零基础学习云计算及大数据DBA集群架构师Linux系统网络服务及安全配置2015年1月8日周五
Posted
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了零基础学习云计算及大数据DBA集群架构师Linux系统网络服务及安全配置2015年1月8日周五相关的知识，希望对你有一定的参考价值。
考试考一天，得分94，最后一题防火墙当时还没搞明白
考题如下:
注意事项： 1.确保在重启主机后所有配置仍然生效。 2.selinux 必须为Enforing 模式，防火墙必须开始。默认策略必须清空。 3.设置主机名为stuXXX.com（“X”为你的foundation 机器ip 地址最后一位。例如：你的ip 地址为172.25.254.30，则你的主机名为stu30.com） 4.不允许ssh 登录到其他主机，已经发现按0 分计算考试得分。 5.考试满分为100 分制，70 分为及格，所有考题需要按照要求完成。 1.使用find 查找/etc 目录下文件名以.conf 结尾的文件，并将其复制到/tmp/etc 目录下。（10 分） 2.配置autofs，当执行cd /opt/server 时，系统自动将172.25.254.250:/content 挂载到此目录。（10 分） 3.创建test1 test2 test3 用户，uid=gid 分别为801 802 803，将他们加入到test 组（本机无test 用户）， 组test 为这些用户的附加组。创建/tmp/test 目录，该目录只有test1 test2 test3 用户可读写，（root 不受限制）。该目录下所创建文件group 将自动改变为test 组，该目录下文件只有owner 可删除。（10 分） 4.创建两个基于名称的虚拟主机网站www.test.com 和www.stuXXX.com，并配置相应的DNS 正、反解析。【其中“XXX”为你的foundation 机器ip 地址的最后一位，如果你的ip 地址为172.25.254.30，则你的主机名为stu30.com】（10 分） 5.制作两个lv，/dev/vg_web/lv_test 和/dev/vg_web/lv_stu。每个逻辑卷200M。分别作为以/www/test.com和/www/stuXXX.com 上两个虚拟主机的主目录(Document root)(10 分) 6.配置页面身份认证，使www.stuXXX.com 必须通过用户名jack，密码uplooking 验证才能访问。（10 分） 7.配置samba，是user1（自己新建）用户密码为redhat，可以通过smbclient 上传下载文件到自己的家目录和/samba（自己新建）目录，/samba 共享名为pub。（10 分） 8.配置vsftpd 使student 用户可以通过ftp 上传下载文件自己家目录中的文件，同时对student 用户启用chroot 功能，并且允许匿名用户上传文件到/var/ftp/test 目录下。（10 分） 9.搭建test.com 的邮件服务器，要求:（10 分） 1）邮件服务器的主机名为postfix.test.com，并做好相应的DNS 解析。 2）能收发所有来自test.com 的邮件（如：发给[email protected] 的邮件，该邮件服务器能收到。其中username 为任意用户名） 3）这个域用户的邮件发件人地址为:[email protected] 4）发送给student 用户的邮件，除student 用户自己能收到以外user1 和root 也能收到。 10.iptables（10 分） 1）清空iptables filter 表的默认策略（2 分） 2）只允许172.25.0.250 和你使用自己的ftp（2 分） 3) 禁止ping 包（2 分） 3）仅允许172.25.0.0/24 网段和你自己的网段用户访问你的邮件服务器（2 分） 4）保存iptables 配置（2 分）
老师写的脚本，用来看试卷
1 #!/bin/bash 2 ##### WARNING###### 3 #to use the grade script that you must set the dns records in stuXXX --> 192.168.0.XXX OR 4 #you can modifiy the /etc/hosts file ; for example 192.168.0.121 www.stu121.com stu121.com stu121 5 ###ssh ### 6 #num=$1 7 #rsa_file="/root/.ssh/id_rsa.$(date +%F)" 8 #[ ! -f "$rsa_file" ] && ssh-keygen -t rsa -f $rsa_file -P ‘‘ > /dev/null 2>&1 && /usr/bin/ssh-copy-id -i $rsa_file.pub [email protected]$num 9 SCORE=100 10 if [ -z "$1" ] ; then 11 echo " $0 NUM|all " 12 exit 13 fi 14 15 function print_MSG { 16 local msg=$1 17 echo -en "\033[1;34m$msg\033[0;39m " 18 } 19 20 function print_PASS { 21 echo -e ‘\033[1;32mPASS\033[0;39m‘ 22 } 23 24 function print_FAIL { 25 echo -en ‘\033[1;31mFAIL\033[0;39m ‘ 26 #echo -e "\033[1;31mSCORE-$1\033[0;39m" 27 echo -e "\033[1;31m-$1\033[0;39m" 28 SCORE=$(($SCORE - $1)) 29 } 30 function print_FAIL1 { 31 echo -e ‘\033[1;31mFAIL\033[0;39m ‘ 32 } 33 34 function print_SUCCESS { 35 echo -e ‘\033[1;36mSUCCESS\033[0;39m‘ 36 } 37 38 function check_selinux { 39 local num=$1 40 selinux=$(ssh [email protected]$num "getenforce") 41 echo -e "\tcheck your selinux: " 42 echo -en "\tyour selinux staus is: $selinux " 43 [ $selinux = "Enforcing" ] && print_SUCCESS || (print_FAIL 100 && echo -e "\tSO the grade script exit." && exit) 44 45 } 46 47 function check_Server_file { 48 local num=$1 49 echo -en "\tCheck /tmp/etc/ directory file: " 50 ssh [email protected]$num "ls -l /tmp/etc/" >/dev/null 2>&1 && print_SUCCESS || print_FAIL 10 51 } 52 53 function check_Server_autofs { 54 local num=$1 55 echo -en "\tUmount /opt/server " 56 ssh [email protected]$num "umount /opt/server &>/dev/null" >/dev/null 2>&1 && print_SUCCESS || print_FAIL1 57 echo -en "\tMount the server nfs to /opt/server " 58 ssh [email protected]$num "cd /opt/server && df -h |grep 254" >/dev/null 2>&1 && print_SUCCESS || print_FAIL 10 59 } 60 61 function check_user { 62 local num=$1 63 echo -en "\tCheck user test1 " 64 ssh [email protected]$num "id test1 " 2> /dev/null | grep ‘gid=801‘ | grep ‘(test)‘ >/dev/null 2>&1 && print_SUCCESS || print_FAIL 1 65 echo -en "\tCheck user test2 " 66 ssh [email protected]$num "id test2" 2>/dev/null | grep ‘gid=802‘ | grep ‘(test)‘ >/dev/null 2>&1 && print_SUCCESS || print_FAIL 1 67 echo -en "\tCheck user test3 " 68 ssh [email protected]$num "id test3" 2> /dev/null | grep ‘gid=803‘ | grep ‘(test)‘ >/dev/null 2>&1 && print_SUCCESS || print_FAIL 1 69 70 echo -en "\tCheck test1-3 users can read&write the directory " 71 FILE_GROUP="$(ssh [email protected]$num "ls -ld /tmp/test/" 2>/dev/null| awk {‘print $4‘} )" 72 [ "$FILE_GROUP" = "test" ] >/dev/null 2>&1 && print_SUCCESS || print_FAIL 2 73 74 echo -en "\tCheck new file will be created to inheritance test group " 75 FILE_P="$(ssh [email protected]$num "ls -ld /tmp/test/ " 2> /dev/null| awk {‘print $1‘} )" 76 [ ${FILE_P:4:3} = "rws" ] >/dev/null 2>&1 && print_SUCCESS || print_FAIL 3 77 echo -en "\tCheck only can owner delete the file " 78 [ ${FILE_P:7:3} = "--T" -o ${FILE_P:7:3} = "--t" ] >/dev/null 2>&1 && print_SUCCESS || print_FAIL 2 79 } 80 function check_dns { 81 local num=$1 82 echo -en "\tCheck DNS is running " 83 #(ssh [email protected]$num "ps -ef" | grep /usr/sbin/named &>/dev/null || ( print_FAIL 10 && exit)) 84 ssh [email protected]$num "ps -ef" | grep /usr/sbin/named &>/dev/null || print_FAIL1 85 ssh [email protected]$num "ps -ef " | grep /usr/sbin/named &> /dev/null && print_SUCCESS 86 echo -en "\tCheck DNS is active after reboot " 87 ssh [email protected]$num "chkconfig --list named" | grep ‘5:on‘ >/dev/null 2>&1 && print_SUCCESS || print_FAIL1 88 echo -en "\tCheck DNS www.test.com A record " 89 #ssh [email protected]$num "[ ! -f /etc/nsswitch.conf.bak ] && cp /etc/nsswitch.conf{,.bak}" 90 #ssh [email protected]$num "sed ‘s/hosts: files dns/hosts: dns/g‘ /etc/nsswitch.conf -i" 91 ssh [email protected]$num "nslookup www.test.com" &>/dev/null && print_SUCCESS || print_FAIL 5 92 echo -en "\tCheck DNS www.stu$num.com A record " 93 ssh [email protected]$num "nslookup www.stu$num.com" &>/dev/null && print_SUCCESS || print_FAIL 5 94 #ssh [email protected]$num "/bin/cp /etc/nsswitch.conf.bak /etc/nsswitch.conf" &> /dev/null 95 96 } 97 98 function check_lvm { 99 local num=$1 100 echo -en "\tCheck vg_web-lv_test is exists " 101 ssh [email protected]$num "ls /dev/mapper/vg_web-lv_test " &> /dev/null && print_SUCCESS || print_FAIL 1 102 echo -en "\tCheck vg_web-lv_stu is exists " 103 ssh [email protected]$num "ls /dev/mapper/vg_web-lv_stu " &> /dev/null && print_SUCCESS || print_FAIL 1 104 105 echo -en "\tmount vg_web-lv_stu to /www/stu$num.com " 106 dirA=$(ssh [email protected]$num "df -h" | grep /dev/mapper/vg_web-lv_stu -A1 | awk ‘{if (NR==2) print $NF}‘) 107 [ "$dirA" = "/www/stu$num.com" ] &> /dev/null && print_SUCCESS || print_FAIL 1 108 echo -en "\tmount vg_web-lv_test to /www/test.com " 109 dirB=$(ssh [email protected]$num "df -h" | grep /dev/mapper/vg_web-lv_test -A1 | awk ‘{if (NR==2) print $NF}‘) 110 #dirB="/var/www/test.com" 111 [ "$dirB" = "/www/test.com" ] &> /dev/null && print_SUCCESS || print_FAIL 1 112 } 113 114 function check_httpd { 115 local num=$1 116 echo -en "\tCheck httpd is running " 117 ssh [email protected]$num "ps -ef" | grep /usr/sbin/httpd &>/dev/null || print_FAIL1 118 ssh [email protected]$num "ps -ef " | grep /usr/sbin/httpd &> /dev/null && print_SUCCESS 119 echo -en "\tCheck httpd is active after reboot " 120 ssh [email protected]$num "chkconfig --list httpd" | grep ‘5:on‘ >/dev/null 2>&1 && print_SUCCESS || print_FAIL1 121 #echo -e "\tCheck httpd config file " 122 #ssh [email protected]$num "grep DocumentRoot /etc/httpd/conf.d/virthost.conf" | while read key1 key2; do [ "$key2" = "/www/stu$num.com" -o $key2 = "/www/test.com" ] 2>/dev/null 2>&1 && print_SUCCESS || print_FAIL 1;done 123 echo -en "\tVisit www.test.com " 124 ####ssh [email protected]$num "curl --url http://www.test.com/index.html 2>/dev/null" |grep "hellotest" >/dev/null && print_SUCCESS || print_FAIL 3 125 ssh [email protected]$num "curl --url http://www.test.com/index.html 2>/dev/null" |grep "www.test.com" >/dev/null && print_SUCCESS || print_FAIL 3 126 echo -en "\tVisit www.stu$num.com " 127 ####ssh [email protected]$num "curl -u jack:uplooking --url http://www.stu$num.com/index.html" | grep "hellostu$num" &> /dev/null && print_SUCCESS || print_FAIL 3 128 #curl --url http://www.stu$num.com/index.html 2>/dev/null | grep "www.stu$num.com" &> /dev/null && print_SUCCESS || print_FAIL 3 129 curl -u jack:uplooking --url http://www.stu$num.com/index.html 2>/dev/null | grep "www.stu$num.com" &> /dev/null && print_SUCCESS || print_FAIL 3 130 #ssh [email protected]$num "curl --url http://www.stu$num.com/index.html 2>/dev/null" |grep "www.stu$num.com" >/dev/null && print_SUCCESS || print_FAIL 3 131 } 132 133 function check_samba { 134 local num=$1 135 echo -en "\tCheck samba is running " 136 ssh [email protected]$num "ps -ef" | grep smbd &>/dev/null || print_FAIL1 137 ssh [email protected]$num "ps -ef " | grep smbd &> /dev/null && print_SUCCESS 138 echo -en "\tCheck httpd is active after reboot " 139 ssh [email protected]$num "chkconfig --list smb" | grep ‘5:on‘ >/dev/null 2>&1 && print_SUCCESS || print_FAIL1 140 echo -en "\tCheck SMB user user1 and password redhat " 141 smbclient -L //stu$num -U user1%redhat >/dev/null 2>&1 && print_SUCCESS || print_FAIL 4 142 echo -en "\tCheck SMB share directory home " 143 smbclient -L //stu$num/homes -U user1%redhat > /dev/null 2>&1 && print_SUCCESS || print_FAIL 5 144 echo -en "\tCheck SMB share directory pub\n" 145 echo ‘test‘ >.testsmb_user1 146 echo -en "\t - SMB user user1 can write this pub directory " 147 echo "put .testsmb_user1" | smbclient //stu$num/pub -U user1%redhat 2>&1 | grep "NT_STATUS_CONNECTION_REFUSED" >/dev/null && print_FAIL 4 || print_SUCCESS 148 echo "rm .testsmb_user1" | smbclient //s$fundation/pub -U user1%redhat >/dev/null 2>&1 149 rm -f .testsmb_alice 150 151 } 152 153 function check_ftp { 154 local num=$1 155 echo -en "\tCheck vsftpd is running " 156 ssh [email protected]$num "ps -ef" | grep /usr/sbin/vsftpd &>/dev/null || print_FAIL 10 157 ( 158 ssh [email protected]$num "ps -ef " | grep /usr/sbin/vsftpd &> /dev/null && print_SUCCESS 159 echo -en "\tCheck vsftpd is active after reboot " 160 ssh [email protected]$num "chkconfig --list vsftpd" | grep ‘5:on‘ >/dev/null 2>&1 && print_SUCCESS || print_FAIL1 161 echo -e "\tCheck vsftpd config file " 162 echo -en "\t - chroot student " 163 ssh [email protected]$num "grep ^chroot_local_user=YES /etc/vsftpd/vsftpd.conf " >/dev/null && print_SUCCESS || print_FAIL 2 164 echo -en "\t - anon_upload " 165 ssh [email protected]$num "grep ^anon_upload_enable=YES /etc/vsftpd/vsftpd.conf " >/dev/null && print_SUCCESS || print_FAIL 2 166 echo -en "\t - selinux ftp_home_dir " 167 ssh [email protected]$num " getsebool -a " | grep "ftp_home_dir --> on" >/dev/null && print_SUCCESS || print_FAIL 2 168 echo -en "\t - selinux ftp_anon_write " 169 ssh [email protected]$num " getsebool -a " | grep "allow_ftpd_anon_write --> on" >/dev/null && print_SUCCESS || print_FAIL 2 170 ) 171 # echo ‘test‘ >.testftp_user1 172 # echo -en "\t - FTP user student can upload file" 173 # ssh [email protected]$num "echo student | passwd student --stdin" &> /dev/null 174 # echo "put .testftp_user1" | lftp [email protected]$num 175 } 176 177 function check_mail { 178 179 local num=$1 180 echo -en "\tCheck postfix is running " 181 ssh [email protected]$num "ps -ef" | grep /usr/libexec/postfix/master &>/dev/null || print_FAIL 5 182 ssh [email protected]$num "ps -ef " | grep /usr/libexec/postfix/master &> /dev/null && print_SUCCESS 183 echo -en "\tCheck postfix is active after reboot " 184 ssh [email protected]$num "chkconfig --list postfix" | grep ‘5:on‘ >/dev/null 2>&1 && print_SUCCESS || print_FAIL1 185 echo -en "\tCheck DNS postfix.test.com A record " 186 ssh [email protected]$num "nslookup postfix.test.com" &>/dev/null && print_SUCCESS || print_FAIL 5 187 echo -e "\tCheck postfix config file " 188 echo -en "\t - myhostname " 189 ssh [email protected]$num "grep ^myhostname /etc/postfix/main.cf" | grep "postfix.test.com" >/dev/null && print_SUCCESS || print_FAIL 1 190 echo -en "\t - mydomain " 191 ssh [email protected]$num "grep ^mydomain /etc/postfix/main.cf" | grep "test.com" >/dev/null && print_SUCCESS || print_FAIL 1 192 echo -en "\t - myorigin " 193 ssh [email protected]$num "grep ^myorigin /etc/postfix/main.cf" | grep "mydomain" >/dev/null && print_SUCCESS || print_FAIL 1 194 echo -en "\t - mydestination " 195 ssh [email protected]$num "grep ^mydestination /etc/postfix/main.cf" | grep "mydomain" >/dev/null && print_SUCCESS || print_FAIL 1 196 echo -en "\t - inet_interfaces " 197 ssh [email protected]$num "grep ^inet_interfaces /etc/postfix/main.cf" | grep "all" >/dev/null && print_SUCCESS || print_FAIL 1 198 199 } 200 201 function check_iptables { 202 local num=$1 203 echo -en "\tCheck /etc/sysconfig/iptables file: " 204 ssh [email protected]$num "ls -l /etc/sysconfig/iptables" >/dev/null 2>&1 && print_SUCCESS || print_FAIL 10 205 ssh [email protected]$num "grep 172.25.$num.11 /etc/sysconfig/iptables"以上是关于零基础学习云计算及大数据DBA集群架构师Linux系统网络服务及安全配置2015年1月8日周五的主要内容，如果未能解决你的问题，请参考以下文章零基础学习云计算及大数据DBA集群架构师Linux系统配置及网络配置2015年12月28日周一
零基础学习云计算及大数据DBA集群架构师Linux系统环境及权限管理2015年12月24日周四
零基础学习云计算及大数据DBA集群架构师Linux系统网络服务及安全配置1.4-1.8
零基础学习云计算及大数据DBA集群架构师Linux系统环境及权限管理2015年12月25日周五