REHL7/CentOS7 中/etc/resolv.conf 详解
Posted
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了REHL7/CentOS7 中/etc/resolv.conf 详解相关的知识，希望对你有一定的参考价值。
参考技术A 这几天在调整Openshift Node域名解析的过程中，发现了与DNS相关的一些配置，花了2天时间，终于理出了一个头绪。首先我们知道，在Linux中，DNS的配置文件位于/etc/resolv.conf，里面主要有三个字段，分别是nameserver, domain, search
我们简单看一下以下例子：
# Generated by NetworkManager
domain example.com
search example.com
nameserver 192.168.1.100
这里domain和search是一个作用，在俩这同时存在时，前者失效。
当访问的域名不能被DNS解析时，resolver会将该域名加上search指定的参数，重新请求DNS，直到被正确解析或试完search指定的列表为止。
这里需要注意一点，在NetworkManager开启的时候，/etc/resolv.conf文件在每次NetworkManager服务重启的过程中会被重写。并且当ifcfg-eth0中proto为dhcp是，peerdns默认为yes，所以每次NetworkManager进行重写时，都会获取dhcp client抓到的dns信息对nameserver和search字段进行重写。
peerdns字段的作用域分两种情况：
简单解释一下：
为yes时：1 如果在网卡(ifcfg-eth0)中设置了DNS地址，或者开启了dhcp client，此项默认为yes
为no时: 不会对/etc/resolv.conf进行重写
下面我们来做两个实验：
我建立了一个RHEL7.7的虚拟机和一台WINDOWS2019 DNS server，以下时两台server的基本信息：
RHEL7.7:
hostname: redhat.eubrmb.com
ip address: 192.168.199.130
WIN2019 server:
ip address: 192.168.199.100
当我把RHEL7的网卡设置为如下时，我们先把resolv.conf文件清空，然后再重启NetworkManager，然后再次观察resolv.conf文件的信息：
# echo > /etc/resolv.conf
# systemctl restart NetworkManager
# cat /etc/resolv.conf
现在我们修改一下网卡配置，然后再次清空resolv.conf，并重启NetworkManager后重新查看：
# echo > /etc/resolv.conf
# systemctl restart NetworkManager
# cat /etc/resolv.conf
由此可见，再开启了dhcp之后，无论我们加不加DNS字段，或者加不加PEERNDS=yes，resolv.conf都会被重写
# echo > /etc/resolv.conf
# systemctl restart NetworkManager
# cat /etc/resolv.conf
这里我们看到，在网卡协议为static，DNS字段存在时，就算PEERNDS=no，resolv.conf也会被重写
当我们去掉DNS字段后，重新测试，发现resolv.conf这回未被重写
细心的人会发现，这里search里面和上面用dhcp测试时不太一样，这里少了一个localdomain。之前被这个问题纠结了一天，最后发现，当为dhcp时，search中的字段会带入dhcp client中拿到的一些信息，因为我用的是VMware workstation，所以这里带入了一个localdoamin。在阿里云ECS上并为发现这个问题，这个search domain会截取主机名第一个点之后的名字当作FQDN的suffix。
总结：
当我们需要手动添加DNS server记录，并不希望重启网络后被重写，我们需要把我们的网卡设置调整为static，并设置PEERNDS=no，最后在/etc/resolv.conf中添加nameserver，这样才能达到我们想要的效果
CentOS7REHL7的firewalld防火墙使用简单说明
title: CentOS7、REHL7的firewalld防火墙使用简单说明
categories: Linux
tags:
- Linux
timezone: Asia/Shanghai
date: 2019-02-25
环境
[[email protected] zones]# cat /etc/centos-release CentOS Linux release 7.6.1810 (Core) [[email protected] home]# firewall-cmd -V 0.5.3
基本使用
1.启动和停止
systemctl start firewalld.service # 启动firewalld服务
systemctl stop firewalld.service # 停止firewalld服务
systemctl status firewalld.service # 查看firewalld服务状态
systemctl enable firewalld.service # 开机自动启动
systemctl disable firewalld.service # 禁用开机自动启动
2.查看状态
firewall-cmd -V # 查看firewalld的版本信息 firewall-cmd --state # 查看运行状态 firewall-cmd --list-services # 查看允许访问的服务 firewall-cmd --list-ports # 查看允许访问的端口 firewall-cmd --list-all # 查看所有允许的 firewall-cmd --get-default-zone # 查看默认zone firewall-cmd --get-active-zones # 查看当前生效的zone firewall-cmd --list-all-zones # 列出所有zone配置
3.开放服务
## 开放和删除端口 firewall-cmd --add-port=80/tcp firewall-cmd --remove-port=80/tcp ## 批量开放和批量删除端口 firewall-cmd --add-port=100-500/tcp firewall-cmd --add-port=100-500/udp ## 添加和删除服务 firewall-cmd --add-service=http firewall-cmd --remove-service=http ## 允许指定IP/IP段访问某端口 firewall-cmd --add-rich-rule="rule family="ipv4" source address="11.11.11.62" port protocol="tcp" port="80" accept" firewall-cmd --add-rich-rule="rule family="ipv4" source address="11.11.11.0/24" port protocol="tcp" port="80" accept" ## 允许某IP/IP段的所有访问 firewall-cmd --add-rich-rule="rule family="ipv4" source address="11.11.11.62" accept" firewall-cmd --add-rich-rule="rule family="ipv4" source address="11.11.11.0/24" accept" ## 删除富规则 firewall-cmd --remove-rich-rule ‘rule family="ipv4" source address="11.11.11.0/24" accept‘
4.禁止某IP/IP段连接
firewall-cmd --add-rich-rule="rule family="ipv4" source address="11.11.11.0/24" port port="22" protocol="tcp" drop" firewall-cmd --add-rich-rule="rule family="ipv4" source address="11.11.11.0/24" drop"
5.查看当前生效设置和已保存设置
firewall-cmd --list-all # 查看所有允许的 - 当前已生效设置 firewall-cmd --get-active-zones # 查看当前生效的zone cat /etc/firewalld/zones/public.xml # 查看``public``区域的已保存设置
6.保存配置
firewall-cmd --runtime-to-permanent # 保存配置 firewall-cmd --reload # 重新加载防火墙并保留状态信息 firewall-cmd --complete-reload # 重新加载防火墙并丢失状态信息
7.使用流程说明
1.首先查看当前防火墙状态是否开放 2.查看当前允许访问的端口和服务 3.查看默认的zone和当前生效的zone（一般使用``public``作为平时使用的zone） 这里说了是一般情况下都会使用``plulic``作为平时使用的zone 所以不排除特殊情况或经过自己自定义的zone zone的设计本身就是为了切换不同网络的时候不用来回重新配置防火墙而设计的 比如平时用``public``，但是服务器检修的时候使用``drop`` 或者平时使用``public``，但是这个是我自己笔记本上安装的系统，到单位以后需要切换``work``，所以直接全部指定``plulic``可能会出现异议 所以这里使用命令的时候都没有像其他教程里一样添加``--zone=public``来指定需要设置的zone，而首先确认当前生效zone后直接设置 4.添加开放端口或服务 5.保存配置 这里说明下，网上所有的教程里都有加``--permanent``选项以使当前命令直接保存到永久配置 我这里是采用类似Cisco网络设备的调试方式，先开放或者关闭某端口 然后确认没问题后，运行``firewall-cmd --runtime-to-permanent``命令保存配置 如果刚才的命令执行有问题可以直接重新重启防火墙服务、重新加载配置或者重启服务器即可恢复到初始状态 这样操作手法可以避免因为误操作造成自己都连不上服务器的问题。 如果经常使用网络设备的小伙伴应该会很容易习惯这种方式 6.关于和``iptables``关系 ``firewall``和``iptables``都只是Linux系统下的防火墙配置和管理工具 通过``firewall-cmd``设置防火墙规则后同样支持使用``iptables -L -n``查看具体规则内容 同时CentOS7和REHL7下同样可以禁用``firewalld``，而使用``iptables``服务来设置和管理防火墙
8.设置服务器只允许某IP/IP段连接服务器SSH
firewall-cmd --add-rich-rule="rule family="ipv4" source address="11.11.11.62" port protocol="tcp" port="22" accept" firewall-cmd --remove-service=ssh firewall-cmd --runtime-to-permanent # 保存配置 systemctl restart firewalld.service
常用选项
| 语法 | 释义 |
|---|---|
| firewall-cmd -h | 打印帮助信息 |
| firewall-cmd -V | 查看firewalld的版本信息 |
| firewall-cmd --state | 返回并打印firewalld状态 |
| firewall-cmd --reload | 重新加载防火墙并保留状态信息 |
| firewall-cmd --complete-reload | 重新加载防火墙并丢失状态信息 |
| firewall-cmd --runtime-to-permanent | 从运行时配置创建永久配置 |
| firewall-cmd --panic-on | 启用应急模式 |
| firewall-cmd --panic-off | 禁用应急模式 |
| firewall-cmd --query-panic | 查询是否启用了应急模式 |
| firewall-cmd --list-services | 查看允许访问的服务 |
| firewall-cmd --list-ports | 查看允许访问的端口 |
| firewall-cmd --list-all | 查看所有允许的 |
| firewall-cmd --add-port=80/tcp | 开放TCP的80端口 |
| firewall-cmd --remove-port=80/tcp | 删除TCP的80端口 |
安装图形界面和使用
yum install -y firewall-config firewall-config
firewall-cmd用法
Usage: firewall-cmd [OPTIONS...]
1.常规选项 - General Options
-h, --help Prints a short help text and exists # 打印帮助信息 -V, --version Print the version string of firewalld # 查看firewalld的版本信息 -q, --quiet Do not print status messages # 不打印状态消息
2.状态选项 - Status Options
--state Return and print firewalld state # 返回并打印firewalld状态 --reload Reload firewall and keep state information # 重新加载防火墙并保留状态信息 --complete-reload Reload firewall and lose state information # 重新加载防火墙并丢失状态信息 --runtime-to-permanent Create permanent from runtime configuration # 从运行时配置创建永久，保存配置
3.记录拒绝选项 - Log Denied Options
--get-log-denied Print the log denied value # 打印拒绝日志 --set-log-denied=<value> Set log denied value # 设置日志拒绝值 --get-ipset-types Print the supported ipset types # 打印支持的ipset类型
4.永久选择 - Permanent Options
--permanent Set an option permanently # 永久设置选项 Usable for options marked with [P] # 可用于标有[P]的选项
5.zone选项 - Zone Options
--get-default-zone Print default zone for connections and interfaces # 获取默认zone --set-default-zone=<zone> Set default zone # 获取默认zone --get-active-zones Print currently active zones # 获取当前活动zone --get-zones Print predefined zones [P] # 获取所有预定义zone --get-services Print predefined services [P] # 获取预定义区域 --get-icmptypes Print predefined icmptypes [P] # 打印预定义的icmp类型 --get-zone-of-interface=<interface> Print name of the zone the interface is bound to [P] # 获取指定网卡绑定的zone --get-zone-of-source=<source>[/<mask>]|<MAC>|ipset:<ipset> Print name of the zone the source is bound to [P] # --list-all-zones List everything added for or enabled in all zones [P] # 列出在所有zond中添加或启用的所有内容 --new-zone=<zone> Add a new zone [P only] # 添加新zone --new-zone-from-file=<filename> [--name=<zone>] Add a new zone from file with optional name [P only] # 从文件创建新zone --delete-zone=<zone> Delete an existing zone [P only] # 删除现有zone --load-zone-defaults=<zone> Load zone default settings [P only] [Z] # 加载zone默认设置 --zone=<zone> Use this zone to set or query options, else default zone Usable for options marked with [Z] --get-target Get the zone target [P only] [Z] --set-target=<target> Set the zone target [P only] [Z] # --info-zone=<zone> Print information about a zone # 打印指定zone的相关信息 --path-zone=<zone> Print file path of a zone [P only] #
6.IPSet选项 - IPSet Options
--get-ipset-types Print the supported ipset types --new-ipset=<ipset> --type=<ipset type> [--option=<key>[=<value>]].. Add a new ipset [P only] --new-ipset-from-file=<filename> [--name=<ipset>] Add a new ipset from file with optional name [P only] --delete-ipset=<ipset> Delete an existing ipset [P only] --load-ipset-defaults=<ipset> Load ipset default settings [P only] --info-ipset=<ipset> Print information about an ipset --path-ipset=<ipset> Print file path of an ipset [P only] --get-ipsets Print predefined ipsets --ipset=<ipset> --set-description=<description> Set new description to ipset [P only] --ipset=<ipset> --get-description Print description for ipset [P only] --ipset=<ipset> --set-short=<description> Set new short description to ipset [P only] --ipset=<ipset> --get-short Print short description for ipset [P only] --ipset=<ipset> --add-entry=<entry> Add a new entry to an ipset [P] --ipset=<ipset> --remove-entry=<entry> Remove an entry from an ipset [P] --ipset=<ipset> --query-entry=<entry> Return whether ipset has an entry [P] --ipset=<ipset> --get-entries List entries of an ipset [P] --ipset=<ipset> --add-entries-from-file=<entry> Add a new entries to an ipset [P] --ipset=<ipset> --remove-entries-from-file=<entry> Remove entries from an ipset [P]
7.IcmpType选项 - IcmpType Options
--new-icmptype=<icmptype> Add a new icmptype [P only] # 添加新的icmptype [仅限P] --new-icmptype-from-file=<filename> [--name=<icmptype>] Add a new icmptype from file with optional name [P only] # 从文件中添加一个带有可选名称的新icmptype [仅限P] --delete-icmptype=<icmptype> Delete an existing icmptype [P only] # 删除现有的icmptype [仅限P] --load-icmptype-defaults=<icmptype> Load icmptype default settings [P only] # 加载icmptype默认设置[仅限P] --info-icmptype=<icmptype> Print information about an icmptype # 打印有关icmptype的信息 --path-icmptype=<icmptype> Print file path of an icmptype [P only] # 打印icmptype的文件路径[仅限P] --icmptype=<icmptype> --set-description=<description> Set new description to icmptype [P only] # 将新描述设置为icmptype [仅限P] --icmptype=<icmptype> --get-description Print description for icmptype [P only] # icmptype的打印说明[仅限P] --icmptype=<icmptype> --set-short=<description> Set new short description to icmptype [P only] # 将新的简短描述设置为icmptype [仅限P] --icmptype=<icmptype> --get-short Print short description for icmptype [P only] # 打印icmptype的简短描述[仅限P] --icmptype=<icmptype> --add-destination=<ipv> Enable destination for ipv in icmptype [P only] # 在icmptype中启用ipv的目标[仅限P] --icmptype=<icmptype> --remove-destination=<ipv> Disable destination for ipv in icmptype [P only] # 在icmptype中禁用ipv的目标[仅限P] --icmptype=<icmptype> --query-destination=<ipv> Return whether destination ipv is enabled in icmptype [P only] # 返回是否在icmptype中启用了目标ipv [仅限P] --icmptype=<icmptype> --get-destinations List destinations in icmptype [P only] # 在icmptype中列出目的地[仅限P]
8.服务选项 - Service Options
--new-service=<service> Add a new service [P only] --new-service-from-file=<filename> [--name=<service>] Add a new service from file with optional name [P only] --delete-service=<service> Delete an existing service [P only] --load-service-defaults=<service> Load icmptype default settings [P only] --info-service=<service> Print information about a service --path-service=<service> Print file path of a service [P only] --service=<service> --set-description=<description> Set new description to service [P only] --service=<service> --get-description Print description for service [P only] --service=<service> --set-short=<description> Set new short description to service [P only] --service=<service> --get-short Print short description for service [P only] --service=<service> --add-port=<portid>[-<portid>]/<protocol> Add a new port to service [P only] --service=<service> --remove-port=<portid>[-<portid>]/<protocol> Remove a port from service [P only] --service=<service> --query-port=<portid>[-<portid>]/<protocol> Return whether the port has been added for service [P only] --service=<service> --get-ports List ports of service [P only] --service=<service> --add-protocol=<protocol> Add a new protocol to service [P only] --service=<service> --remove-protocol=<protocol> Remove a protocol from service [P only] --service=<service> --query-protocol=<protocol> Return whether the protocol has been added for service [P only] --service=<service> --get-protocols List protocols of service [P only] --service=<service> --add-source-port=<portid>[-<portid>]/<protocol> Add a new source port to service [P only] --service=<service> --remove-source-port=<portid>[-<portid>]/<protocol> Remove a source port from service [P only] --service=<service> --query-source-port=<portid>[-<portid>]/<protocol> Return whether the source port has been added for service [P only] --service=<service> --get-source-ports List source ports of service [P only] --service=<service> --add-module=<module> Add a new module to service [P only] --service=<service> --remove-module=<module> Remove a module from service [P only] --service=<service> --query-module=<module> Return whether the module has been added for service [P only] --service=<service> --get-modules List modules of service [P only] --service=<service> --set-destination=<ipv>:<address>[/<mask>] Set destination for ipv to address in service [P only] --service=<service> --remove-destination=<ipv> Disable destination for ipv i service [P only] --service=<service> --query-destination=<ipv>:<address>[/<mask>] Return whether destination ipv is set for service [P only] --service=<service> --get-destinations List destinations in service [P only]
9.Options to Adapt and Query Zones：适应和查询区域的选项
--list-all List everything added for or enabled in a zone [P] [Z] --list-services List services added for a zone [P] [Z] --timeout=<timeval> Enable an option for timeval time, where timeval is a number followed by one of letters ‘s‘ or ‘m‘ or ‘h‘ Usable for options marked with [T] --set-description=<description> Set new description to zone [P only] [Z] --get-description Print description for zone [P only] [Z] --set-short=<description> Set new short description to zone [P only] [Z] --get-short Print short description for zone [P only] [Z] --add-service=<service> Add a service for a zone [P] [Z] [T] --remove-service=<service> Remove a service from a zone [P] [Z] --query-service=<service> Return whether service has been added for a zone [P] [Z] --list-ports List ports added for a zone [P] [Z] --add-port=<portid>[-<portid>]/<protocol> Add the port for a zone [P] [Z] [T] --remove-port=<portid>[-<portid>]/<protocol> Remove the port from a zone [P] [Z] --query-port=<portid>[-<portid>]/<protocol> Return whether the port has been added for zone [P] [Z] --list-protocols List protocols added for a zone [P] [Z] --add-protocol=<protocol> Add the protocol for a zone [P] [Z] [T] --remove-protocol=<protocol> Remove the protocol from a zone [P] [Z] --query-protocol=<protocol> Return whether the protocol has been added for zone [P] [Z] --list-source-ports List source ports added for a zone [P] [Z] --add-source-port=<portid>[-<portid>]/<protocol> Add the source port for a zone [P] [Z] [T] --remove-source-port=<portid>[-<portid>]/<protocol> Remove the source port from a zone [P] [Z] --query-source-port=<portid>[-<portid>]/<protocol> Return whether the source port has been added for zone [P] [Z] --list-icmp-blocks List Internet ICMP type blocks added for a zone [P] [Z] --add-icmp-block=<icmptype> Add an ICMP block for a zone [P] [Z] [T] --remove-icmp-block=<icmptype> Remove the ICMP block from a zone [P] [Z] --query-icmp-block=<icmptype> Return whether an ICMP block has been added for a zone [P] [Z] --add-icmp-block-inversion Enable inversion of icmp blocks for a zone [P] [Z] --remove-icmp-block-inversion Disable inversion of icmp blocks for a zone [P] [Z] --query-icmp-block-inversion Return whether inversion of icmp blocks has been enabled for a zone [P] [Z] --list-forward-ports List IPv4 forward ports added for a zone [P] [Z] --add-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]] Add the IPv4 forward port for a zone [P] [Z] [T] --remove-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]] Remove the IPv4 forward port from a zone [P] [Z] --query-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]] Return whether the IPv4 forward port has been added for a zone [P] [Z] --add-masquerade Enable IPv4 masquerade for a zone [P] [Z] [T] --remove-masquerade Disable IPv4 masquerade for a zone [P] [Z] --query-masquerade Return whether IPv4 masquerading has been enabled for a zone [P] [Z] --list-rich-rules List rich language rules added for a zone [P] [Z] --add-rich-rule=<rule> Add rich language rule ‘rule‘ for a zone [P] [Z] [T] --remove-rich-rule=<rule> Remove rich language rule ‘rule‘ from a zone [P] [Z] --query-rich-rule=<rule> Return whether a rich language rule ‘rule‘ has been added for a zone [P] [Z]
10.Options to Handle Bindings of Interfaces：处理接口绑定的选项
--list-interfaces List interfaces that are bound to a zone [P] [Z] # 列出绑定到区域的接口[P] [Z] --add-interface=<interface> Bind the <interface> to a zone [P] [Z] # 将<interface>绑定到区域[P] [Z] --change-interface=<interface> Change zone the <interface> is bound to [Z] # 更改区域<interface>绑定到[Z] --query-interface=<interface> Query whether <interface> is bound to a zone [P] [Z] # 查询<interface>是否绑定到区域[P] [Z] --remove-interface=<interface> Remove binding of <interface> from a zone [P] [Z] # 从区域[P] [Z]中删除<interface>的绑定
11.Options to Handle Bindings of Sources：处理来源绑定的选项
--list-sources List sources that are bound to a zone [P] [Z] # 列出绑定到区域的源[P] [Z] --add-source=<source>[/<mask>]|<MAC>|ipset:<ipset> Bind the source to a zone [P] [Z] # 将源绑定到区域[P] [Z] --change-source=<source>[/<mask>]|<MAC>|ipset:<ipset> Change zone the source is bound to [Z] # 更改区域源绑定到[Z] --query-source=<source>[/<mask>]|<MAC>|ipset:<ipset> Query whether the source is bound to a zone [P] [Z] # 查询源是否绑定到区域[P] [Z] --remove-source=<source>[/<mask>]|<MAC>|ipset:<ipset> Remove binding of the source from a zone [P] [Z] # 从区域中删除源的绑定[P] [Z]
12.Direct Options
--direct First option for all direct options # 所有直接选项的第一选择 --get-all-chains Get all chains [P] # 获取所有链[P] --get-chains {ipv4|ipv6|eb} <table> Get all chains added to the table [P] # 将所有链添加到表中[P] --add-chain {ipv4|ipv6|eb} <table> <chain> Add a new chain to the table [P] # 在表中添加一个新链[P] --remove-chain {ipv4|ipv6|eb} <table> <chain> Remove the chain from the table [P] # 从表中删除链[P] --query-chain {ipv4|ipv6|eb} <table> <chain> Return whether the chain has been added to the table [P] # 返回是否已将链添加到表中[P] --get-all-rules Get all rules [P] # 获取所有规则[P] --get-rules {ipv4|ipv6|eb} <table> <chain> Get all rules added to chain in table [P] # 将所有规则添加到表中的链[P] --add-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>... Add rule to chain in table [P] # 在表[P]中添加规则到链 --remove-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>... Remove rule with priority from chain in table [P] # 从表[P]中的链中删除具有优先级的规则 --remove-rules {ipv4|ipv6|eb} <table> <chain> Remove rules from chain in table [P] # 从表[P]中的链中删除规则 --query-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>... Return whether a rule with priority has been added to chain in table [P] # 返回是否已将具有优先级的规则添加到表[P]中的链 --passthrough {ipv4|ipv6|eb} <arg>... Pass a command through (untracked by firewalld) # 通过命令（未触发过firewalld） --get-all-passthroughs Get all tracked passthrough rules [P] # 获取所有跟踪的直通规则[P] --get-passthroughs {ipv4|ipv6|eb} <arg>... Get tracked passthrough rules [P] # 跟踪直通规则[P] --add-passthrough {ipv4|ipv6|eb} <arg>... Add a new tracked passthrough rule [P] # 添加新的跟踪直通规则[P] --remove-passthrough {ipv4|ipv6|eb} <arg>... Remove a tracked passthrough rule [P] # 删除跟踪的直通规则[P] --query-passthrough {ipv4|ipv6|eb} <arg>... Return whether the tracked passthrough rule has been added [P] # 返回是否添加了跟踪的直通规则[P]
13.Lockdown Options：锁定选项
--lockdown-on Enable lockdown. # 启用锁定。 --lockdown-off Disable lockdown. # 禁用锁定 --query-lockdown Query whether lockdown is enabled # 查询是否启用了锁定
14.Lockdown Whitelist Options：锁定白名单选项
--list-lockdown-whitelist-commands List all command lines that are on the whitelist [P] # 列出白名单中的所有命令行[P]＃ --add-lockdown-whitelist-command=<command> Add the command to the whitelist [P] # 将命令添加到白名单[P] --remove-lockdown-whitelist-command=<command> Remove the command from the whitelist [P] # 从白名单中删除命令[P] --query-lockdown-whitelist-command=<command> Query whether the command is on the whitelist [P] # 查询命令是否在白名单中[P] --list-lockdown-whitelist-contexts List all contexts that are on the whitelist [P] # 列出白名单中的所有上下文[P] --add-lockdown-whitelist-context=<context> Add the context context to the whitelist [P] # 将上下文上下文添加到白名单[P] --remove-lockdown-whitelist-context=<context> Remove the context from the whitelist [P] # 从白名单中删除上下文[P] --query-lockdown-whitelist-context=<context> Query whether the context is on the whitelist [P] # 查询上下文是否在白名单中[P] --list-lockdown-whitelist-uids List all user ids that are on the whitelist [P] # 列出白名单中的所有用户ID [P] --add-lockdown-whitelist-uid=<uid> Add the user id uid to the whitelist [P] # 将用户ID uid添加到白名单[P] --remove-lockdown-whitelist-uid=<uid> Remove the user id uid from the whitelist [P] # 从白名单中删除用户ID uid [P] --query-lockdown-whitelist-uid=<uid> Query whether the user id uid is on the whitelist [P] # 查询用户id uid是否在白名单中[P] --list-lockdown-whitelist-users List all user names that are on the whitelist [P] # 列出白名单中的所有用户名[P] --add-lockdown-whitelist-user=<user> Add the user name user to the whitelist [P] # 将用户名用户添加到白名单[P] --remove-lockdown-whitelist-user=<user> Remove the user name user from the whitelist [P] # 从白名单中删除用户名用户[P] --query-lockdown-whitelist-user=<user> Query whether the user name user is on the whitelist [P] # 从白名单中删除用户名用户[P]
15.应急模式 - Panic Options
--panic-on Enable panic mode # 启用应急模式 --panic-off Disable panic mode # 禁用应急模式 --query-panic Query whether panic mode is enabled # 查询是否启用了应急模式
作者：小六的昵称已被使用
链接：https://www.jianshu.com/p/463332787dde
以上是关于REHL7/CentOS7 中/etc/resolv.conf 详解的主要内容，如果未能解决你的问题，请参考以下文章