Jun8

【原创】利用iftop查看进程产生的网路流量

Author: leeon  Click: 18103   Comments: 0 Category: linux  Tag: iftop,linux,network

当机器的出入流量有异常的时候,我们可以利用iftop工具查看每个进程的网络流量情况。iftop工具具有强大的网络流量分析能力。编译安装iftop工具前需要在机器上安装:libpcap ,libcurses。

iftop功能强大,这里我们只需要执行

 

[code="bash"]
iftop -P
[/code]

查看出来的流量是前2秒,10秒,40秒的平均流量,每个连接会显示两行数据,第一行是出流量,第二行是入流量数据,我们只用关心当前2秒的平均流量就能判断此时此刻哪个进程使用的网络IO较大。

不带参数效果:

带参数查看端口号效果:

界面操作命令如图所示

 

命令即可查看每个端口的网络流量情况,这样再通过netstat反查每个端口对应的进程名即可!

附上官方使用说明:

When running, iftop uses the whole screen to display network usage. At the top of the display is a logarithmic scale for the bar graph
which gives a visual indication of traffic.

The main part of the display lists, for each pair of hosts, the rate at which data has been sent and received over the preceding 2, 10
and 40 second intervals. The direction of data flow is indicated by arrows, <= and =>. For instance,

foo.example.com => bar.example.com 1Kb 500b 100b
<= 2Mb 2Mb 2Mb

shows, on the first line, traffic from foo.example.com to bar.example.com; in the preceding 2 seconds, this averaged 1Kbit/s, around
half that amount over the preceding 10s, and a fifth of that over the whole of the last 40s. During each of those intervals, the data
sent in the other direction was about 2Mbit/s. On the actual display, part of each line is inverted to give a visual indication of the
10s average of traffic. You might expect to see something like this where host foo is making repeated HTTP requests to bar, which is
sending data back which saturates a 2Mbit/s link.

By default, the pairs of hosts responsible for the most traffic (10 second average) are displayed at the top of the list.

At the bottom of the display, various totals are shown, including peak traffic over the last 40s, total traffic transferred (after
filtering), and total transfer rates averaged over 2s, 10s and 40s.

May22

【转载】Linux中bash与sh的区别

Author: 匿名  Click: 9159   Comments: 0 Category: linux  Tag: linux,bash,sh

在我们所使用的系统当中,使用sh调用执行脚本,相当于打开了bash的POSIX标准模式 (等效于bash的 --posix 参数)

一般的,sh是bash的“子集” (不是子集的部分,具体区别见下的“Things sh has that bash does not”)

例子:

[wwy@sf-watch test]$ cat t2.sh 
#!/bin/bash
diff <(echo xxx) <(echo yyy) # 此语法包含bash的特性,不属于sh的POSIX标准

[wwy@sf-watch test]$ bash -x ./t2.sh # 使用bash 调用,不会出问题
+ diff /dev/fd/63 /dev/fd/62
++ echo xxx
++ echo yyy
1c1
< xxx
---
> yyy
[wwy@sf-watch test]$ sh ./t2.sh # 而用sh调用,报错如下
./t2.sh: line 3: syntax error near unexpected token `('
./t2.sh: line 3: `diff <(echo xxx) <(echo yyy)'
[wwy@sf-watch test]$ echo $?
2

但是,在我们的linux系统中,sh是bash的一个软链接:

[wangweiyu@ComSeOp mon]$ which sh 
/bin/sh
[wangweiyu@ComSeOp mon]$ ls -l /bin/sh
lrwxrwxrwx 1 root root 4 Mar 21 2007 /bin/sh -> bash

那为什么上面的例子中还会出现问题呢?原因在于: bash程序执行,当“$0”是“sh”的时候, 则要求下面的代码遵循一定的规范,当不符合规范的语法存在时,则会报错, 所以可以这样理解, “sh”并不是一个程序,而是一种标准(POSIX), 这种标准,在一定程度上保证了脚本的跨系统性(跨UNIX系统)

下面的内容详细的说明了bash与sh在语法等方面的具体差异:

Things bash has that sh does not:

long invocation options
[+-]O invocation option
-l invocation option
`!' reserved word to invert pipeline return value
`time' reserved word to time pipelines and shell builtins
the `function' reserved word
the `select' compound command and reserved word
arithmetic for command: for ((expr1 ; expr2; expr3 )); do list; done
new $'...' and $"..." quoting
the $(...) form of command substitution
the $(<filename) form of command substitution, equivalent to
$(cat filename)
the ${#param} parameter value length operator
the ${!param} indirect parameter expansion operator
the ${!param*} prefix expansion operator
the ${param:offset[:length]} parameter substring operator
the ${param/pat[/string]} parameter pattern substitution operator
expansions to perform substring removal (${p%[%]w}, ${p#[#]w})
expansion of positional parameters beyond $9 with ${num}
variables: BASH, BASH_VERSION, BASH_VERSINFO, UID, EUID, REPLY,
TIMEFORMAT, PPID, PWD, OLDPWD, SHLVL, RANDOM, SECONDS,
LINENO, HISTCMD, HOSTTYPE, OSTYPE, MACHTYPE, HOSTNAME,
ENV, PS3, PS4, DIRSTACK, PIPESTATUS, HISTSIZE, HISTFILE,
HISTFILESIZE, HISTCONTROL, HISTIGNORE, GLOBIGNORE, GROUPS,
PROMPT_COMMAND, FCEDIT, FIGNORE, IGNOREEOF, INPUTRC,
SHELLOPTS, OPTERR, HOSTFILE, TMOUT, FUNCNAME, histchars,
auto_resume
DEBUG trap
ERR trap
variable arrays with new compound assignment syntax
redirections: <>, &>, >|, <<<, [n]<&word-, [n]>&word-
prompt string special char translation and variable expansion
auto-export of variables in initial environment
command search finds functions before builtins
bash return builtin will exit a file sourced with `.'
builtins: cd -/-L/-P, exec -l/-c/-a, echo -e/-E, hash -d/-l/-p/-t.
export -n/-f/-p/name=value, pwd -L/-P,
read -e/-p/-a/-t/-n/-d/-s/-u,
readonly -a/-f/name=value, trap -l, set +o,
set -b/-m/-o option/-h/-p/-B/-C/-H/-P,
unset -f/-v, ulimit -i/-m/-p/-q/-u/-x,
type -a/-p/-t/-f/-P, suspend -f, kill -n,
test -o optname/s1 == s2/s1 < s2/s1 > s2/-nt/-ot/-ef/-O/-G/-S
bash reads ~/.bashrc for interactive shells, $ENV for non-interactive
bash restricted shell mode is more extensive
bash allows functions and variables with the same name
brace expansion
tilde expansion
arithmetic expansion with $((...)) and `let' builtin
the `[[...]]' extended conditional command
process substitution
aliases and alias/unalias builtins
local variables in functions and `local' builtin
readline and command-line editing with programmable completion
command history and history/fc builtins
csh-like history expansion
other new bash builtins: bind, command, compgen, complete, builtin,
declare/typeset, dirs, enable, fc, help,
history, logout, popd, pushd, disown, shopt,
printf
exported functions
filename generation when using output redirection (command >a*)
POSIX.2-style globbing character classes
POSIX.2-style globbing equivalence classes
POSIX.2-style globbing collating symbols
egrep-like extended pattern matching operators
case-insensitive pattern matching and globbing
variable assignments preceding commands affect only that command,
even for builtins and functions
posix mode and strict posix conformance
redirection to /dev/fd/N, /dev/stdin, /dev/stdout, /dev/stderr,
/dev/tcp/host/port, /dev/udp/host/port
debugger support, including `caller' builtin and new variables
RETURN trap
the `+=' assignment operator

Things sh has that bash does not:
uses variable SHACCT to do shell accounting
includes `stop' builtin (bash can use alias stop='kill -s STOP')
`newgrp' builtin
turns on job control if called as `jsh'
$TIMEOUT (like bash $TMOUT)
`^' is a synonym for `|'
new SVR4.2 sh builtins: mldmode, priv

Implementation differences:
redirection to/from compound commands causes sh to create a subshell
bash does not allow unbalanced quotes; sh silently inserts them at EOF
bash does not mess with signal 11
sh sets (euid, egid) to (uid, gid) if -p not supplied and uid < 100
bash splits only the results of expansions on IFS, using POSIX.2
field splitting rules; sh splits all words on IFS
sh does not allow MAILCHECK to be unset (?)
sh does not allow traps on SIGALRM or SIGCHLD
bash allows multiple option arguments when invoked (e.g. -x -v);
sh allows only a single option argument (`sh -x -v' attempts
to open a file named `-v', and, on SunOS 4.1.4, dumps core.
On Solaris 2.4 and earlier versions, sh goes into an infinite
loop.)
sh exits a script if any builtin fails; bash exits only if one of
the POSIX.2 `special' builtins fails

调用相关:

在脚本的调用方面(interactive、login相关),bash与sh也是存在差异 以下是详细说明(假如被调用执行的脚本名字叫xxx.sh)

BASH:

1、 交互式的登录shell (bash –il xxx.sh)
载入的信息:
/etc/profile
~/.bash_profile( -> ~/.bashrc -> /etc/bashrc)
~/.bash_login
~/.profile

2、非交互式的登录shell (bash –l xxx.sh)
载入的信息:
/etc/profile
~/.bash_profile ( -> ~/.bashrc -> /etc/bashrc)
~/.bash_login
~/.profile
$BASH_ENV

3、交互式的非登录shell (bash –i xxx.sh)
载入的信息:
~/.bashrc ( -> /etc/bashrc)

4、非交互式的非登录shell (bash xxx.sh)
载入的信息:
$BASH_ENV

SH:

1、交互式的登录shell
载入的信息:
/etc/profile
~/.profile

2、非交互式的登录shell
载入的信息:
/etc/profile
~/.profile

3、交互式的非登录shell
载入的信息:
$ENV

4、非交互式的非登录shell
载入的信息:
nothing

由此可以看出,最主要的区别在于相关配置文件的是否载入, 而这些配置的是否载入,也就导致了很多默认选项的差异 (具体请仔细查看~/.bash_profile 等文件) 如:

[wangweiyu@ComSeOp ~]$ grep ulimit /etc/profile    
ulimit -S -c unlimited > /dev/null 2>&1
即,如果/etc/profile没有被载入,则不会产生core dump

值得一提的是,使用ssh远程执行命令, 远端sshd进程通过“bash –c”的方式来执行命令(即“非交互式的非登录shell”) 所以这一点,和登录之后再在本地执行执行命令,就存在了一定的差异

如:

[wangweiyu@ComSeOp ~]$ ssh wangweiyu@127.0.0.1 'echo $-'
wangweiyu@127.0.0.1's password:
hBc
[wangweiyu@ComSeOp ~]$ echo $-
himBH
[wangweiyu@ComSeOp ~]$ ssh wangweiyu@127.0.0.1 'echo $0'
wangweiyu@127.0.0.1's password:
bash
[wangweiyu@ComSeOp ~]$ echo $0
-bash

注: “$-” 中含有“i”代表“交互式shell” “$0”的显示结果为“-bash”,bash前面多个“-”,代表“登录shell” 没有“i“和“-”的,是“非交互式的非登录shell”

另外还有一点,虽然ssh远程执行的命令是“非交互式的非登录shell”,但在执行命令之前,ssh的那一次登录本身是“交互式的登录shell”,所以其会先读一下“~/.bash_profile”

如:

[wangweiyu@ComSeOp ~]$ cat .bashrc 
# .bashrc
# User specific aliases and functions
# Source global definitions
if [ -f /etc/bashrc ]; then
. /etc/bashrc
fi
echo 'xxx'

[wangweiyu@ComSeOp ~]$ ssh wangweiyu@127.0.0.1 'echo $-'
wangweiyu@127.0.0.1's password:
xxx
hBc

这一点,衍生出一个关于scp的问题,scp在传输数据之前,会先进行一次ssh登录, 而当.bashrc文件有输出的时候,则会导致scp失败!原因是解析返回的数据包出现混乱

如:

[wangweiyu@ComSeOp ~]$ cat .bashrc 
# .bashrc
# User specific aliases and functions
# Source global definitions
if [ -f /etc/bashrc ]; then
. /etc/bashrc
fi
echo 'xxx'
[wangweiyu@ComSeOp ~]$ scp file wangweiyu@127.0.0.1:/tmp
wangweiyu@127.0.0.1's password:
xxx
[wangweiyu@ComSeOp ~]$ echo $?
1
[wangweiyu@ComSeOp ~]$ ls /tmp/
[wangweiyu@ComSeOp ~]$
Apr23

【转载】Linux常用服务ACL规则详解

Author: 匿名  Click: 8094   Comments: 0 Category: linux  Tag: linux,acl,http,tcp,nfs,mail

前几年学的不用也忘的差不多了,重新记录一下。

-------------------------------------------------------------------------------------------------------

本文主要讲解服务程序有:apache、tcp_wapper、sendmail、samba、nfs、squid、ssh的访问控制。

实验中可以用修改/etc/hosts文件加

127.0.0.1 student.example.com student localhost.localdomain localhost
192.168.100.102 student1.example.com student1
192.168.100.103 abc.crack.org abc

apache测试
----------回顾
deny from 192.168.100.
deny from 192.168.100
deny from 192.168.100.101/24
都可以


域名用.example.com

Order allow,deny
allow from .example.com
表示只允许.example.com访问。
果加上deny from all,表示全部都拒绝,

order deny,allow
deny from .example.com
表示只拒绝.example.com
如果加上allow from all 表示全部都允许,


Deny,Allow
Deny指令在 Allow指令之前被评估。缺省允许所有访问。 任何不匹配Deny指令或者匹配 Allow指令的客户都被允许访问服务器。
Allow,Deny
Allow指令在 Deny指令之前被评估。缺省禁止所有访问。 任何不匹配Allow指令或者匹配 Deny指令的客户都将被禁止访问服务器。

用户登陆认证

directory中加
AllowOverride AuthConfig

在限制的目录下
.htaccess 这个名字固定 千万注意不要写错
写入
AuthName "Auth service"
AuthType basic
AuthUserFile /etc/httpd/conf/.htpasswd 这个名字和位置都不固定,
require valid-user


用htpasswd -c /etc/httpd/conf/.htpasswd 用户名


\\\\\\\\\小结\\\\\\\\\\
只允许.example.com的域访问。
Order allow,deny
allow from .example.com

只不允许.example.com访问
Order deny,allow
deny from .example.com


********************************************************************************************
tcp_wapper
----回顾

1。tcpd先检查hosts.allow再检查hosts.deny,如果前者允许的IP或者域名 后者即使有也不起作用


2。写法不支持24/32/8等mask的写法,必须把掩码写全
如:
sshd: 192.168.0.0/255.255.255.0
单个IP可以不写。
域名用 .example.com


还可以写sshd: all except .example.com

3。rhel3里常用
sshd
vsftpd
ipop3d


例题:
ssh可以被本地子网访问,但是不能让其他网段的用户访问
/etc/hosts.deny
sshd :ALL EXCEPT 192.168.0.

\\\\\\\\\小结\\\\\\\\\\
只允许example.com访问
hosts.allow
sshd:ALL EXCEPT .example.com
hosts.deny无

只不允许example.com访问
hosts.deny
sshd:ALL EXCEPT .example.com
hosts.allow无

**以上的理解是错误的,在tcp_wrapper中,拒绝只能用host.deny**

如果只允许example.com访问
hosts.allow 写sshd:.example.com
hosts.deny 写sshd:all

如果只不允许example.com访问
hosts.allow不写
hosts.deny 写sshd:.example.com

所以:
对于sshd:ALL EXCEPT .example.com这一句,表示的是hosts.allow中对sshd 都允许进入但是除了example.com不运用这个规则,但不表示拒绝,只是表示不进入,如果想拒绝还需要在 hosts.deny中加规则。


***********************************************************************************************
sendmail
写入文件
access中

192.168.0 拒绝是REJECT
无最后的点

域名

******************************************************************************************

ssh限制
如果限制用户登陆
在sshd_config中加入
AllowUsers root 那么除了这个用户都不可以登陆
DenyUsers sshtest 那么对这个用户拒绝登陆
************************************************************************************************


samba限制
------回顾
机制和tcp_wrapper一样,先看allow再看deny

hosts deny = 150.203.4. badhost.mynet.edu.au

hosts allow = 150.203. EXCEPT 150.203.6.66

hosts deny = all except .crack.org

hosts allow = 192.168.100.

Where the lists conflict, the allow list takes precedence.
如果冲突以allow优先。


\\\\\\\\\小结\\\\\\\\\\
只允许example.com访问
hosts allow = .example.com(如果同时不写hosts deny,默认deny all)
或者
hosts deny = all except .example.com

只拒绝example.com访问
hosts deny = .example.com

注意:这里也不能加hosts allow =all,不需要如果有了hosts.deny默认允许其他,加了反而允许全部访问,因为allow优先,和apache里的设置类似。


************************************************************************************
nfs限制


/var/smbtest *.example.com(ro,no_root_squash,async) *.crack.org(rw,root_squash,sync)
注意这里域名前要用 * 号

ip写法:
192.168.100.* == 192.168.100.0/24

/usr/src *.siyongc.domain(ro,root_squash,sync) 192.168.100.*(ro,root_squash,sync)
/var/ftp/pub/incoming 192.168.100.24(rw,all_squash,anonuid=50,anongid=50)


只允许example.com访问
/var/smbtest *.example.com(ro,no_root_squash,async)

**************************************************************************************
squid限制


和sendmail一样默认是deny all

他的规则和tcp_wrapper一样,如果allow通过,那么将不在检查deny

写法 需要先定义,然后在使用


搜索acl all,在之前定义
acl example src 192.168.100.0/24

acl spams dstdomain .hotmail.com

然后 搜索YOUR,使用
http_access deny spams
http_access allow example


只为.example.com的域提供代理,拒绝允许代理的域访问 .hotmail.com的页面
acl allowdomain srcdomain .example.com
acl spams dstdomain .hotmail.com
http_access deny spams
http_access allow example

Apr23

【原创】Linux常用服务domain写法

Author: leeon  Click: 6224   Comments: 0 Category: linux  Tag: domain,service

一、tcp_wrapper 中表示网段的方法

192.168.0.               or   192.168.0.0/255.255.255.0

  域的表示方法为:

   .example.com

 

二、NFS 中网段的表示方法

  192.168.0.0/24     192.168.0.0/255.255.255.0

  域的表示方法

  *.example.com

 

三、samba  中表示网段的方法

  192.168.0.        192.168.0.0/255.255.255.0  192.168.0.0/24

  .example.com

 

四、sendmail 中表示网段的方法

  192.168.0   /etc/mail/access 中的写法     192.168.0. or 192.168.0.0/255.255.255.0

  example.com

 

五、iptables

  192.168.0.0/24 or   192.168.0.0/255.255.255.0

  

 

六、http

  192.168.0.0/24      192.168.0.0/255.255.255.0

  .example.com     

 

 

注:

0.0.0.0/255.255.255.0 的网段表示法只在xinetd telnet中不生效其它服务均能适用。

 

分类

标签

归档

最新评论

Abyss在00:04:28评论了
Linux中ramdisk,tmpfs,ramfs的介绍与性能测试
shallwe99在10:21:17评论了
【原创】如何在微信小程序开发中正确的使用vant ui组件
默一在09:04:53评论了
Berkeley DB 由浅入深【转自架构师杨建】
Memory在14:09:22评论了
【原创】最佳PHP框架选择(phalcon,yaf,laravel,thinkphp,yii)
leo在17:57:04评论了
shell中使用while循环ssh的注意事项

我看过的书

链接

其他

访问本站种子 本站平均热度:8823 c° 本站链接数:1 个 本站标签数:464 个 本站被评论次数:94 次