1、selinux
vim /etc/selinux/config
根据题目要求设置
getenforce
2、SSH
vim /etc/hosts.allow
sshd : 172.25.0.0/24
vim /etc/hosts.deny
sshd : 172.24.3.0/24
yum -y install xinetd
systemctl restart sshd xinetd systemctl enable sshd xinetd
firewall-cmd --permanent --add-rich-rule 'rule family=ipv4 source address=172.24.3.0/24 service name=ssh drop'
firewall-cmd --reload
firewall-cmd --list-all
3、自定义用户环境
echo "alias qstat='/bin/ps -Ao pid,tt,user,fname,rsz'" >> /etc/bashrc
4、配置防火墙端口转发
firewall-cmd --permanent --add-rich-rule 'rule family=ipv4 source address=172.25.0.0/24 forward-port port=5423 protocol=tcp to-port=80'
firewall-cmd --reload
firewall-cmd --list-all
5、配置链路聚合
nmcli connection add type team con-name team0 ifname team0 config '{"runner":{"name":"activebackup"}}'
nmcli connection add type team-slave con-name team0-eth1 ifname eth1 master team0
nmcli connection add type team-slave con-name team0-eth2 ifname eth2 master team0
vim /etc/sysconfig/network-script/ifcfg-team0
BOOTPROTO=static
IPADDR=172.16.0.20
NETMASK=255.255.255.0
systemctl restart network
teamdctl team0 stat
6、配置ipv6地址
nmcli connection show
nmcli connection modify 'System eth0' connection.autoconnect yes ipv6.method manual +ipv6.address '2003:ac18::305/64'
nmcli connection up 'System eth0'
ifconfig
7、邮件服务
vim /etc/postfix/main.cf
relayhost = [smtp0.example.com]
myorigin = example.com
mydestination =
inet_interfaces = loopback-only
local_transport = error:local mail delivery is disabled
systemctl restart postfix.service systemctl enable postfix.service
firewall-cmd --permanent --add-service=smtp
firewall-cmd --reload
firewall-cmd --list-all
8、samba
yum -y install samba*
mkdir /common
setsebool -P samba_export_all_rw=on
id ldapuser1
pdbedit -a ldapuser1
vim /etc/samba/smb.conf
查找workgroup,修改:workgroup = STAFF
最后一行：
[common]
path = /common
hosts allow = 172.25.0.0/24
firewall-cmd --permanent --add-service=samba
firewall-cmd --reload
firewall-cmd --list-all
systemctl restart smb nmb systemctl enable smb nmb
验证:客户端
yum -y install samba-client cifs-utils
smbclient -L server0 -U ldapuse1
9、多用户samba挂载
mkdir /devops
id ldapuser2
id ldapuser3
pdbedit -a ldapuser2
pdbedit -a ldapuser3
setfacl -m u:ldapuser3:rwx /devops/
vim /etc/samba/smb.conf
[devops]
path = /devops
write list = ldapuser3
valid users = ldapuser2,ldapuser3
hosts allow = 172.25.0.0/24
systemctl restart smb nmb systemctl enable smb nmb
客户端
smbclient -L server0
mkdir /mnt/dev
vim /etc/fstab
//172.25.0.11/devops /mnt/dev cifs username=ldapuser2,password=kerberos,multiuser,sec=ntlmssp,_netdev 0 0
mount -a
df -hT
验证:
su - ldapuser2
cifscreads add -u ldapuser2 172.25.0.11
su - ldapuser3
cifscreads add -u ldapuser3 172.25.0.11
10、NFS
mkdir -p /public /protected/project
chown ldapuser0 /protected/project
setfacl -m u:ldapsuer4:rwx /protected/project/
wget -O /etc/krb5.keytab http://.keytab
vim /etc/exports
/public 172.25.0.0/24(ro)
/protected 172.25.0.0/24(rw,sec=krb5p)
vim /etc/sysconfig/nfs
修改第十三行 RPCNFSDARGS="-V4.2"
systemctl restart nfs-secure-server nfs-server
systemctl enable nfs-secure-server nfs-server
exportfs -rv
firewall-cmd --permanent --add-service=nfs
firewall-cmd --permanent --add-service=mountd
firewall-cmd --permanent --add-service=rpc-bind
firewall-cmd --reload
firewall-cmd --list-all
11、挂载NFS
showmount -e 172.25.0.11
mkdir -p /mnt/nfsmount /mnt/nfssecure
wget -O /etc/krb5.keytab http://.keytab
systemctl restart nfs-secure systemctl enable nfs-secure
vim /etc/fstab
server0.example.com:/public /mnt/nfsmount nfs _netdev 0 0
server0.example.com:/protected /mnt/nfssecure nfs sec=krb5p,v4.2,_netdev 0 0
mount -a
df -hT
12、实现一个web服务器
yum -y install httpd
cp /usr/share/doc/httpd-2.4.6/httpd-vhosts.conf /etc/httpd/conf.d
vim /etc/httpd/conf.d/httpd-vhosts.conf
<VirtualHost *:80>
DocumentRoot /var/www/html
ServerName server0.example.com
</VirtualHost>
<Directory /var/www/html>
<RequireAll>
Require not ip 172.24.3.0/24
Require all granted
</RequireAll>
</Directory>
cd /var/www/html/
wget http://.html -O index.html
vim index.html
http test1
systemctl restart httpd systemctl enable httpd
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload
firewall-cmd --list-all
验证：firefox server0.example.com
13、配置安全web
yum -y install mod_ssl
cd /etc/pki/tls/certs/
wget http://example-ca.crt
wget http://server0.crt
cd ../private/
wget http://server0.key
chmod 600 server0.key
vim /etc/httpd/conf.d/ssl.conf
/server0.crt 修改第100行
/server0.key 修改第107行
/example-ca.crt 修改第122行
systemctl restart httpd.service systemctl enable httpd.service
验证：firefox edit->preferences->Advanced->View Certificates->import->/etc/pki/tls/certs/example-ca.crt->勾选三个勾
14、配置虚拟主机
mkdir /var/www/virtual
useradd harry
setfacl -m u:harry:rwx /var/www/virtual
cd /var/www/virtual
wget http://.html -O index.html
vim index.html
http test2
vim /etc/httpd/conf.d/01-www0.conf
<VirtualHost *:80>
ServerName www0.example.com
DocumentRoot /var/www/virtual
<VirtualHost>
systemctl restart httpd.service systemctl enable httpd.service
验证:firefox www0.example.com
15、配置web内容访问
mkdir /var/www/html/private
cd /var/www/html/private
wget http://.html -O index.html
vim index.html
http test3
vim /etc/httpd/conf.d/00-default.conf
<Directory /var/www/html/private>
Require ip 127.0.0.1 ::1 172.25.0.11
</Directory>
systemctl restart httpd.service systemctl enable httpd.service
验证；firefox server0.example.com/private server端可以访问,desktop端无法访问
16、实现动态web内容
yum -y install mod_wsgi
mkdir /var/www/webapp0
cd /var/www/webapp0
wsgi http://webinfo.wsgi
vim webinfo.wsgi
一段python脚本
vim /etc/httpd/conf.d/02-wsgi.conf
Listen 8909
<VirtualHost *:8909>
ServerName webapp0.example.com
DocumentRoot /var/www/webapp0
WSGIScriptAlias / /var/www/webapp0/webinfo.wsgi
</VirtualHost>
semanage port -a -t http_port_t -p tcp 8909
firewall-cmd --permanent --add-port=8909/tcp
firewall-cmd --reload
firewall-cmd --list-all
验证:firefox webapp0.example.com:8909
17、创建一个脚本
cd /root
vim test1.sh
#!/bin/bash
case $1 in
cat)
echo 'dog'
;;
dog)
echo 'cat'
;;
*)
echo '/root/test1.sh cat|dog'
esac
chmod +x test1.sh
sh test1.sh
18、创建添加用户的脚本
cd /root
vim test2.sh
#!/bin/bash
if [ $# -eq 0 ];then
echo 'Usage: /root/batchusers userfile'
exit 1
fi
if [ ! -f $1 ];then
echo 'Input file not found'
exit 1
fi
while read line
do
useradd -s /bin/false $line
done < $1
vim userlist
a
b
c
chmod +x test2.sh
sh test2.sh
19、iscsi 服务器端
fdisk /dev/vdb
p n +3G p w
ls /dev/vdb*
yum -y insall targetcli
targetcli
/backstores/block create iscsi_store /dev/vdb1
iscsi/ create iqn.2016-02.com.example:server0
/iscsi/iqn.2016-02.com.example:server0/tpg1/acls create iqn.2016-02.com.example:desktop0
/iscsi /iqn.2016-02.com.example:server0/tpg1/luns create /backstores/block/iscsi_store
/iscsi /iqn.2016-02.com.example:server0/tpg1/portals create 172.25.0.11
ls saveconfig exit
systemctl restart target systemctl enable target
firewall-cmd --permanent --add-port=3260/tcp
firewall-cmd --reload
firewall-cmd --list-all
20、iscsi 客户端
yum -y install iscsi-initiator-utils
vim /etc/iscsi/initiatorname.iscsi
InitiatorName=iqn.2016-02.com.example:desktop0
systemctl restart iscisd iscsi systemctl enable iscsid iscsi
iscsiadm -m discovery -t st -p server0
iscsiadm -m node iqn.2016-02.com.example:server0 -p 172.25.0.11 -l
lsblk
mkdir /mnt/data
fdisk /dev/sda
p n +2100M p w
mkfs.ext4 /dev/sda1
blkid /dev/sda1
vim /etc/fstab
UUID="" /mnt/data ext4 _netdev 0 0
mount -a
df -hT
iscsiadm -m discovery -t st -p server0
iscsiadm -m node iqn.2016-02.com.example:server0 -p 172.25.0.11 -l
sync;reboot -f
21、数据库
yum -y install mariadb-server mariadb
vim /etc/my.cnf
skip-networking
systemctl restart mariadb systemctl enable mariadb
mysqladmin -u root -p password 'redhat'
mysql -u root -p
create database Contacts;
grant select on Contacts.* to Raikon@localhost identified by 'redhat';
show databases;
delete from mysql.user where password='';
quit
vim users.sql
mysql -u root -predhat
use Contacts;
source /root/users.sql
show tables;
22、数据库查询
mysql -u root -predhat
use Contacts;
show tables;
desc base;
desc location;
select name from base where password='';
select count(*) from base,location where base.name='' and location.city='' and base.id=location.id;
来源：51CTO
作者：远方在呼唤
链接：https://blog.51cto.com/11293100/2421138