++}END{for(i in ip) {if(ip[i]>99){system("iptables -A INPUT -s "i" -j REJECT")}}}' /var/log/httpd/access_log