1、編寫腳本selinux.sh，實現(xiàn)開啟或禁用SELinux功能

腳本如下：

#!/bin/bash

case "$1" in
    on)
        sed -i '/^SELINUX=/c\SELINUX=enforcing' /etc/selinux/config && echo "executed successfully, please reboot"
        ;;
    off)
        sed -i '/^SELINUX=/c\SELINUX=disabled' /etc/selinux/config && echo "executed successfully, please reboot"
        ;;
    *)
        echo "Usage: $0 on|off"
        ;;
esac

執(zhí)行結果如下：

[21:48:26 root@centos7-2 data]#./selinux.sh on
executed successfully, please reboot
[21:48:32 root@centos7-2 data]#./selinux.sh off
executed successfully, please reboot
[21:48:36 root@centos7-2 data]#./selinux.sh aa
Usage: ./selinux.sh on|off

2、統(tǒng)計/etc/fstab文件中每個文件系統(tǒng)類型出現(xiàn)的次數(shù)

/etc/fstab文件內(nèi)容如下：

[21:56:30 root@centos7 ~]#cat /etc/fstab 

#
# /etc/fstab
# Created by anaconda on Fri May 15 16:26:08 2020
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
UUID=5323ffc1-3434-41b0-b8ec-909403493a60 /                       xfs     defaults        0 0
UUID=edd1490f-a15a-4a21-82dc-928bc1c04b38 /boot                   xfs     defaults        0 0
UUID=5d56a0d4-150b-4827-8f82-763868b561c7 /data                   xfs     defaults        0 0
UUID=ed5d5d57-d87f-48e8-90df-c962f78230d9 swap                    swap    defaults        0 0
UUID=b73bf8f8-7c53-4abc-8d67-ea8d1f446fa8 /mnt/sda6               ext3    defaults        0 0
UUID=1d138cbd-a684-4be1-9939-27132163d631 /mnt/sda7               ext3    defaults        0 0
UUID=03fd63d6-d79a-4b95-83e6-6bf7df3cf764 /mnt/sda8               ext3    defaults        0 0
UUID=360479c3-3bc0-4c7e-859d-f72f98366fac /mnt/sda9               ext4    defaults        0 0

使用AWK命令統(tǒng)計，結果如下：

[22:45:19 root@centos7 ~]#awk -F " " /^UUID/'{ FileSystem[$3]++ }BEGIN{print "FileSystem NUM\n---------------"}END{for (i in FileSystem ){printf "%-11s %d\n",i,FileSystem[i] }}' /etc/fstab 
FileSystem NUM
---------------
swap        1
ext3        3
ext4        1
xfs         3

3、提取出字符串Yd$C@M05MB%9&Bdh7dq+YVixp3vpw中的所有數(shù)字

利用awk自帶函數(shù)gsub，用法如下：
gsub(r,s,[t])：對t字符串進行搜索r表示的模式匹配的內(nèi)容，并全部替換為s所表示的內(nèi)容
處理結果如下：

[22:53:53 root@centos7 ~]#echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw" | awk 'gsub(/[^0-9]/,"",$0)'
05973

4、解決DOS攻擊生產(chǎn)案例:根據(jù)web日志或者或者網(wǎng)絡連接數(shù)，監(jiān)控當某個IP 并發(fā)連接數(shù)或者短時內(nèi)PV(頁面瀏覽量)達到100，即調(diào)用防火墻命令封掉對應的IP，監(jiān)控頻率每隔5分鐘。防火墻命令為:iptables -A INPUT -s IP -j REJECT

先編寫腳本：

#!/bin/bash

awk '{ip[$1]++}END{for(i in ip){if(ip[i]>100)print i}}' /var/log/httpd/access_log > /tmp/hosts.txt
while read ip; do
    iptables -A INPUT -s $ip -j REJECT
done < /tmp/hosts.txt

腳本執(zhí)行如下：

[23:35:50 root@centos7-2 data]#bash -x ddos_monitor.sh
+ awk '{ip[$1]++}END{for(i in ip){if(ip[i]>100)print i}}' /var/log/httpd/access_log
+ read ip
+ iptables -A INPUT -s 192.168.23.17 -j REJECT
+ read ip

給該腳本添加執(zhí)行權限，并將該腳本加入定時任務，結果如下：

[23:40:31 root@centos7-2 data]#crontab -l
*/5 * * * * ./data/ddos_monitor.sh