1、编写脚本selinux.sh，实现开启或禁用SELinux功能

read -p "please input character set selinux for {start|stop} :" SE
SEC=$(sed -rn 's@^SELINUX=(.)@\1@'p /etc/selinux/config)
if [ $SE == 'start' ];then
if [ $SEC == 'enforcing' ];then
echo "selinux current status is enforcing"
elif [ $SEC == 'disabled' ];then
sed -ri 's@^SELINUX=(.)@SELINUX=enforcing@' /etc/selinux/config && echo "selinux start succeed"
fi
elif [ $SE == 'stop' ];then
if [ $SEC == 'disabled' ];then
echo "selinux current status is disabled"
elif [ $SEC == 'enforcing' ];then
sed -ri 's@^SELINUX=(.*)@SELINUX=disabled@' /etc/selinux/config && echo "selinux stop succeed"
fi
fi

2、统计/etc/fstab文件中每个文件系统类型出现的次数

grep "^UUID" fstab | awk -F" " '{print $3}' | uniq -c

3、提取出字符串Yd$C@M05MB%9&Bdh7dq+YVixp3vpw中的所有数字

echo "Yd$C@M05MB%9&Bdh7dq+YVixp3vpw" | awk -F "" '
{
for(i=1;i<=NF;i++)
{
if ($i ~ /[0-9]/)
{
str=$i
str1=(str1 str)
}
}
print str1
}'

**4、解决DOS*生产案例:根据web日志或者或者网络连接数，监控当某个IP 并发连接数或者短时内PV达到100，即调用防火墙命令封掉对应的IP，监控频 率每隔5分钟。防火墙命令为:iptables -A INPUT -s IP -j REJECT

#!/bin/sh
while true
do
awk '{print $1}' access.log |sort |uniq -c >/tmp/ip.log#分析web访问日志
while read line
do
ip=echo $line|awk '{print $2}'
count=echo $line|awk '{print $1}'
if [ $count -gt 100 ] && [ iptables -L -n|grep $ip|wc -l -lt 1 ]
then
iptables -A INPUT -s $ip -j REJECT
echo "$line is dropped" >>/tmp/drop_ip.log
fi
done sleep 300
done