命令拷屏之服务(应用)信息
7.keepalived
[root@localhost keepalived-1.1.12]# wget http://www.keepalived.org/software/keepalived-1.2.13.tar.gz [root@localhost keepalived-1.1.12]# tar zxvf keepalived-1.2.13.tar.gz [root@localhost keepalived-1.1.12]# cd keepalived-1.2.13 [root@localhost keepalived-1.1.12]# ./configure checking for openssl/ssl.h... no configure: error: !!! OpenSSL is not properly installed on your system. !!! !!! Can not include OpenSSL headers files. !!! [root@localhost keepalived-1.1.12]# yum install openssl-devel [root@localhost keepalived-1.2.13]# ./configure;make;make install [root@localhost keepalived]# vi keepalived.conf 全局定义，vrrp实例定义，虚拟服务器定义 [root@localhost keepalived]# pwd /usr/local/etc/keepalived [root@localhost etc]# cp rc.d/init.d/keepalived /etc/init.d/keepalived 这个命令或下面的命令都可以 [root@localhost etc]# ln -s rc.d/init.d/keepalived /etc/init.d/keepalived 漂移虚拟ip时掉了5个ping包
6.rsyslog相关
[root@109-com1 rsyslog.d]# rpm -q rsyslog rsyslog-5.8.10-8.el6.x86_64 [root@109-com1 rsyslog.d]# rpm -ql rsyslog /etc/logrotate.d/syslog /etc/pki/rsyslog /etc/rc.d/init.d/rsyslog /etc/rsyslog.conf /etc/rsyslog.d /etc/sysconfig/rsyslog /lib64/rsyslog /lib64/rsyslog/imfile.so /lib64/rsyslog/imklog.so /lib64/rsyslog/immark.so /lib64/rsyslog/impstats.so /lib64/rsyslog/imptcp.so /lib64/rsyslog/imtcp.so /lib64/rsyslog/imudp.so /lib64/rsyslog/imuxsock.so /lib64/rsyslog/lmnet.so /lib64/rsyslog/lmnetstrms.so /lib64/rsyslog/lmnsd_ptcp.so /lib64/rsyslog/lmregexp.so /lib64/rsyslog/lmstrmsrv.so /lib64/rsyslog/lmtcpclt.so /lib64/rsyslog/lmtcpsrv.so /lib64/rsyslog/lmzlibw.so /lib64/rsyslog/ommail.so /lib64/rsyslog/omprog.so /lib64/rsyslog/omruleset.so /lib64/rsyslog/omtesting.so /lib64/rsyslog/omuxsock.so /lib64/rsyslog/pmlastmsg.so /sbin/rsyslogd /var/lib/rsyslog [root@109-com1 postfix]# cat /etc/rsyslog.conf # rsyslog v5 configuration file # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html # If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html #### MODULES #### $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imklog # provides kernel logging support (previously done by rklogd) #$ModLoad immark # provides --MARK-- message capability # Provides UDP syslog reception #$ModLoad imudp #$UDPServerRun 514 # Provides TCP syslog reception #$ModLoad imtcp #$InputTCPServerRun 514 #### GLOBAL DIRECTIVES #### # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # File syncing capability is disabled by default. This feature is usually not required, # not useful and an extreme performance hit #$ActionFileEnableSync on # Include all config files in /etc/rsyslog.d/ $IncludeConfig /etc/rsyslog.d/*.conf #### RULES #### # Log all kernel messages to the console. # Logging much else clutters up the screen. #kern.* /dev/console # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* -/var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * # Save news errors of level crit and higher in a special file. uucp,news.crit /var/log/spooler # Save boot messages also to boot.log local7.* /var/log/boot.log # ### begin forwarding rule ### # The statement between the begin ... end define a SINGLE forwarding # rule. They belong together, do NOT split them. If you create multiple # forwarding rules, duplicate the whole block! # Remote Logging (we use TCP for reliable delivery) # # An on-disk queue is created for this action. If the remote host is # down, messages are spooled to disk and sent when it is up again. #$WorkDirectory /var/lib/rsyslog # where to place spool files #$ActionQueueFileName fwdRule1 # unique name prefix for spool files #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown #$ActionQueueType LinkedList # run asynchronously #$ActionResumeRetryCount -1 # infinite retries if host is down # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional #*.* @@remote-host:514 # ### end of the forwarding rule ###
5.crond相关
[root@222-comecs cron.d]# rpm -qa|grep cron
cronie-anacron-1.4.4-12.el6.x86_64
crontabs-1.10-33.el6.noarch
cronie-1.4.4-12.el6.x86_64
[root@222-comecs cron.d]# rpm -ql cronie-anacron
/etc/anacrontab
/etc/cron.hourly/0anacron
/usr/sbin/anacron
/usr/share/man/man5/anacrontab.5.gz
/usr/share/man/man8/anacron.8.gz
/var/spool/anacron
/var/spool/anacron/cron.daily
/var/spool/anacron/cron.monthly
/var/spool/anacron/cron.weekly
[root@109-com1 postfix]# rpm -ql crontabs /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly /etc/crontab /usr/bin/run-parts /usr/share/man/man4/crontabs.4.gz [root@109-com1 20141104]# rpm -ql cronie /etc/cron.d /etc/cron.d/0hourly /etc/cron.deny /etc/pam.d/crond /etc/rc.d/init.d/crond /etc/sysconfig/crond /usr/bin/crontab /usr/sbin/crond /usr/share/doc/cronie-1.4.4 /usr/share/doc/cronie-1.4.4/AUTHORS /usr/share/doc/cronie-1.4.4/COPYING /usr/share/doc/cronie-1.4.4/ChangeLog /usr/share/doc/cronie-1.4.4/INSTALL /usr/share/doc/cronie-1.4.4/README /usr/share/man/man1/crontab.1.gz /usr/share/man/man5/crontab.5.gz /usr/share/man/man8/cron.8.gz /usr/share/man/man8/crond.8.gz /var/spool/cron [root@109-com1 postfix]# cat /etc/crontab SHELL=/bin/bash PATH=/sbin:/bin:/usr/sbin:/usr/bin #MAILTO=root HOME=/ # For details see man 4 crontabs # Example of job definition: # .---------------- minute (0 - 59) # | .------------- hour (0 - 23) # | | .---------- day of month (1 - 31) # | | | .------- month (1 - 12) OR jan,feb,mar,apr ... # | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat # | | | | | # * * * * * user-name command to be executed
4.logrotate相关
[root@109-com1 logrotate.d]# cat /var/lib/logrotate.status logrotate state -- version 2 "/var/log/iptraf/*.log" 2014-9-13 "/var/log/yum.log" 2014-8-27 "/var/log/asterisk/messages" 2014-11-5 "/var/log/dracut.log" 2014-8-27 "/var/log/wtmp" 2014-11-1 "/var/log/spooler" 2014-11-2 "/var/log/btmp" 2014-11-1 "/var/log/iscsiuio.log" 2014-8-27 "/var/log/maillog" 2014-11-2 "/var/log/secure" 2014-11-2 "/var/log/messages" 2014-11-2 "/var/log/cron" 2014-11-2 [root@109-com1 logrotate.d]# rpm -ql logrotate /etc/cron.daily/logrotate /etc/logrotate.conf /etc/logrotate.d /usr/sbin/logrotate /usr/share/doc/logrotate-3.7.8 /usr/share/doc/logrotate-3.7.8/CHANGES /usr/share/doc/logrotate-3.7.8/COPYING /usr/share/man/man5/logrotate.conf.5.gz /usr/share/man/man8/logrotate.8.gz /var/lib/logrotate.status
[root@109-com1 postfix]# cat /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# use date as a suffix of the rotated file
dateext
# uncomment this if you want your log files compressed
#compress
# RPM packages drop log rotation information into this directory
include /etc/logrotate.d
# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
monthly
create 0664 root utmp
minsize 1M
rotate 1
}
/var/log/btmp {
missingok
monthly
create 0600 root utmp
rotate 1
}
# system-specific logs may be also be configured here.
[root@109-com1 postfix]# cat /etc/logrotate.d/syslog
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}
3.sshd相关
客户交互及日志分析 ###服务器重启 service sshd restart Oct 31 11:46:18 250-shiyan sshd[8252]: Received signal 15; terminating. Oct 31 11:46:18 250-shiyan sshd[8284]: Server listening on 0.0.0.0 port 22. Oct 31 11:46:18 250-shiyan sshd[8284]: Server listening on :: port 22. ###用户正常登录与退出 login as: flt flt@192.168.2.250's password: Last login: Fri Oct 31 11:34:19 2014 from 192.168.2.80 Oct 31 11:47:07 250-shiyan sshd[8287]: Accepted password for flt from 192.168.2.80 port 56942 ssh2 Oct 31 11:47:07 250-shiyan sshd[8287]: pam_unix(sshd:session): session opened for user flt by (uid=0) [flt@250-shiyan ~]$exit Oct 31 11:48:59 250-shiyan sshd[8287]: pam_unix(sshd:session): session closed for user flt ###用户被限制，所以不能正常登录 login as: flt Oct 31 11:37:37 250-shiyan sshd[8255]: User flt from 192.168.2.80 not allowed because not listed in AllowUsers Oct 31 11:37:37 250-shiyan sshd[8256]: input_userauth_request: invalid user flt flt@192.168.2.250's password: Access denied Oct 31 11:38:15 250-shiyan unix_chkpwd[8257]: password check failed for user (flt) Oct 31 11:38:15 250-shiyan sshd[8255]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.2.80 user=flt Oct 31 11:38:17 250-shiyan sshd[8255]: Failed password for invalid user flt from 192.168.2.80 port 56895 ssh2 flt@192.168.2.250's password: ctrl+c结束 Oct 31 11:38:21 250-shiyan sshd[8256]: Received disconnect from 192.168.2.80: 13: Unable to authenticate
2.iptables相关
[root@ipt ~]# iptables -t nat -vnL POSTROUTING --line-number|grep 69 53 2 104 SNAT tcp -- * * 192.168.1.0/24 192.168.1.69 tcp dpt:3389 to:172.16.1.254 54 0 0 SNAT tcp -- * * 192.168.1.0/24 192.168.1.69 tcp dpt:13388 to:172.16.1.254 [root@ipt ~]# iptables -t nat -vnL PREROUTING --line-number|grep 69 5 0 0 DNAT tcp -- * * 0.0.0.0/0 1.85.49.230 tcp dpt:3690 to:172.16.1.9:3690 33 1008 62696 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 34 1880 96972 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 62 2 104 DNAT tcp -- * * 0.0.0.0/0 1.85.49.230 tcp dpt:13389 to:192.168.1.69:3389 63 0 0 DNAT tcp -- * * 0.0.0.0/0 1.85.49.230 tcp dpt:13388 to:192.168.1.69:13388 69 0 0 DNAT tcp -- * * 0.0.0.0/0 1.85.49.230 tcp dpt:10011 to:172.16.1.15:3000 [root@ipt ~]# iptables -vnL FORWARD --line-number|grep 69 33 16 1531 ACCEPT all -- * * 192.168.1.69 0.0.0.0/0 47 696 35483 ACCEPT all -- * * 192.168.1.86 0.0.0.0/0 69 0 0 ACCEPT all -- * * 192.168.1.167 0.0.0.0/0 # iptables -t filter -A INPUT -s 123.456.789.0/24 -j DROP # iptables -t filter -A OUTPUT -d 123.456.789.0/24 -j DROP # iptables -A INPUT -i eth1 -s 10.0.0.0/8 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP_SPOOF A: " # iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP # iptables -A INPUT -s 1.2.3.4 -p tcp --destination-port 80 -j LOG --log-level crit xt_layer7 13576 12 iptable_mangle 6784 1 xt_MARK 6144 6 ipt_REDIRECT 5760 3 ipt_MASQUERADE 6656 5 iptable_nat 8964 1 nf_nat 20372 3 ipt_REDIRECT,ipt_MASQUERADE,iptable_nat ipt_REJECT 6912 0 nf_conntrack_ipv4 16012 17 iptable_nat,nf_nat nf_defrag_ipv4 6016 1 nf_conntrack_ipv4 xt_tcpudp 6912 238 xt_conntrack 7424 2 nf_conntrack 61768 7 xt_layer7,ipt_MASQUERADE,iptable_nat,nf_nat,nf_conntrack_netbios_ns,nf_conntrack_ipv4,xt_conntrack ipv6 216820 28 iptable_filter 6656 1 ip_tables 14224 3 iptable_mangle,iptable_nat,iptable_filter x_tables 17668 9 xt_layer7,xt_MARK,ipt_REDIRECT,ipt_MASQUERADE,iptable_nat,ipt_REJECT,xt_tcpudp,xt_conntrack,ip_tables nf_conntrack_netbios_ns 6400 0 xt_connlimit 3238 0 iptable_nat 6158 1 nf_nat 22759 1 iptable_nat nf_conntrack_ipv4 9506 3 iptable_nat,nf_nat nf_defrag_ipv4 1483 1 nf_conntrack_ipv4 iptable_filter 2793 1 ip_tables 17831 2 iptable_nat,iptable_filter ipt_LOG 5845 2 ipt_REJECT 2351 0 ip6t_REJECT 4628 2 nf_conntrack_ipv6 8748 2 nf_defrag_ipv6 11182 1 nf_conntrack_ipv6 xt_state 1492 2 nf_conntrack 79758 6 xt_connlimit,iptable_nat,nf_nat,nf_conntrack_ipv4,nf_conntrack_ipv6,xt_state ip6table_filter 2889 1 ip6_tables 18732 1 ip6table_filter
1.NFS相关
[root@localhost ~]# yum install rpcbind Installed: rpcbind.x86_64 0:0.2.0-11.el6 Dependency Installed: libgssglue.x86_64 0:0.1-11.el6 libtirpc.x86_64 0:0.2.1-6.el6_5.2 [root@localhost ~]# rpm -ql libgssglue /etc/gssapi_mech.conf /lib64/libgssglue.so.1 /lib64/libgssglue.so.1.0.0 [root@localhost ~]# rpm -ql libtirpc /etc/netconfig /lib64/libtirpc.so.1 /lib64/libtirpc.so.1.0.10 [root@localhost ~]# rpm -ql rpcbind /etc/rc.d/init.d/rpcbind /sbin/rpcbind /usr/sbin/rpcinfo /var/cache/rpcbind [root@localhost ~]# ps -ef|grep rpc root 3082 2368 0 17:54 pts/1 00:00:00 grep rpc [root@localhost ~]# service rpcbind start Starting rpcbind: [ OK ] [root@localhost ~]# ps -ef|grep rpc rpc 1174 1 0 18:07 ? 00:00:00 rpcbind root 1178 1140 0 18:07 pts/0 00:00:00 grep rpc [root@localhost ~]# rpcbind start [root@localhost ~]# ps -ef|grep rpc rpc 3085 1 0 17:55 ? 00:00:00 rpcbind start root 3087 2368 0 17:55 pts/1 00:00:00 grep rpc [root@localhost ~]# rpcbind -a -a (abort) specified without -d (debugging) -- ignored. rpcbind: another rpcbind is already running. Aborting [root@localhost ~]# rpcbind -i rpcbind: another rpcbind is already running. Aborting [root@localhost ~]# rpcbind -s rpcbind: another rpcbind is already running. Aborting [root@localhost ~]# rpcbind -w rpcbind: another rpcbind is already running. Aborting [root@localhost ~]# cd /proc/1174/fd [root@localhost fd]# ls 0 1 10 11 2 3 4 5 6 7 8 9 [root@localhost fd]# ll total 0 lrwx------. 1 root root 64 Sep 18 18:10 0 -> /dev/null lrwx------. 1 root root 64 Sep 18 18:10 1 -> /dev/null lrwx------. 1 root root 64 Sep 18 18:10 10 -> socket:[11434] lrwx------. 1 root root 64 Sep 18 18:10 11 -> socket:[11435] lrwx------. 1 root root 64 Sep 18 18:10 2 -> /dev/null lr-x------. 1 root root 64 Sep 18 18:10 3 -> /var/run/rpcbind.lock lrwx------. 1 root root 64 Sep 18 18:10 4 -> socket:[11450] lrwx------. 1 root root 64 Sep 18 18:10 5 -> socket:[11425] lrwx------. 1 root root 64 Sep 18 18:10 6 -> socket:[11427] lrwx------. 1 root root 64 Sep 18 18:10 7 -> socket:[11429] lrwx------. 1 root root 64 Sep 18 18:10 8 -> socket:[11430] lrwx------. 1 root root 64 Sep 18 18:10 9 -> socket:[11432] [root@localhost fd]# cd /var/cache/ [root@localhost cache]# ls ldconfig rpcbind yum [root@localhost cache]# cd rpcbind/ [root@localhost rpcbind]# ll total 8 -rw-------. 1 rpc rpc 124 Sep 18 18:06 portmap.xdr -rw-------. 1 rpc rpc 668 Sep 18 18:06 rpcbind.xdr [root@localhost rpcbind]# file * portmap.xdr: data rpcbind.xdr: data [root@221-comecs ~]# rpcinfo program version netid address service owner 100000 4 tcp6 ::.0.111 portmapper superuser 100000 3 tcp6 ::.0.111 portmapper superuser 100000 4 udp6 ::.0.111 portmapper superuser 100000 3 udp6 ::.0.111 portmapper superuser 100000 4 tcp 0.0.0.0.0.111 portmapper superuser 100000 3 tcp 0.0.0.0.0.111 portmapper superuser 100000 2 tcp 0.0.0.0.0.111 portmapper superuser 100000 4 udp 0.0.0.0.0.111 portmapper superuser 100000 3 udp 0.0.0.0.0.111 portmapper superuser 100000 2 udp 0.0.0.0.0.111 portmapper superuser 100000 4 local /var/run/rpcbind.sock portmapper superuser 100000 3 local /var/run/rpcbind.sock portmapper superuser 100024 1 udp 0.0.0.0.210.86 status 29 100024 1 tcp 0.0.0.0.148.133 status 29 100024 1 udp6 ::.149.13 status 29 100024 1 tcp6 ::.179.140 status 29 100021 1 udp 0.0.0.0.135.42 nlockmgr superuser 100021 3 udp 0.0.0.0.135.42 nlockmgr superuser 100021 4 udp 0.0.0.0.135.42 nlockmgr superuser 100021 1 tcp 0.0.0.0.192.46 nlockmgr superuser 100021 3 tcp 0.0.0.0.192.46 nlockmgr superuser 100021 4 tcp 0.0.0.0.192.46 nlockmgr superuser 100021 1 udp6 ::.186.157 nlockmgr superuser 100021 3 udp6 ::.186.157 nlockmgr superuser 100021 4 udp6 ::.186.157 nlockmgr superuser 100021 1 tcp6 ::.192.127 nlockmgr superuser 100021 3 tcp6 ::.192.127 nlockmgr superuser 100021 4 tcp6 ::.192.127 nlockmgr superuser [root@221-comecs ~]# rpcinfo -p program vers proto port service 100000 4 tcp 111 portmapper 100000 3 tcp 111 portmapper 100000 2 tcp 111 portmapper 100000 4 udp 111 portmapper 100000 3 udp 111 portmapper 100000 2 udp 111 portmapper 100024 1 udp 53846 status 100024 1 tcp 38021 status 100021 1 udp 34602 nlockmgr 100021 3 udp 34602 nlockmgr 100021 4 udp 34602 nlockmgr 100021 1 tcp 49198 nlockmgr 100021 3 tcp 49198 nlockmgr 100021 4 tcp 49198 nlockmgr [root@localhost rpcbind]# yum install nfs-utils Installed: nfs-utils.x86_64 1:1.2.3-39.el6_5.3 Dependency Installed: keyutils.x86_64 0:1.4-4.el6 libevent.x86_64 0:1.4.13-4.el6 nfs-utils-lib.x86_64 0:1.1.5-6.el6_5 [root@localhost rpcbind]# rpm -ql nfs-utils /etc/nfsmount.conf /etc/rc.d/init.d/nfs /etc/rc.d/init.d/nfslock /etc/rc.d/init.d/rpcgssd /etc/rc.d/init.d/rpcidmapd /etc/rc.d/init.d/rpcsvcgssd /etc/request-key.d/id_resolver.conf /etc/sysconfig/nfs /sbin/mount.nfs /sbin/mount.nfs4 /sbin/nfs_cache_getent /sbin/rpc.statd /sbin/umount.nfs /sbin/umount.nfs4 /usr/sbin/exportfs /usr/sbin/mountstats /usr/sbin/nfsidmap /usr/sbin/nfsiostat /usr/sbin/nfsstat /usr/sbin/rpc.gssd /usr/sbin/rpc.idmapd /usr/sbin/rpc.mountd /usr/sbin/rpc.nfsd /usr/sbin/rpc.svcgssd /usr/sbin/rpcdebug /usr/sbin/showmount /usr/sbin/sm-notify /usr/sbin/start-statd /var/lib/nfs /var/lib/nfs/etab /var/lib/nfs/rmtab /var/lib/nfs/rpc_pipefs /var/lib/nfs/statd /var/lib/nfs/statd/sm /var/lib/nfs/statd/sm.bak /var/lib/nfs/state /var/lib/nfs/v4recovery /var/lib/nfs/xtab [root@localhost rpcbind]# rpm -ql nfs-utils-lib /etc/idmapd.conf /usr/lib64/libnfsidmap.so.0 /usr/lib64/libnfsidmap.so.0.3.0 /usr/lib64/libnfsidmap/nsswitch.so /usr/lib64/libnfsidmap/static.so /usr/lib64/libnfsidmap/umich_ldap.so /usr/lib64/librpcsecgss.so.3 /usr/lib64/librpcsecgss.so.3.0.0 [root@localhost rpcbind]# rpm -ql keyutils /bin/keyctl /etc/request-key.conf /etc/request-key.d /sbin/request-key [root@localhost rpcbind]# rpm -ql libevent /usr/lib64/libevent-1.4.so.2 /usr/lib64/libevent-1.4.so.2.1.3 /usr/lib64/libevent_core-1.4.so.2 /usr/lib64/libevent_core-1.4.so.2.1.3 /usr/lib64/libevent_extra-1.4.so.2 /usr/lib64/libevent_extra-1.4.so.2.1.3 [root@localhost nfs]# mount /dev/mapper/VolGroup-lv_root on / type ext4 (rw) proc on /proc type proc (rw) sysfs on /sys type sysfs (rw) devpts on /dev/pts type devpts (rw,gid=5,mode=620) tmpfs on /dev/shm type tmpfs (rw,rootcontext="system_u:object_r:tmpfs_t:s0") /dev/sda1 on /boot type ext4 (rw) none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw) sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)启动nfs后会多出这两行 nfsd on /proc/fs/nfsd type nfsd (rw)
