1、编写脚本selinux.sh，实现开启或禁用SELinux功能
1>创建脚本selinux_control.sh
[root@centos7 data]# vim selinux_control.sh
#!/bin/bash
[ -z "$*" ] && { echo -e "Usage:`basename $0` on|off" ;exit 2 ; }
if [ "$1" == "on" ];then
sed -i "s/SELINUX=disabled/SELINUX=enforcing/g" /etc/sysconfig/selinux && setenforce 1
echo "SELINUX enforcing"
elif [ "$1" == "off" ];then
sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/sysconfig/selinux && setenforce 0
echo "SELINUX disabled"
else
echo "argument error"
fi
2>添加执行权限，检查selinux配置文件
[root@centos7 data]# chmod +x selinux_control.sh
[root@centos7 data]# cat /etc/sysconfig/selinux
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
3>执行脚本
[root@centos7 data]# sh /selinux_control.sh ###不带参数
Usage:selinux_control.sh on|off
[root@centos7 data]# sh /selinux_control.sh dafda ###带错误参数
argument error
[root@centos7 data]# sh /selinux_control.sh on ###启动selinux
SELINUX enforcing
[root@centos7 data]# cat /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
[root@centos7 data]# sh selinux_control.sh off ###禁用selinux
SELINUX disabled
[root@centos7 data]# cat /etc/sysconfig/selinux
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
2、统计/etc/fstab文件中每个文件系统类型出现的次数
[root@centos7 ~]# cat test.locat /etc/fstab | awk '/^UUID/{sum[$3]++}END{for(type in sum){print type,sum[type]}}'
swap 1
xfs 3
3、提取出字符串"Yd$C@M05MB%9&Bdh7dq+YVixp3vpw"中的所有数字
tr提取：
[root@centos7 ~]# echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw"|tr -dc "[^0-9]"
05973
grep提取：
[root@centos7 ~]# echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw"|grep -o '[0-9]'
0
5
9
7
3
awk提取：
[root@centos7 ~]# echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw"|awk -F '[^0-9]+' '{for(i=1;i<=NF;i++){print $i}}'
05
9
7
3
4、解决DOS攻击生产案例:根据web日志或者网络连接数，监控当某个IP 并发连接数或者短时内PV达到100，即调用防火墙命令封掉对应的IP，监控频 率每隔5分钟。防火墙命令为:iptables -A INPUT -s IP -j REJECT
1>创建脚本dos_prevent.sh
[root@centos7 ~]# ip addr show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:be:ff:5b brd ff:ff:ff:ff:ff:ff
inet 192.168.100.7/24 brd 192.168.100.255 scope global noprefixroute eth0
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:febe:ff5b/64 scope link
valid_lft forever preferred_lft forever
[root@centos7 data]# vim dos_prevent.sh
#!/bin/bash
#以IP和时间为下标创建数组，确保短时间内同一IP的大量访问是dos攻击
#判断短时间内同一IP访问次数大于100，将符合条件的IP输出到文件
awk '{sum[$1$4]++}END{for (ip in sum){if(sum[ip]>100)print ip,sum[ip]}}' /var/log/httpd/access_log | cut -d'[' -f1 | uniq > /data/ip.log
while read LINE;do
if [ -n "$LINE" ];then
#检查防火墙规则是否已经添加过攻击IP，如果有，跳过此次循环，否则添加
if iptables -L|grep -q $LINE;then
continue
else
iptables -A INPUT -s $LINE -j REJECT
echo $LINE >> /data/blacklist.log
fi
fi
done < /data/ip.log
[root@centos7 data]# chmod +x dos_prevent.sh
2>添加任务计划，并检查防火墙规则
[root@centos7 ~]# vim /etc/crontab
*/5 * * * * root sh /data/dos_prevent.sh &>/dev/null
[root@centos7 ~]# iptables -nvL
Chain INPUT (policy ACCEPT 426 packets, 67223 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 150 packets, 21356 bytes)
pkts bytes target prot opt in out source destination
3>在另一台机器上使用ab测试
[root@centos6 ~]# ip addr show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:0c:29:8c:f8:9c brd ff:ff:ff:ff:ff:ff
inet 192.168.100.6/24 brd 192.168.100.255 scope global eth0
inet6 fe80::20c:29ff:fe8c:f89c/64 scope link
valid_lft forever preferred_lft forever
[root@centos6 ~]# ab -c20 -n200 192.168.100.7/index.html
This is ApacheBench, Version 2.3 <$Revision: 655654 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/
Benchmarking 192.168.100.7 (be patient)
Completed 100 requests
Completed 200 requests
Finished 200 requests
Server Software: Apache/2.4.6
Server Hostname: 192.168.100.7
Server Port: 80
Document Path: /index.html
Document Length: 208 bytes
Concurrency Level: 20
Time taken for tests: 0.068 seconds
Complete requests: 200
Failed requests: 0
Write errors: 0
Non-2xx responses: 200
Total transferred: 77400 bytes
HTML transferred: 41600 bytes
Requests per second: 2925.90 [#/sec] (mean)
Time per request: 6.835 [ms] (mean)
Time per request: 0.342 [ms] (mean, across all concurrent requests)
Transfer rate: 1105.79 [Kbytes/sec] received
Connection Times (ms)
min mean[+/-sd] median max
Connect: 0 0 0.7 0 3
Processing: 2 6 1.8 6 10
Waiting: 0 6 1.8 6 9
Total: 3 6 1.8 6 11
Percentage of the requests served within a certain time (ms)
50% 6
66% 7
75% 8
80% 9
90% 9
95% 10
98% 10
99% 10
100% 11 (longest request)
4>检查cron服务日志，并检查防火墙规则
[root@centos7 ~]# tail -f /var/log/cron
Apr 21 21:01:01 centos7 run-parts(/etc/cron.hourly)[6270]: finished 0anacron
Apr 21 22:01:01 centos7 CROND[6670]: (root) CMD (run-parts /etc/cron.hourly)
Apr 21 22:01:01 centos7 run-parts(/etc/cron.hourly)[6670]: starting 0anacron
Apr 21 22:01:01 centos7 run-parts(/etc/cron.hourly)[6679]: finished 0anacron
Apr 21 22:51:01 centos7 crond[628]: (*system*) RELOAD (/etc/crontab)
Apr 21 22:55:01 centos7 CROND[7124]: (root) CMD (sh /data/dos_prevent.sh &>/dev/null)
Apr 21 22:56:10 centos7 crond[628]: (CRON) INFO (Shutting down)
Apr 21 22:56:10 centos7 crond[7151]: (CRON) INFO (RANDOM_DELAY will be scaled with factor 13% if used.)
Apr 21 22:56:10 centos7 crond[7151]: (CRON) INFO (running with inotify support)
Apr 21 22:56:10 centos7 crond[7151]: (CRON) INFO (@reboot jobs will be run at computer's startup.)
Apr 21 22:57:01 centos7 crond[7151]: (*system*) RELOAD (/etc/crontab)
Apr 21 23:00:01 centos7 CROND[7197]: (root) CMD (sh /data/dos_prevent.sh &>/dev/null)
Apr 21 23:01:01 centos7 CROND[7209]: (root) CMD (run-parts /etc/cron.hourly)
Apr 21 23:01:01 centos7 run-parts(/etc/cron.hourly)[7209]: starting 0anacron
Apr 21 23:01:01 centos7 run-parts(/etc/cron.hourly)[7218]: finished 0anacron
[root@centos7 ~]# iptables -nvL
Chain INPUT (policy ACCEPT 195 packets, 45949 bytes)
pkts bytes target prot opt in out source destination
0 0 REJECT all -- * * 192.168.100.6 0.0.0.0/0 reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 33 packets, 3656 bytes)
pkts bytes target prot opt in out source destination
验证成功！
扫一扫
2500
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
