第七周作业

1、解决DOS攻击生产案例:根据web日志或者或者网络连接数，监控当某个IP 并发连接数或者短时内PV达到100，即调用防火墙命令封掉对应的IP，监控频 率每隔5分钟。防火墙命令为:iptables -A INPUT -s IP -j REJECT

#!/bin/bash
NUM=100
while true; do
  ss -nt |grep -e ^[^State] | awk -F"[ :]+" '{print $4}' | sort | uniq -c | while read COUNT IP; do
    if [[ $COUNT -gt $NUM ]]; then
      iptables -A INPUT -s $IP -j REJECT
    fi
  done
done

2、描述密钥交换的过程

https://www.cnblogs.com/yungyu16/p/13332882.html#:~:text=%E5%AF%86%E9%92%A5%E4%BA%A4%E6%8D%A2%2F%E5%8D%8F%E5%95%86%E6%9C%BA%E5%88%B6%E7%9A%84%E5%87%A0%E7%A7%8D%E7%B1%BB%E5%9E%8B.%203.1.%20%E4%BE%9D%E9%9D%A0%E9%9D%9E%E5%AF%B9%E7%A7%B0%E5%8A%A0%E5%AF%86%E7%AE%97%E6%B3%95.%20%E5%8E%9F%E7%90%86%EF%BC%9A%E6%8B%BF%E5%88%B0%E5%85%AC%E9%92%A5%E7%9A%84%E4%B8%80%E6%96%B9%E5%85%88%E7%94%9F%E6%88%90%E9%9A%8F%E6%9C%BA%E7%9A%84%E4%BC%9A%E8%AF%9D%E5%AF%86%E9%92%A5%EF%BC%8C%E7%84%B6%E5%90%8E%E5%88%A9%E7%94%A8%E5%85%AC%E9%92%A5%E5%8A%A0%E5%AF%86%E5%AE%83%EF%BC%9B%E5%86%8D%E6%8A%8A%E5%8A%A0%E5%AF%86%E7%BB%93%E6%9E%9C%E5%8F%91%E7%BB%99%E5%AF%B9%E6%96%B9%EF%BC%8C%E5%AF%B9%E6%96%B9%E7%94%A8%E7%A7%81%E9%92%A5%E8%A7%A3%E5%AF%86%EF%BC%9B%E4%BA%8E%E6%98%AF%E5%8F%8C%E6%96%B9%E9%83%BD%E5%BE%97%E5%88%B0%E4%BA%86%E4%BC%9A%E8%AF%9D%E5%AF%86%E9%92%A5%E3%80%82.%203.2.,%E4%BE%9D%E9%9D%A0%E4%B8%93%E9%97%A8%E7%9A%84%E5%AF%86%E9%92%A5%E4%BA%A4%E6%8D%A2%E7%AE%97%E6%B3%95.%20%E5%8E%9F%E7%90%86%EF%BC%9A%E8%BF%99%E4%B8%AA%E5%8E%9F%E7%90%86%E6%AF%94%E8%BE%83%E5%A4%8D%E6%9D%82%EF%BC%8C%E4%B8%80%E4%B8%A4%E5%8F%A5%E8%AF%9D%E8%AF%B4%E4%B8%8D%E6%B8%85%E6%A5%9A%EF%BC%8C%E5%BE%85%E4%BC%9A%E5%84%BF%E8%81%8A%E5%88%B0%20DH%20%E7%9A%84%E9%82%A3%E4%B8%AA%E7%AB%A0%E8%8A%82%E4%BC%9A%E8%AF%A6%E8%B0%88%E3%80%82.%203.3.%20%E4%BE%9D%E9%9D%A0%E9%80%9A%E8%AE%AF%E5%8F%8C%E6%96%B9%E4%BA%8B%E5%85%88%E5%B7%B2%E7%BB%8F%E5%85%B1%E4%BA%AB%E7%9A%84%E2%80%9C%E7%A7%98%E5%AF%86%E2%80%9D.

3、https的通信过程

https://zhuanlan.zhihu.com/p/56663184

4、使用awk以冒号分隔获取/ettc/passwd文件第一列

awk -F: '{print $1}' /etc/passwd