第3次答疑

1.取8位随机数。
法一：
取随机数（纳秒）：
[root@m01 ~]# date +%N
734230030
[root@m01 ~]# date +%N
230165114
[root@m01 ~]# date +%N
952112382
取随机密码：
[root@m01 ~]# date +%N|md5sum
0df13a64922bb9743642005f565f459a -
取随机数前八位：
[root@m01 ~]# date +%N|md5sum|cut -c1-8
0bf249c4
[root@m01 ~]# date +%N|md5sum|cut -c1-8
8a22f1cd
法二：
[root@m01 ~]# echo $RANDOM
19815
[root@m01 ~]# echo $RANDOM
23196
[root@m01 ~]# echo $RANDOM
19874
[root@m01 ~]# echo $((1+3))
4
[root@m01 ~]# echo $((1-3))
-2
[root@m01 ~]# echo $(($RANDOM))
32195
[root@m01 ~]# echo $(($RANDOM+10000000))
10012808
[root@m01 ~]# echo $(($RANDOM+10000000))
10015463

[root@m01 opt]# vim sed-range.txt
[root@m01 opt]# cat sed-range.txt
oldboy
{
oldboy
oldgirl
}
oldboy
{
oldboy
oldgirl
}
[root@m01 opt]# tr -d "a-z" <sed-range.txt

{

}

{

}
[root@m01 opt]# tr -cd "a-z" <sed-range.txt
oldboyoldboyoldgirloldboyoldboyoldgirl[root@m01 opt]#
[root@m01 opt]# tr -cd "a-z" <sed-range.txt
oldboyoldboyoldgirloldboyoldboyoldgirl[root@m01 opt]# tr -cd "a-z\n" <sed-range.txt
oldboy

oldboy
oldgirl

oldboy

oldboy
oldgirl
法三：
[root@m01 opt]# tr -cd "a-zA-Z0-9" </dev/urandom |head -c8
IrlsIeyl[root@m01 opt]# tr -cd "a-zA-Z0-9" </dev/urandom |head -c8
Qv2LGyTH[root@m01 opt]#

2.批量添加5个用户stu01,stu02....stu05,并设置8位随机密码(禁止使用for,while等循环)
[root@m01 ~]# echo stu{01..05}
stu01 stu02 stu03 stu04 stu05
[root@m01 ~]# echo stu{01..05}|tr "" "\n"
stu01 stu02 stu03 stu04 stu05
[root@m01 ~]# echo stu{01..05}|tr " " "\n"
stu01
stu02
stu03
stu04
stu05
[root@m01 ~]# echo stu{01..05}|tr " " "\n"|sed -r 's#(.*)#useradd \1#g'
useradd stu01
useradd stu02
useradd stu03
useradd stu04
useradd stu05
[root@m01 ~]# echo stu{01..05}|tr " " "\n"|sed -r 's#(.*)#useradd \1;pass=$((RANDOM+10000000))#g'
useradd stu01;pass=$((RANDOM+10000000))
useradd stu02;pass=$((RANDOM+10000000))
useradd stu03;pass=$((RANDOM+10000000))
useradd stu04;pass=$((RANDOM+10000000))
useradd stu05;pass=$((RANDOM+10000000))
[root@m01 ~]# echo stu{01..05}|tr " " "\n"|sed -r 's#(.*)#useradd \1;pass=$((RANDOM+10000000));echo "$pass"#g'
useradd stu01;pass=$((RANDOM+10000000));echo "$pass"
useradd stu02;pass=$((RANDOM+10000000));echo "$pass"
useradd stu03;pass=$((RANDOM+10000000));echo "$pass"
useradd stu04;pass=$((RANDOM+10000000));echo "$pass"
useradd stu05;pass=$((RANDOM+10000000));echo "$pass"
[root@m01 ~]# echo stu{01..05}|tr " " "\n"|sed -r 's#(.*)#useradd \1;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin \1#g'
useradd stu01;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu01
useradd stu02;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu02
useradd stu03;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu03
useradd stu04;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu04
useradd stu05;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu05
[root@m01 ~]# echo stu{01..05}|tr " " "\n"|sed -r 's#(.*)#useradd \1;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin \1\t#g'
useradd stu01;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu01
useradd stu02;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu02
useradd stu03;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu03
useradd stu04;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu04
useradd stu05;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu05
[root@m01 ~]# echo stu{01..05}|tr " " "\n"|sed -r 's#(.*)#useradd \1;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin \1\t `echo "echo "$pass""`#g'
useradd stu01;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu01 `echo "echo "$pass""`
useradd stu02;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu02 `echo "echo "$pass""`
useradd stu03;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu03 `echo "echo "$pass""`
useradd stu04;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu04 `echo "echo "$pass""`
useradd stu05;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu05 `echo "echo "$pass""`
[root@m01 ~]# echo stu{01..05}|tr " " "\n"|sed -r 's#(.*)#useradd \1;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin \1;echo -e "\1 \t"#g'
useradd stu01;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu01;echo -e "stu01 "
useradd stu02;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu02;echo -e "stu02 "
useradd stu03;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu03;echo -e "stu03 "
useradd stu04;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu04;echo -e "stu04 "
useradd stu05;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu05;echo -e "stu05 "
[root@m01 ~]# echo stu{01..05}|tr " " "\n"|sed -r 's#(.*)#useradd \1;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin \1;echo -e "\1 \t `echo "$pass"`"#g'
useradd stu01;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu01;echo -e "stu01 `echo "$pass"`"
useradd stu02;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu02;echo -e "stu02 `echo "$pass"`"
useradd stu03;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu03;echo -e "stu03 `echo "$pass"`"
useradd stu04;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu04;echo -e "stu04 `echo "$pass"`"
useradd stu05;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu05;echo -e "stu05 `echo "$pass"`"
[root@m01 ~]# echo stu{01..05}|tr " " "\n"|sed -r 's#(.*)#useradd \1;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin \1;echo -e "\1 \t `echo "$pass"`">>/opt/oldboy.log#g'
useradd stu01;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu01;echo -e "stu01 `echo "$pass"`">>/opt/oldboy.log
useradd stu02;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu02;echo -e "stu02 `echo "$pass"`">>/opt/oldboy.log
useradd stu03;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu03;echo -e "stu03 `echo "$pass"`">>/opt/oldboy.log
useradd stu04;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu04;echo -e "stu04 `echo "$pass"`">>/opt/oldboy.log
useradd stu05;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin stu05;echo -e "stu05 `echo "$pass"`">>/opt/oldboy.log
[root@m01 ~]# echo stu{01..05}|tr " " "\n"|sed -r 's#(.*)#useradd \1;pass=$((RANDOM+10000000));echo "$pass"|passwd --stdin \1;echo -e "\1 \t `echo "$pass"`">>/opt/oldboy.log#g'|bash
Changing password for user stu01.
passwd: all authentication tokens updated successfully.
Changing password for user stu02.
passwd: all authentication tokens updated successfully.
Changing password for user stu03.
passwd: all authentication tokens updated successfully.
Changing password for user stu04.
passwd: all authentication tokens updated successfully.
Changing password for user stu05.
passwd: all authentication tokens updated successfully.

[root@m01 ~]# tail -5 /etc/passwd
stu01:x:501:501::/home/stu01:/bin/bash
stu02:x:502:502::/home/stu02:/bin/bash
stu03:x:503:503::/home/stu03:/bin/bash
stu04:x:504:504::/home/stu04:/bin/bash
stu05:x:505:505::/home/stu05:/bin/bash
参考：http://blog.51cto.com/dengaosky/1854560

3.取IP地址
法一：
[root@m01 ~]# ip a s eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:0c:29:87:32:04 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.61/24 brd 10.0.0.255 scope global eth0
inet6 fe80::20c:29ff:fe87:3204/64 scope link
valid_lft forever preferred_lft forever
[root@m01 ~]# ip a s eth0|awk 'NR==3'
inet 10.0.0.61/24 brd 10.0.0.255 scope global eth0
[root@m01 ~]# ip a s eth0|awk -F "[ /]+" 'NR==3{print $3}'
10.0.0.61

法二：反向思维：将不是数字和点的归类作为菜刀刀痕。
[root@m01 ~]# ip a s eth0|awk 'NR==3'
inet 10.0.0.61/24 brd 10.0.0.255 scope global eth0
[root@m01 ~]# ip a s eth0|awk 'NR==3'|egrep "[0-9.]+"
inet 10.0.0.61/24 brd 10.0.0.255 scope global eth0
[root@m01 ~]# ip a s eth0|awk 'NR==3'|egrep "[^0-9.]+"
inet 10.0.0.61/24 brd 10.0.0.255 scope global eth0
[root@m01 ~]# ip a s eth0|awk 'NR==3'|egrep -o "[^0-9.]+"
inet
/
brd
scope global eth
[root@m01 ~]# ip a s eth0|awk -F "[^0-9.]+" 'NR==3{print $2}'
10.0.0.61

4.如何统计出系统中谁在破解你的密码及破解的次数
[root@m01 opt]# awk '/Failed/p' secure-20161219
情况一：以root用户身份试图破解root密码
[root@m01 opt]# awk '/Failed password/' secure-20161219
情况二：不断试题破解其他用户
[root@m01 opt]# awk '/Invalid user/' secure-20161219

[root@m01 opt]# awk '/Failed password|Invalid user/' secure-20161219|head
Dec 11 03:49:24 localhost sshd[27087]: Invalid user support from 123.31.34.190 port 55493
Dec 11 03:49:25 localhost sshd[27087]: Failed password for invalid user support from 123.31.34.190 port 55493 ssh2
Dec 11 03:49:26 localhost sshd[27092]: Invalid user admin from 123.31.34.190 port 56193
Dec 11 03:49:27 localhost sshd[27092]: Failed password for invalid user admin from 123.31.34.190 port 56193 ssh2
Dec 11 03:49:29 localhost sshd[27094]: Invalid user uucp from 123.31.34.190 port 56223
Dec 11 03:49:30 localhost sshd[27094]: Failed password for invalid user uucp from 123.31.34.190 port 56223 ssh2
Dec 11 04:37:36 localhost sshd[28081]: Invalid user business from 221.126.233.134 port 3290
Dec 11 04:37:36 localhost sshd[28081]: Failed password for invalid user business from 221.126.233.134 port 3290 ssh2
Dec 11 04:37:36 localhost sshd[28081]: Failed password for invalid user business from 221.126.233.134 port 3290 ssh2
Dec 11 04:37:36 localhost sshd[28081]: Failed password for invalid user business from 221.126.233.134 port 3290 ssh2
[root@m01 opt]# vim temp2.txt //仅做练习

[root@m01 opt]# awk '/Failed password|Invalid user/' secure-20161219|head|awk -F "from|port" '{print $2}'


123.31.34.190
123.31.34.190
123.31.34.190
123.31.34.190
221.126.233.134
221.126.233.134
221.126.233.134
221.126.233.134
解决空行问题：
[root@m01 opt]# awk '/Failed password|Invalid user/' secure-20161219|head|egrep "from|port" //检查

[root@m01 opt]# awk '/Failed password|Invalid user/' secure-20161219|head|awk -F " (from|port) " '{print $2}'
123.31.34.190
123.31.34.190
123.31.34.190
123.31.34.190
123.31.34.190
123.31.34.190
221.126.233.134
221.126.233.134
221.126.233.134
221.126.233.134
[root@m01 opt]# awk '/Failed password|Invalid user/' secure-20161219|head|awk -F " (from|port) " '{print $2}'|sort|uniq -c
6 123.31.34.190
4 221.126.233.134
[root@m01 opt]# awk '/Failed password|Invalid user/' secure-20161219|awk -F " (from|port) " '{print $2}'|sort|uniq -c|sort -rn -k1
68652 218.65.30.25
34326 218.65.30.53
21201 218.87.109.154
18065 112.85.42.103
17164 112.85.42.99
17163 218.87.109.151
17163 218.87.109.150
17163 218.65.30.61
17163 218.65.30.126
17163 218.65.30.124
17163 218.65.30.123
17163 218.65.30.122
17163 182.100.67.120
17163 182.100.67.119
17163 112.85.42.124
17163 112.85.42.107
3289 222.186.50.206
3265 219.133.29.16
3206 111.73.46.156
2479 117.21.226.189
2373 59.63.166.84
975 209.126.122.70
704 91.224.160.176
640 91.224.161.71
592 92.223.217.2
540 202.58.181.155
327 117.27.158.53
319 116.55.245.57
316 113.207.7.3
290 46.139.219.84
192 91.224.161.88
192 91.224.160.108
128 123.31.34.165
122 121.18.231.85
91 118.100.251.170
86 195.154.50.61
77 212.83.134.168
74 123.31.34.141
45 123.249.45.155
39 163.172.116.20
39 123.31.34.215
30 221.194.44.225
30 183.136.238.78
21 111.73.46.162
21 103.27.238.252
20 212.83.177.228
18 212.129.29.20
18 163.172.116.185
15 212.83.170.203
15 186.137.216.89
15 111.73.46.36
13 163.172.113.30
12 187.72.132.40
12 177.70.4.90
12 139.59.237.72
12 121.134.178.234
11 51.254.143.19
11 206.223.178.182
11 191.243.54.242
11 187.115.73.70
11 169.46.38.74
11 118.193.161.88
10 218.2.0.16
10 163.172.204.238
10 163.172.119.98
10 110.45.145.222
9 62.210.9.223
9 195.154.57.248
8 202.71.25.248
7 125.16.71.175
7 120.221.28.232
6 195.154.53.146
6 123.31.34.190
6 123.31.34.17
6 115.239.230.222
5 222.186.134.140
5 123.31.31.249
4 91.223.133.33
4 221.126.233.134
4 212.83.158.199
4 185.159.37.21
4 123.31.34.43
4 123.24.90.245
3 85.93.5.70
3 115.239.248.35
2 85.93.5.71
2 195.20.3.210
2 103.237.144.68
1 122.228.238.66