linux shell實現批量關閉區域網中主機埠

假設區域網中有多台主機，只能開通ssh服務(埠22)，如果發現其他服務打開，則全部關閉。通過運行一個shell腳本，完成以上功能。在實際運維中，可以通過puppet等工具更快更好的完成這個功能，所以本案例僅僅用來練手，為了熟悉sed, awk, grep等常見的shell命令而已。

1、通過nmap命令查詢區域網中所有主機打開的埠，並存入文件nmap1.txt中。

1 # 通過nmap命令查詢區域網中所有主機打開的埠，並存入文件nmap1.txt中
2 mkdir -p /wuhao/sh/files
3 nmap $1 > /wuhao/sh/files/nmap1.txt

以nmap 192.168.20.1-10為例，輸出結果為：

Starting Nmap 5.51 ( http://nmap.org ) at 2016-03-03 16:37 CST
Nmap scan report for oos01 (192.168.20.1)
Host is up (0.0000040s latency).
Not shown: 997 closed ports
PORT   STATE    SERVICE
21/tcp open     ftp
22/tcp open     ssh
80/tcp filtered http

Nmap scan report for oos02 (192.168.20.2)
Host is up (0.000099s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
3306/tcp open  mysql
MAC Address: 00:1C:42:FF:5A:B5 (Parallels)

Nmap scan report for oos03 (192.168.20.3)
Host is up (0.000097s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
3306/tcp open  mysql
MAC Address: 00:1C:42:38:94:3C (Parallels)

Nmap done: 10 IP addresses (3 hosts up) scanned in 1.57 seconds

2、從文件nmap1.txt中提取出需要的信息(主機ip，以及埠狀態)。

 1 # 從文件nmap1.txt中提取出需要的信息(主機ip，以及埠狀態)
 2 sed -n '/\(Nmap scan report for\|^[0-9]\+\/\)/p' /wuhao/sh/files/nmap1.txt > /wuhao/sh/files/nmap2.txt
 3 hosts=($(grep -on '(.*)' /wuhao/sh/files/nmap2.txt | sed -n 's/(\|)//gp'))
 4 declare -i len=${#hosts[*]}
 5 declare -i i=0
 6 while [[ $i -lt $len ]]
 7 do
 8   lines[$i]=$(echo ${hosts[$i]} | awk -F ':' '{print $1}')
 9   ips[$i]=$(echo ${hosts[$i]} | awk -F ':' '{print $2}')
10   i=$i+1
11 done
12 # echo ${lines[*]}=1 5 9
13 # echo ${ips[*]}=192.168.20.1 192.168.20.2 192.168.20.3

3、在埠狀態行首添加所對應的主機ip信息，並將結果保存到文件nmap2.txt中。

 1 # 在埠狀態行首添加所對應的主機ip信息
 2 declare -i j=0
 3 while [[ $j -lt $len ]]
 4 do
 5   declare -i k=$j+1
 6   if [ $j -ne $(($len-1)) ]; then
 7     sed -i "$((${lines[$j]}+1)),$((${lines[$k]}-1))s/^/${ips[$j]} /" /wuhao/sh/files/nmap2.txt
 8   else
 9     sed -i "$((${lines[$j]}+1)),$""s/^/${ips[$j]} /" /wuhao/sh/files/nmap2.txt
10   fi
11   j=$j+1
12 done
13 
14 # 將多個空格以及/替換為一個空格
15 sed -i 's/ \+\|\// /g' /wuhao/sh/files/nmap2.txt

nmap2.txt文件內容為：

Nmap scan report for oos01 (192.168.20.1)
192.168.20.1 21 tcp open ftp
192.168.20.1 22 tcp open ssh
192.168.20.1 80 tcp filtered http
Nmap scan report for oos02 (192.168.20.2)
192.168.20.2 22 tcp open ssh
192.168.20.2 80 tcp open http
192.168.20.2 3306 tcp open mysql
Nmap scan report for oos03 (192.168.20.3)
192.168.20.3 22 tcp open ssh
192.168.20.3 80 tcp open http
192.168.20.3 3306 tcp open mysql

4、提取出需要關閉的埠(除了埠22之外，其餘埠全部關閉)。通過sshpass遠程登錄到各主機，並且在iptables執行關閉埠命令。

 1 # 提取出需要關閉的埠(除了埠22之外，其餘埠如果打開則全部關閉)
 2 awk '{if($4~/open/ && $2!=22) print $0}' /wuhao/sh/files/nmap2.txt > /wuhao/sh/files/nmap3.txt
 3 
 4 hostip=($(awk -F " " '{print $1}' /wuhao/sh/files/nmap3.txt))
 5 port=($(awk -F " " '{print $2}' /wuhao/sh/files/nmap3.txt))
 6 protocol=($(awk -F " " '{print $3}' /wuhao/sh/files/nmap3.txt))
 7 
 8 # 通過sshpass遠程登錄到各主機，並且在iptables執行關閉埠命令
 9 for((m=0;m<${#hostip[*]};m=m+1))
10 do
11   sshpass -p 123456 ssh root@${hostip[$m]} "iptables -A INPUT -p ${protocol[$m]} --dport ${port[$m]} -j DROP;service iptables save;service iptables restart;exit"
12 done
13 
14 echo "success!"

5、運行腳本，查看結果。

[root@oos01 sh]# sh shutdownport.sh 192.168.20.1-10
iptables: Saving firewall rules to /etc/sysconfig/iptables: [  OK  ]
iptables: Setting chains to policy ACCEPT: filter [  OK  ]
iptables: Flushing firewall rules: [  OK  ]
iptables: Unloading modules: [  OK  ]
iptables: Applying firewall rules: [  OK  ]
iptables: Saving firewall rules to /etc/sysconfig/iptables: [  OK  ]
iptables: Setting chains to policy ACCEPT: filter [  OK  ]
iptables: Flushing firewall rules: [  OK  ]
iptables: Unloading modules: [  OK  ]
iptables: Applying firewall rules: [  OK  ]
iptables: Saving firewall rules to /etc/sysconfig/iptables: [  OK  ]
iptables: Setting chains to policy ACCEPT: filter [  OK  ]
iptables: Flushing firewall rules: [  OK  ]
iptables: Unloading modules: [  OK  ]
iptables: Applying firewall rules: [  OK  ]
iptables: Saving firewall rules to /etc/sysconfig/iptables: [  OK  ]
iptables: Setting chains to policy ACCEPT: filter [  OK  ]
iptables: Flushing firewall rules: [  OK  ]
iptables: Unloading modules: [  OK  ]
iptables: Applying firewall rules: [  OK  ]
iptables: Saving firewall rules to /etc/sysconfig/iptables: [  OK  ]
iptables: Setting chains to policy ACCEPT: filter [  OK  ]
iptables: Flushing firewall rules: [  OK  ]
iptables: Unloading modules: [  OK  ]
iptables: Applying firewall rules: [  OK  ]
success!