第10周作业

1、编写脚本selinux.sh，实现开启或禁用SELinux功能

read -p "please input character set selinux for {start|stop} :" SE

SEC=$(sed -rn 's@^SELINUX=(.*)@\1@'p /etc/selinux/config)

if [ $SE == 'start' ];then

if [ $SEC == 'enforcing' ];then

echo "selinux current status is enforcing"

elif [ $SEC == 'disabled' ];then

sed -ri 's@^SELINUX=(.*)@SELINUX=enforcing@' /etc/selinux/config && echo "selinux start succeed"

elif [ $SE == 'stop' ];then

if [ $SEC == 'disabled' ];then

echo "selinux current status is disabled"

elif [ $SEC == 'enforcing' ];then

sed -ri 's@^SELINUX=(.*)@SELINUX=disabled@' /etc/selinux/config && echo "selinux stop succeed"

2、统计/etc/fstab文件中每个文件系统类型出现的次数

grep "^UUID" fstab |awk -F" " '{print $3}' | uniq -c

3、提取出字符串Yd$C@M05MB%9&Bdh7dq+YVixp3vpw中的所有数字

echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw" | awk -F "" '

{

for(i=1;i<=NF;i++)

{

if ($i ~ /[0-9]/)

{

str=$i

str1=(str1 str)

}

print str1

4、解决DOS攻击生产案例:根据web日志或者或者网络连接数，监控当某个IP 并发连接数或者短时内PV达到100，即调用防火墙命令封掉对应的IP，监控频率每隔5分钟。防火墙命令为:iptables -A INPUT -s IP -j REJECT

web，也可以分析日志，把单IP PV数高的封掉。按天定义PV=1000即封掉

#!/bin/bash

while true

awk'{print $1}'access.log|grep -v "^$"|sort|uniq -c > /tmp/tmp.log

exec </tmp/tmp.log

while read line

ip=`echo $link | awk '{print $2}'`

count=`echo $line |awk'{print $1}'`

if[ $count -gt 5 ] && [ `iptables -L -n | grep "$ip"|wc-l` -lt 1 ]

then

iptables -I INPUT -s $ip -j REJECT

echo"$line is dropped" >>/tmp/droplist.log

done

sleep5

done