零基础学习云计算及大数据DBA集群架构师【Linux系统\网络服务及安全配置2015年1月8日周五】

考试考一天，得分94，最后一题防火墙当时还没搞明白

考题如下:

注意事项：
.确保在重启主机后所有配置仍然生效。
.selinux 必须为Enforing 模式，防火墙必须开始。默认策略必须清空。
.设置主机名为stuXXX.com（“X”为你的foundation 机器ip 地址最后一位。例如：你的ip 地址为172.25.254.30，则你的主机名为stu30.com）
.不允许ssh 登录到其他主机，已经发现按0 分计算考试得分。
.考试满分为100 分制， 分为及格，所有考题需要按照要求完成。
.使用find 查找/etc 目录下文件名以.conf 结尾的文件，并将其复制到/tmp/etc 目录下。（ 分）
.配置autofs，当执行cd /opt/server 时，系统自动将172.:/content 挂载到此目录。（ 分）
.创建test1 test2 test3 用户，uid=gid 分别为801  ，将他们加入到test 组（本机无test 用户），
组test 为这些用户的附加组。创建/tmp/test 目录，该目录只有test1 test2 test3 用户可读写，（root
不受限制）。该目录下所创建文件group 将自动改变为test 组，该目录下文件只有owner 可删除。（ 分）
 分）
.制作两个lv，/dev/vg_web/lv_test 和/dev/vg_web/lv_stu。每个逻辑卷200M。分别作为以/www/ 分)
.配置页面身份认证，使www.stuXXX.com 必须通过用户名jack，密码uplooking 验证才能访问。（ 分）
 分）
 分）
.搭建test.com 的邮件服务器，要求:（ 分）
）邮件服务器的主机名为postfix.test.com，并做好相应的DNS 解析。
）能收发所有来自test.com 的邮件（如：发给username@test.com 的邮件，该邮件服务器能收到。其中username 为任意用户名）
）这个域用户的邮件发件人地址为:XXX@test.com
）发送给student 用户的邮件，除student 用户自己能收到以外user1 和root 也能收到。
.iptables（ 分）
）清空iptables filter 表的默认策略（ 分）
）只允许172. 和你使用自己的ftp（ 分）
) 禁止ping 包（ 分）
）仅允许172./ 网段和你自己的网段用户访问你的邮件服务器（ 分）
）保存iptables 配置（ 分）

老师写的脚本，用来看试卷

 #!/bin/bash
 ##### WARNING######
 #to use the grade script that you must set the dns records .XXX OR
 #you can modifiy the /etc/hosts file ;  for example 192.168.0.121 www.stu121.com stu121.com stu121
 ###ssh ###
 #num=$
 #rsa_file="/root/.ssh/id_rsa.$(date +%F)"
 #[ ! -f >&  && /usr/bin/ssh-copy-id -i $rsa_file.pub root@stu$num
 SCORE=
 if [  -z "$1" ] ; then
         echo " $0 NUM|all "
         exit
 fi

 function print_MSG {
         local msg=$
         echo -en "\033[1;34m$msg\033[0;39m "
 }

 function print_PASS {
   echo -e '\033[1;32mPASS\033[0;39m'
 }

 function print_FAIL {
   echo -en '\033[1;31mFAIL\033[0;39m '
   #echo -e "\033[1;31mSCORE-$1\033[0;39m"
   echo -e "\033[1;31m-$1\033[0;39m"
   SCORE=$(($SCORE - $))
 }
 function print_FAIL1 {
   echo -e '\033[1;31mFAIL\033[0;39m '
 }

 function print_SUCCESS {
   echo -e '\033[1;36mSUCCESS\033[0;39m'
 }

 function check_selinux {
     local num=$
     selinux=$(ssh root@stu$num "getenforce")
         echo -e "\tcheck your selinux: "
         echo -en "\tyour selinux staus is: $selinux "
         [ $selinux =  && echo -e "\tSO the grade script exit." && exit)

 }

 function check_Server_file {
     local num=$
     echo -en "\tCheck /tmp/etc/ directory file: "
     >& && print_SUCCESS || print_FAIL
 }

 function check_Server_autofs {
     local num=$
     echo -en "\tUmount /opt/server "
     >& && print_SUCCESS || print_FAIL1
     echo -en "\tMount the server nfs to /opt/server "
     >& && print_SUCCESS || print_FAIL
 }

 function check_user {
     local num=$
         echo -en "\tCheck user test1 "
     > /dev/>& && print_SUCCESS || print_FAIL
         echo -en "\tCheck user test2 "
     >/dev/>& && print_SUCCESS || print_FAIL
         echo -en "\tCheck user test3 "
     > /dev/>& && print_SUCCESS || print_FAIL 

         echo -en "\tCheck test1-3 users can read&write the directory "
     FILE_GROUP="$(ssh root@stu$num "ls -ld /tmp/test/" 2>/dev/null| awk {'print $4'} )"
     [ >& && print_SUCCESS || print_FAIL 

         echo -en "\tCheck new file will be created to inheritance test group "
     FILE_P="$(ssh root@stu$num "ls -ld /tmp/test/ " 2> /dev/null| awk {'print $1'} )"
     [ ${FILE_P::} = >& && print_SUCCESS || print_FAIL
      echo -en "\tCheck only can owner delete the file "
     [ ${FILE_P::} = :} = >& && print_SUCCESS || print_FAIL
 }
 function check_dns {
      local num=$
         echo -en "\tCheck DNS is running "
     #( && exit))
     ssh root@stu$num "ps -ef" | grep /usr/sbin/named  &>/dev/null ||   print_FAIL1
     ssh root@stu$num "ps -ef " | grep /usr/sbin/named  &> /dev/null && print_SUCCESS
         echo -en "\tCheck DNS is active after reboot "
     >& && print_SUCCESS ||  print_FAIL1
         echo -en "\tCheck DNS  www.test.com A record "
         #ssh root@stu$num "[ ! -f /etc/nsswitch.conf.bak ]  && cp /etc/nsswitch.conf{,.bak}"
         #ssh root@stu$num "sed 's/hosts:      files dns/hosts:      dns/g' /etc/nsswitch.conf -i"

         echo -en "\tCheck DNS  www.stu$num.com A record "

     #ssh root@stu$num "/bin/cp /etc/nsswitch.conf.bak /etc/nsswitch.conf" &> /dev/null

 }

 function check_lvm {
     local num=$
     echo -en "\tCheck vg_web-lv_test is exists "

     echo -en "\tCheck vg_web-lv_stu is exists "

     echo -en "\tmount vg_web-lv_stu to /www/stu$num.com "
      dirA=$(ssh root@stu$num "df  -h" | grep  /dev/mapper/vg_web-lv_stu  -A1 | awk '{if (NR==2) print $NF}')
     [
     echo -en "\tmount vg_web-lv_test to /www/test.com "
     dirB=$(ssh root@stu$num "df  -h" | grep  /dev/mapper/vg_web-lv_test -A1 | awk '{if (NR==2) print $NF}')
     #dirB="/var/www/test.com"
     [
 }

 function check_httpd {
     local num=$
         echo -en "\tCheck httpd is running "
     ssh root@stu$num "ps -ef" | grep /usr/sbin/httpd  &>/dev/null ||  print_FAIL1
     ssh root@stu$num "ps -ef " | grep /usr/sbin/httpd  &> /dev/null && print_SUCCESS
         echo -en "\tCheck httpd is active after reboot "
     >& && print_SUCCESS ||  print_FAIL1
     #echo -e "\tCheck httpd config file       "
     #>/dev/>& && print_SUCCESS ||  print_FAIL ;done
     echo -en "\tVisit www.test.com "
         ####

     echo -en "\tVisit www.stu$num.com "
     ####
     #curl  --url http://www.stu$num.com/index.html 2>/dev/null | grep "www.stu$num.com"  &>  /dev/null && print_SUCCESS || print_FAIL 3
         curl  -u jack:uplooking --url http://www.stu$num.com/index.html 2>/dev/null | grep "www.stu$num.com"  &>  /dev/null && print_SUCCESS || print_FAIL 3
         #
 }

 function check_samba {
 local num=$
         echo -en "\tCheck samba is running "
         ssh root@stu$num "ps -ef" | grep smbd  &>/dev/null ||  print_FAIL1
         ssh root@stu$num "ps -ef " | grep smbd  &> /dev/null && print_SUCCESS
         echo -en "\tCheck httpd is active after reboot "
         >& && print_SUCCESS ||  print_FAIL1
         echo -en "\tCheck SMB user user1 and password redhat "
         smbclient -L //stu$num -U user1%redhat >/dev/null 2>&1 && print_SUCCESS ||  print_FAIL 4
     echo -en "\tCheck SMB share directory home "
         smbclient -L //stu$num/homes -U user1%redhat  > /dev/null 2>&1  && print_SUCCESS || print_FAIL  5
     echo -en "\tCheck SMB share directory pub\n"
                 echo 'test' >.testsmb_user1
                 echo -en "\t - SMB user user1 can write this pub directory "
                 echo "put .testsmb_user1" | smbclient //stu$num/pub -U user1%redhat  2>&1 | grep "NT_STATUS_CONNECTION_REFUSED" >/dev/null   && print_FAIL 4 || print_SUCCESS
                 echo "rm .testsmb_user1"  | smbclient //s$fundation/pub -U user1%redhat  >/dev/null 2>&1
                 rm -f .testsmb_alice

 }

 function check_ftp {
     local num=$
     echo -en "\tCheck vsftpd is running "

         (
         ssh root@stu$num "ps -ef " | grep /usr/sbin/vsftpd   &> /dev/null && print_SUCCESS
         echo -en "\tCheck vsftpd is active after reboot "
         >& && print_SUCCESS ||  print_FAIL1
         echo -e "\tCheck vsftpd config file "
      echo -en "\t - chroot student "

         echo -en "\t - anon_upload "

         echo -en "\t - selinux ftp_home_dir "

         echo -en "\t - selinux ftp_anon_write "

     )
 #    echo 'test' >.testftp_user1
 #                echo -en "\t - FTP user student can upload file"
 #        ssh root@stu$num "echo student | passwd student --stdin"  &> /dev/null
 #        echo "put .testftp_user1" | lftp student@stu$num
 }

 function check_mail {

 local num=$
         echo -en "\tCheck postfix is running "

         ssh root@stu$num "ps -ef " | grep /usr/libexec/postfix/master   &> /dev/null && print_SUCCESS
         echo -en "\tCheck postfix is active after reboot "
         >& && print_SUCCESS ||  print_FAIL1
     echo -en "\tCheck DNS  postfix.test.com A record "

     echo -e "\tCheck postfix config file "
     echo -en "\t - myhostname "

     echo -en "\t - mydomain "

     echo -en "\t - myorigin "

     echo -en "\t - mydestination "

     echo -en "\t - inet_interfaces "

 }

 function check_iptables {
     local num=$
     echo -en "\tCheck /etc/sysconfig/iptables file: "
     >& && print_SUCCESS || print_FAIL 

 }

 function check_ule_main {
         local num=$
 #check selinux type must be enforcing ; otherwise the script will exit.
     check_selinux $num
     echo
         print_MSG "1.Tar check\n"
         check_Server_file $num

         print_MSG "2.Server Autofs Set\n"
         check_Server_autofs $num

         print_MSG "3.Check users & privileges\n"
         check_user $num

         print_MSG "4.check DNS(Bind)\n"
         check_dns $num

         print_MSG "5.Check LVM\n"
         check_lvm $num

     print_MSG "Check Web Service\n"
     #print_MSG ."Check Web Service\n"
         check_httpd $num

 #        print_MSG "6.Check web htaccess\n"
 #        check_htaccess $num

         print_MSG "7.Check CIFS(SAMBA)\n"
         check_samba $num

         print_MSG "8.Check Ftp Service\n"
         check_ftp $num

     print_MSG "9.Check Mail Service\n"
         check_mail $num

     print_MSG "10.Check iptables\n"
         check_iptables $num

 }
  in
         all)
                 #. /etc/rht
                 N_UM=$RHT_MAXSTATIONS
                  $N_UM) ; do
                         print_MSG "stu$N_um check exam\n"
                         check_ule_main $N_um
                         print_MSG "stu$N_um check end\n"
                 done
                 ;;
         [-]* )
                 NUM=$
                 print_MSG "stu$NUM check begin\n"
                 check_ule_main $NUM
         #check_Server_tar $NUM
         #check_Server_autofs $NUM
         #check_user $NUM
         #check_dns $NUM
         #check_lvm $NUM
         #check_httpd $NUM
         #check_samba $NUM
         #check_ftp $NUM
         #check_mail $NUM
         #check_iptables $NUM

                 print_MSG "stu$NUM check end\n"
                 ;;
         *)
                 print_MSG "error $1\n"
                 ;;
 esac
 #echo "Your SCORE is $SCORE"
 echo -e "\t\033[1;31mYOUR SCORE IS:\033[0;39m \033[1;36m$SCORE\033[0;39m "