[toc]linux
10.32/10.33 rsync经过服务同步shell
10.34 linux系统日志apache
10.35 screen工具vim
这种方式能够理解为:在远程主机上创建一个rsync服务器,在服务器上配置好rsync的各类应用,而后将本机做为rsync的一个客户端链接远程rsync服务器,下面是步骤说明:centos
[root@localhost ~]# vim /etc/rsyncd.conf log file=/var/log/rsync.log pid file=/var/run/rsyncd.pid address=192.168.72.132 [test] path=/root/rsync use chroot=true max connections=4 read only=no list=true uid=root gid=root auth users=test secrets file=/etc/rsyncd.passwd hosts allow=192.168.72.133
[root@localhost ~]# rsync --daemon [root@localhost ~]# ps aux |grep rsync root 4708 0.0 0.0 114656 524 ? Ss 10:59 0:00 rsync --daemon root 4710 0.0 0.0 112676 972 pts/0 S+ 10:59 0:00 grep --color=auto rsync
查看端口是否启动,netstat -lntp,刚才在/etc/rsyncd.conf中指定了端口,下图所示: 安全
为了方便测试把rsyncd.conf文件内容从新编辑为 path=/tmp/rsync,新建该临时目录并赋予权限bash
[root@localhost ~]# vi /etc/rsyncd.conf [root@localhost ~]# mkdir /tmp/rsync [root@localhost ~]# chmod 777 /tmp/rsync服务器
在须要后台服务的另一台机上输入以下命令:网络
[root@xavi-002 tmp]# rsync -avP /tmp/xavi.txt 192.168.72.133::test/xavi-02.txt rsync: failed to connect to 192.168.72.133 (192.168.72.133): Connection refused (111) rsync error: error in socket IO (code 10) at clientserver.c(122) [sender=3.0.9]
如今发现这里有错误,没法执行同步命令,查看下是否存在ip不通的状况,ping ip地址,而后用telnet查看其网络状况,若是没有telnet,请用yum安装一下less
[root@xavi-002 ~]# ping 192.168.72.130 PING 192.168.72.130 (192.168.72.130) 56(84) bytes of data. 64 bytes from 192.168.72.130: icmp_seq=1 ttl=64 time=2.44 ms 64 bytes from 192.168.72.130: icmp_seq=2 ttl=64 time=0.592 ms
[root@xavi-002 ~]# telnet 192.168.72.130 873 Trying 192.168.72.130... Connected to 192.168.72.130. Escape character is '^]'. @RSYNCD: 30.0
再次看下iptables是否有问题
[root@xavi-002 ~]# iptables -nvL Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67 0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67 8964 14M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 256 16892 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 6416 553K INPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/0 6416 553K INPUT_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0 6416 553K INPUT_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID 6393 552K REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
这里说明咱们要关闭的是firewalld.?????
[root@xavi-002 ~]# systemctl stop firewalld [root@xavi-002 ~]# iptables -nvL Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
同时把主机的firewalld服务也关闭
[root@localhost ~]# systemctl stop firewalld [root@localhost ~]# iptables -nvL Chain INPUT (policy ACCEPT 21405 packets, 15M bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67 0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- * virbr0 0.0.0.0/0 192.168.122.0/24 ctstate RELATED,ESTABLISHED 0 0 ACCEPT all -- virbr0 * 192.168.122.0/24 0.0.0.0/0 0 0 ACCEPT all -- virbr0 virbr0 0.0.0.0/0 0.0.0.0/0 0 0 REJECT all -- * virbr0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable 0 0 REJECT all -- virbr0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable Chain OUTPUT (policy ACCEPT 10672 packets, 784K bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT udp -- * virbr0 0.0.0.0/0 0.0.0.0/0 udp dpt:68
把两台机器的firewalld服务关闭后,在来看下telnet命令下端口状况
[root@xavi-002 ~]# telnet 192.168.72.130 873 Trying 192.168.72.130... Connected to 192.168.72.130. Escape character is '^]'. @RSYNCD: 30.0
这里表示已经成功链接,退出并关闭,输入“ctrl+]”,而后输入quit
[root@xavi-002 ~]# telnet 192.168.72.130 873 Trying 192.168.72.130... Connected to 192.168.72.130. Escape character is '^]'. @RSYNCD: 30.0 ^] telnet> quit Connection closed.
再次运行命令,提示要输入密码,这是咱们能够在主机上把/etc/rsyncd.conf配置文件再修改一下,把secret和auth users行加#号注释掉.
[root@xavi-002 ~]# rsync -avP /tmp/xavi.txt 192.168.72.130::test/xavi-02.txt Password:
再次在从机上运行后台服务命令,从远程机器上传输到主机上该文件
[root@xavi-002 ~]# rsync -avP /tmp/xavi.txt 192.168.72.130::test/xavi-02.txt sending incremental file list xavi.txt 2391 100% 0.00kB/s 0:00:00 (xfer#1, to-check=0/1) sent 2463 bytes received 27 bytes 711.43 bytes/sec total size is 2391 speedup is 0.96
在主机上查看到了xavi-02文件
[root@localhost ~]# ls /tmp/rsync xavi-02.txt
固然咱们也能够在从机上把主机的文件拉到从机上
[root@xavi-002 ~]# rsync -avP 192.168.72.130::test/xavi-02.txt /tmp/123.txt receiving incremental file list xavi-02.txt 2391 100% 2.28MB/s 0:00:00 (xfer#1, to-check=0/1) sent 45 bytes received 2497 bytes 221.04 bytes/sec total size is 2391 speedup is 0.94
如今咱们在来回归一下刚才编辑/etc/rsyncd.conf的配置内容解析:
log file=/var/log/rsync.log pid file=/var/run/rsyncd.pid address=192.168.72.132 [test] //模块名 path=/root/rsync use chroot=true max connections=4 read only=no list=true uid=root gid=root auth users=test secrets file=/etc/rsyncd.passwd hosts allow=192.168.72.133
[root@localhost rsync]# ln -s /etc/passwd /tmp/rsync/test.txt [root@localhost rsync]# ls -l /tmp/rsync/test.txt lrwxrwxrwx 1 root root 11 2月 3 18:10 /tmp/rsync/test.txt -> /etc/passwd
而后再到从机133上执行同步,
[root@xavi-002 ~]# rsync -avL test@192.168.72.130::test/ /tmp/test1/ receiving incremental file list symlink has no referent: "/test.txt" (in test) created directory /tmp/test1 ./ xavi-02.txt sent 48 bytes received 2567 bytes 5230.00 bytes/sec total size is 2391 speedup is 0.91 rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1518) [generator=3.0.9]
上例中看出,若是设置use chroot为ture,则同步软连接文件会有问题,下面把主机的rsync配置文件修改一下,把ture改成false
在回到从机133上,再次同步
[root@xavi-002 ~]# rsync -avL test@192.168.72.130::test/ /tmp/test1/ receiving incremental file list test.txt sent 45 bytes received 2528 bytes 5146.00 bytes/sec total size is 4782 speedup is 1.86
没有报错,问题解决,另外修改玩rsycnd.conf配置文件后不须要重启rsyncd服务,这是rsync的一个特定机制,配置文件是即时生效的.
[root@xavi-002 ~]# ls -l /tmp/test1/ 总用量 8 -rw-r--r-- 1 root root 2391 1月 7 15:53 test.txt -rw-r--r-- 1 root root 2391 2月 3 11:33 xavi-02.txt
[root@localhost rsync]# killall rsync [root@localhost rsync]# !ps ps aux |grep vmstat root 8382 0.0 0.0 112676 968 pts/1 R+ 20:02 0:00 grep --color=auto vmstat
==未能实现??????????==
这里咱们看到密码配置文件在/etc/rsyncd.passwd,编辑它
[root@localhost rsync]# vim /etc/rsyncd.passwd
同时开放它的权限
[root@localhost rsync]# vim /etc/rsyncd.passwd [root@localhost rsync]# chmod 600 !$
[root@xavi-002 ~]# vim /etc/rsync_pass.txt
这样在写shell脚本的时候就能够不用输入密码了
日志记录了系统天天发生的各类各样的事情,好比监测系统情况、排查系统故障等,你能够经过他来检查错误发生的缘由,或者受到攻击时攻击者留下的痕迹。日志的主要功能是审计和监测,还能够实时的监测系统状态,监测和追踪侵入者等等。
[root@localhost ~]# ls /var/log/messages /var/log/messages [root@localhost ~]# less !$
查看其大小
[root@localhost ~]# du -sh !$ du -sh /var/log/messages 900K /var/log/messages
一般,/var/log/messages是在作故障诊断时首先要查看的文件。
系统有一个日志轮询的机制,每星期切换一个日志,切换后的日志名字相似于messages-20180123.会存放在/var/log/目录下面,连同messages一共有5个这样的日志文件,这里的20180123就是日期,表示日子切割的年月日.
[root@localhost ~]# ls /var/log/messages* /var/log/messages /var/log/messages-20180123 /var/log/messages-20180204 /var/log/messages-20180115 /var/log/messages-20180128
这是经过logrotate工具的控制来实现的,它的配置文件是/etc/logrotate.conf,(若是没有特殊需求请不要修改这个配置文件)。
[root@localhost ~]# cat /etc/logrotate.conf # see "man logrotate" for details # rotate log files weekly weekly # keep 4 weeks worth of backlogs rotate 4 //保留4个文件 # create new (empty) log files after rotating old ones create # use date as a suffix of the rotated file dateext # uncomment this if you want your log files compressed #compress # RPM packages drop log rotation information into this directory include /etc/logrotate.d # no packages own wtmp and btmp -- we'll rotate them here /var/log/wtmp { monthly create 0664 root utmp minsize 1M rotate 1 } /var/log/btmp { missingok monthly create 0600 root utmp rotate 1 } # system-specific logs may be also be configured here.
上述logrotate.conf配置文件的内容能够参考英文注释去理解,/var/log/messages是由rsyslogd这个守护进程产生的,若是中止这个服务则系统不会产生/var/log/messages,因此这个服务不要中止。
[root@localhost ~]# ls /etc/logrotate.d chrony glusterfs libvirtd numad psacct sssd wpa_supplicant cups iscsiuiolog libvirtd.qemu ppp samba syslog yum [root@localhost ~]# cat /etc/logrotate.d/syslog /var/log/cron /var/log/maillog /var/log/messages /var/log/secure /var/log/spooler { missingok sharedscripts postrotate /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true endscript }
[root@localhost ~]# dmesg |head [ 0.000000] Initializing cgroup subsys cpuset [ 0.000000] Initializing cgroup subsys cpu [ 0.000000] Initializing cgroup subsys cpuacct [ 0.000000] Linux version 3.10.0-514.el7.x86_64 (builder@kbuilder.dev.centos.org) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC) ) #1 SMP Tue Nov 22 16:42:41 UTC 2016 [ 0.000000] Command line: BOOT_IMAGE=/vmlinuz-3.10.0-514.el7.x86_64 root=UUID=12ac0c7f-ed4e-49b8-b862-68d478ecc7e4 ro crashkernel=auto rhgb quiet LANG=zh_CN.UTF-8 [ 0.000000] Disabled fast string operations [ 0.000000] e820: BIOS-provided physical RAM map: [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009ebff] usable [ 0.000000] BIOS-e820: [mem 0x000000000009ec00-0x000000000009ffff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000000dc000-0x00000000000fffff] reserved
[root@localhost ~]# ls /var/log/dmesg /var/log/dmesg [root@localhost ~]# less /var/log/dmesg [ 0.000000] Initializing cgroup subsys cpuset [ 0.000000] Initializing cgroup subsys cpu [ 0.000000] Initializing cgroup subsys cpuacct [ 0.000000] Linux version 3.10.0-514.el7.x86_64 (builder@kbuilder.dev.centos.org) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC) ) #1 SMP Tue Nov 22 16:42:41 UTC 2016 [ 0.000000] Command line: BOOT_IMAGE=/vmlinuz-3.10.0-514.el7.x86_64 root=UUID=12ac0c7f-ed4e-49b8-b862-68d478ecc7e4 ro crashkernel=auto rhgb quiet LANG=zh_CN.UTF-8 [ 0.000000] Disabled fast string operations [ 0.000000] e820: BIOS-provided physical RAM map: [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009ebff] usable
3.11 last 命令查看Linux的历史信息,用法以下:
[root@localhost ~]# less /var/log/dmesg [root@localhost ~]# last root pts/0 192.168.72.1 Mon Feb 5 19:15 still logged in reboot system boot 3.10.0-514.el7.x Mon Feb 5 18:51 - 20:37 (01:45) root pts/0 192.168.72.1 Sun Feb 4 16:02 - crash (1+02:49) reboot system boot 3.10.0-514.el7.x Sun Feb 4 15:29 - 20:37 (1+05:07) root pts/1 192.168.72.1 Sat Feb 3 15:21 - crash (1+00:07) root pts/0 192.168.72.1 Sat Feb 3 10:30 - 17:09 (06:38) root pts/0 192.168.72.1 Thu Feb 1 19:59 - 22:44 (02:44) reboot system boot 3.10.0-514.el7.x Thu Feb 1 19:54 - 20:37 (4+00:42)
上例中,从左至右依次为帐户名称、登陆终端、登陆客户端ip、登陆日期及时长。last命令输出的信息其实是读取了二进制日志文件/var/log/wtmp, 只是这个文件不能直接使用cat, vim, head, tail等工具查看。 。
[root@localhost ~]# lastb btmp begins Thu Feb 1 20:35:01 2018
另一个和登录信息有关的安全日志文件为/var/log/secure, 该日志文件记录验证和受权等方面的信息,好比ssh登录系统成功或者失败,都会把相关信息记录在这个日志里
[root@localhost ~]# ls /var/log/secure /var/log/secure [root@localhost ~]# less /var/log/secure Feb 4 17:59:53 localhost polkitd[580]: Registered Authentication Agent for unix-process:3970:905339 (system bus name :1.63 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8) Feb 5 18:51:55 localhost polkitd[536]: Loading rules from directory /etc/polkit-1/rules.d Feb 5 18:51:55 localhost polkitd[536]: Loading rules from directory /usr/share/polkit-1/rules.d Feb 5 18:51:55 localhost polkitd[536]: Finished loading, compiling and executing 6 rules Feb 5 18:51:55 localhost polkitd[536]: Acquired the name org.freedesktop.PolicyKit1 on the system bus Feb 5 18:52:03 localhost sshd[865]: Server listening on 0.0.0.0 port 22. Feb 5 18:52:03 localhost sshd[865]: Server listening on :: port 22. Feb 5 19:15:30 localhost sshd[2474]: Accepted password for root from 192.168.72.1 port 51786 ssh2 /var/log/secure...skipping... Feb 4 17:59:53 localhost polkitd[580]: Registered Authentication Agent for unix-process:3970:905339 (system bus name :1.63 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8) Feb 5 18:51:55 localhost polkitd[536]: Loading rules from directory /etc/polkit-1/rules.d Feb 5 18:51:55 localhost polkitd[536]: Loading rules from directory /usr/share/polkit-1/rules.d Feb 5 18:51:55 localhost polkitd[536]: Finished loading, compiling and executing 6 rules
有时候咱们须要执行一个命令或脚本,须要几小时甚至几天,在这个过程当中,若是中途断网或者出现有其余意外状况怎么办,固然也能够吧命令或者脚本放到后台运行,不过不保险,没法在屏幕上随时查看,这就要用到虚拟终端screen。
[root@localhost ~]# yum install -y screen 已加载插件:fastestmirror, langpacks base | 3.6 kB 00:00:00
[root@localhost ~]# screen [root@localhost ~]# w 20:54:48 up 2:03, 1 user, load average: 0.04, 0.03, 0.05 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT root pts/1 192.168.72.1:S.0 20:54 0.00s 0.03s 0.00s w
[root@localhost ~]# screen -ls There is a screen on: 3451.pts-0.localhost (Attached) 1 Socket in /var/run/screen/S-root.
[root@localhost ~]# screen [detached from 3451.pts-0.localhost]
[root@localhost ~]# screen -r 3451 1 0 0 1330772 932 378496 0 0 23 2 21 31 0 0 100 0 0 0 0 0 1330756 932 378528 0 0 0 0 43 55 0 0 100 0 0 0 0 0 1330756 932 378528 0 0 0 0 24 36 0 0 100 0 0 0 0 0 1330756 932 378528 0 0 0 0 38 50 0 0 99 0 0 0 0 0 1330756 932 378528 0 0 0 0 30 46 0 0 100 0 0
[root@localhost ~]# screen -ls No Sockets found in /var/run/screen/S-root.
[root@localhost ~]# screen [detached from 3670.pts-0.localhost] [root@localhost ~]# screen [detached from 3704.pts-0.localhost] [root@localhost ~]# screen [detached from 3733.pts-0.localhost] [root@localhost ~]# sreen -ls bash: sreen: 未找到命令... [root@localhost ~]# screen -ls There are screens on: 3733.pts-0.localhost (Detached) 3704.pts-0.localhost (Detached) 3670.pts-0.localhost (Detached) 3 Sockets in /var/run/screen/S-root.
[root@localhost ~]# screen -S "test_screen" [root@localhost ~]# sleep 100 [root@localhost ~]# screen -ls There are screens on: 3806.test_screen (Attached) 3733.pts-0.localhost (Detached) 3704.pts-0.localhost (Detached) 3670.pts-0.localhost (Detached) 4 Sockets in /var/run/screen/S-root.