1、编写脚本selinux.sh，实现开启或禁用SELinux功能
read -p "please input character set selinux for {start|stop} :" SE
SEC=$(sed -rn 's@^SELINUX=(.*)@\1@'p /etc/selinux/config)
if [ $SE == 'start' ];then
if [ $SEC == 'enforcing' ];then
echo "selinux current status is enforcing"
elif [ $SEC == 'disabled' ];then
sed -ri 's@^SELINUX=(.*)@SELINUX=enforcing@' /etc/selinux/config && echo "selinux start succeed"
fi
elif [ $SE == 'stop' ];then
if [ $SEC == 'disabled' ];then
echo "selinux current status is disabled"
elif [ $SEC == 'enforcing' ];then
sed -ri 's@^SELINUX=(.*)@SELINUX=disabled@' /etc/selinux/config && echo "selinux stop succeed"
fi
fi
2、统计/etc/fstab文件中每个文件系统类型出现的次数
grep "^UUID" fstab |awk -F" " '{print $3}' | uniq -c
3、提取出字符串Yd$C@M05MB%9&Bdh7dq+YVixp3vpw中的所有数字
echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw" | awk -F "" '
{
for(i=1;i<=NF;i++)
{
if ($i ~ /[0-9]/)
{
str=$i
str1=(str1 str)
}
}
print str1
}'
4、解决DOS攻击生产案例:根据web日志或者或者网络连接数，监控当某个IP 并发连接数或者短时内PV达到100，即调用防火墙命令封掉对应的IP，监控频 率每隔5分钟。防火墙命令为:iptables -A INPUT -s IP -j REJECT
web，也可以分析日志，把单IP PV数高的封掉。按天定义PV=1000即封掉
#!/bin/bash
while true
do
awk'{print $1}'access.log|grep -v "^$"|sort|uniq -c > /tmp/tmp.log
exec </tmp/tmp.log
while read line
do
ip=`echo $link | awk '{print $2}'`
count=`echo $line |awk'{print $1}'`
if[ $count -gt 5 ] && [ `iptables -L -n | grep "$ip"|wc-l` -lt 1 ]
then
iptables -I INPUT -s $ip -j REJECT
echo"$line is dropped" >>/tmp/droplist.log
fi
done
sleep5
done
