啟東Shell編寫

Mr. Neo Chen (netkiller), 陳景峰(BG7NYT)

中國廣東省深圳市龍華新區民治街道溪山美地
518131
+86 13113668890
+86 755 29812080
<netkiller@msn.com>

$Id: shell.xml 449 2012-08-10 10:38:08Z netkiller $

$Data$

摘要

我的系列文檔

1. 啟用 shell
2. htpasswd 密碼批量生成
3. firewall

1. 啟用 shell

1 解決重複運行問題

1 記錄PID以便可以停止Shell運維

		
#!/bin/bash
##############################################
# $Author: netkiller $
# $Id: shell.xml 449 2012-08-10 10:38:08Z netkiller $
##############################################
NAME=info
BASEDIR='/www'
PROG=$BASEDIR/bin/$(basename $0)
LOGFILE=/var/tmp/$NAME.log
PIDFILE=/var/tmp/$NAME.pid
##############################################
PHP=/usr/local/webserver/php/bin/php
##############################################
#echo $$
#echo $BASHPID
function start(){
	if [ -f "$PIDFILE" ]; then
		echo $PIDFILE
		exit 2
	fi

	for (( ; ; ))
	do
		cd $BASEDIR/crontab/
		$PHP readfile.php > $LOGFILE
		$PHP chart_gold_silver_xml.php > /dev/null
		sleep 60
	done &
	echo $! > $PIDFILE
}
function stop(){
  	[ -f $PIDFILE ] && kill `cat $PIDFILE` && rm -rf $PIDFILE
}

case "$1" in
  start)
  	start
	;;
  stop)
  	stop
	;;
  status)
  	ps ax | grep chart.xml | grep -v grep | grep -v status
	;;
  restart)
  	stop
	start
	;;
  *)
	echo $"Usage: $0 {start|stop|status|restart}"
	exit 2
esac

exit $?

2. htpasswd 密碼批量生成

		
#!/bin/bash

PASSFILE=nginx.password
[ ! -f $PASSFILE ] && touch $PASSFILE

while read username password
do
        htpasswd -b -d $PASSFILE $username $password
done << EOF
neo     FwJSYxD4WBzPr4CQvxI8HIbV0yDkQi
chen    2hsD3OgkeM4GPPcNYUceqL8ccMzXjU
bg7nyt  XAq7Zcln8dGCTIIKt8GwwEwqmCN8d1
netkiller       fcCIY3GaroTPCSW40XBrg0HNlmbLD7
neochen DPSiWJtqUIaI2bUUobuX2PjdyzDGgI
EOF

3. firewall

分析access.log 檔案,將 top 30 的IP放入黑名單.

腳本具有黑白名單功能

		
#!/bin/bash

ACCCESS_LOG=/tmp/access.log
TIMEPOINT='24/May/2012'
BLACKLIST=/var/tmp/black
WHITELIST=/var/tmp/white
if [ ! -f ${BLACKLIST} ]; then
    touch ${BLACKLIST}
fi

if [ ! -f ${WHITELIST} ]; then
    touch ${WHITELIST}
fi

for deny in $(grep ${TIMEPOINT} ${ACCCESS_LOG} | awk '{print $1}' | awk -F'.' '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -r -n | head -n 30| awk '{print $2}')
do

    if [ $(grep -c $deny ${WHITELIST}) -ne 0 ]; then
        echo 'Allow IP:' $deny
	iptables -D INPUT -p tcp --dport 443 -s $deny -j DROP
	iptables -D INPUT -p tcp --dport 80 -s $deny -j DROP
	continue
    fi

    if [ $(grep -c $deny ${BLACKLIST}) -eq 0 ] ; then

	echo 'Deny IP:' $deny
        echo $deny >> ${BLACKLIST}
        iptables -I INPUT -p tcp --dport 443 -s $deny -j DROP
        iptables -I INPUT -p tcp --dport 80 -s $deny -j DROP
    fi
done

Netkiller Architect 手札	Netkiller Developer 手札	Netkiller Testing 手札	Netkiller Cryptography 手札	Netkiller Version 手札
Netkiller Linux 手札	Netkiller Debian 手札	Netkiller CentOS 手札	Netkiller FreeBSD 手札	Netkiller Security 手札
Netkiller Web 手札	Netkiller Monitoring 手札	Netkiller Storage 手札	Netkiller Mail 手札	Netkiller Shell 手札
Netkiller Database 手札	Netkiller PostgreSQL 手札	Netkiller MySQL 手札	Netkiller NoSQL 手札	Netkiller LDAP 手札
Netkiller Network 手札	Netkiller Cisco IOS 手札	Netkiller Multimedia 手札	Netkiller Docbook 手札	Netkiller 開源軟件手札