第十一周

1、编写脚本/root/bin/checkip.sh，每5分钟检查一次，如果发现通过ssh登录失败 次数超过10次，自动将此远程IP放入Tcp Wrapper的黑名单中予以禁止防问

[root@laowei03 ~]#vim /bin/checkip.sh
#!/bin/bash

lastb | awk '/ssh/{print $3}'| sort | uniq -c | sort -nr > /data/TCP_Wrappers.txt
while read count ip;do
    if [ $count -gt 10 ];then
        echo "sshd:$ip:deny" > /etc/hosts.allow
    fi
done < /data/TCP_Wrappers.txt
[root@laowei03 ~]#crontab -e
*/5 * * * * /bin/bash /bin/checkip.sh

#用两个客户端分别向13主机发起多次ssh失败连接，如下
[root@laowei03 ~]#lastb
root     ssh:notty    192.168.7.12     Fri Apr 24 17:18 - 17:18  (00:00)    
root     ssh:notty    192.168.7.12     Fri Apr 24 17:17 - 17:17  (00:00)    
root     ssh:notty    192.168.7.12     Fri Apr 24 17:13 - 17:13  (00:00)    
root     ssh:notty    192.168.7.11     Fri Apr 24 17:13 - 17:13  (00:00)    
root     ssh:notty    192.168.7.12     Fri Apr 24 17:13 - 17:13  (00:00)    
root     ssh:notty    192.168.7.12     Fri Apr 24 17:13 - 17:13  (00:00)    
root     ssh:notty    192.168.7.12     Fri Apr 24 17:13 - 17:13  (00:00)    
root     ssh:notty    192.168.7.12     Fri Apr 24 17:13 - 17:13  (00:00)    
root     ssh:notty    192.168.7.12     Fri Apr 24 17:13 - 17:13  (00:00)    
root     ssh:notty    192.168.7.12     Fri Apr 24 17:13 - 17:13  (00:00)    
root     ssh:notty    192.168.7.12     Fri Apr 24 17:13 - 17:13  (00:00)    
root     ssh:notty    192.168.7.11     Fri Apr 24 17:13 - 17:13  (00:00)    
root     ssh:notty    192.168.7.11     Fri Apr 24 17:13 - 17:13  (00:00)    
root     ssh:notty    192.168.7.11     Fri Apr 24 17:13 - 17:13  (00:00)

#当定时任务执行后，再用12尝试ssh连接13主机
[root@laowei02 ~]#ssh 192.168.7.13
ssh_exchange_identification: read: Connection reset by peer
可以看出已经被拒绝，无法连接

2、配置magedu用户的sudo权限，允许magedu用户拥有root权限

[root@laowei03 ~]#touch f1.txt
[root@laowei03 ~]#ll f1.txt 
-rw-r--r-- 1 root root 0 Apr 24 16:29 f1.txt

#切换到magedu用户，尝试查看文件目录
[magedu@laowei03 ~]$ll /root/
ls: cannot open directory /root/: Permission denied
显示权限被拒绝

#然后添加magedu权限
[root@laowei03 etc]#visudo -f sudoers
magedu  ALL=(root)      ALL
#检查配置是否成功
[root@laowei03 etc]#visudo -c 
/etc/sudoers: parsed OK

#切换到magedu用户，再次访问并用root账号验证
[magedu@laowei03 ~]$sudo vim /root/f1.txt
[sudo] password for magedu:
[root@laowei03 ~]#ll f1.txt 
-rw-r--r-- 1 root root 7 Apr 24 16:57 f1.txt
[root@laowei03 ~]#cat f1.txt 
hehehe
可以看到f1.txt成功添加了文本，证实magedu获得了root权限