Linux访问权限控制及时间同步实践

1、编写脚本/root/bin/checkip.sh，每5分钟检查一次，如果发现通过ssh登录失败次数超过10次，自动将此远程IP放入Tcp Wrapper的黑名单中予以禁止防问

方式一：脚本+定时任务

　　1）编写脚本

[root@test ~]#cat checkip.sh
#!/bin/bash
#
#************************************************************************
#Author:                qiuhom
#QQ:                    467697313
#mail:                  qiuhom467697313@qq.com
#Date:                  2019-12-22
#FileName：             checkip.sh
#URL:                   https://www.cnblogs.com/qiuhom-1874/
#Description：
#Copyright (C):        2019 All rights reserved
#************************************************************************
 
[ $UID -ne 0 ]&&echo "this script must root run it " && exit 1
if [[ ! -e "/work" ]]; then
        mkdir /work
fi
cmd=`cat /var/log/secure|grep "Failed password for qiuhom"|awk '{print $(NF-3)}'|sort|uniq -c|awk '{print $2"==>"$1}'`
 
echo "$cmd">/work/ip.txt
 
for i in `cat /work/ip.txt`
    do
        ip=`echo "$i"|awk -F "==>" '{print $1}'`
        count=`echo "$i"|awk -F "==>" '{print $2}'`
        if [ $count -gt 10 ];then
           xx=`grep $ip /etc/hosts.deny |wc -l`
           if [ $xx == 0 ];then
               echo "ALL:$ip" >> /etc/hosts.deny
           fi
        fi
    done
 
[root@test ~]#

说明：此脚本主要思想是通过日志来过滤出登录失败的用户，然后取出其ip地址，统计其ip出现的次数，如果登录失败10次，则把其ip放入/etc/hosts.deny（TCP Warpper的黑名单）中将其ip禁用。

　　2）指定计划任务

[root@test ~]#crontab -l
*/5 * * * * bash /root/bin/checkip.sh &> /dev/null

方式二：脚本方式，死循环加sleep 来控制执行时长周期

[root@test ~]#cat checkip.sh
#!/bin/bash
#
#************************************************************************
#Author:                qiuhom
#QQ:                    467697313
#mail:                  qiuhom467697313@qq.com
#Date:                  2019-12-22
#FileName：             checkip.sh
#URL:                   https://www.cnblogs.com/qiuhom-1874/
#Description：
#Copyright (C):        2019 All rights reserved
#************************************************************************
 
[ $UID -ne 0 ]&&echo "this script must root run it " && exit 1
 
if [[ ! -e "/work" ]]; then
        mkdir /work
fi
 
while true
do
    sleep 300
 
    cmd=`cat /var/log/secure|grep "Failed password for qiuhom"|awk '{print $(NF-3)}'|sort|uniq -c|awk '{print $2"==>"$1}'`
 
    echo "$cmd">/work/ip.txt
 
　  for i in `cat /work/ip.txt`
        do
            ip=`echo "$i"|awk -F "==>" '{print $1}'`
            count=`echo "$i"|awk -F "==>" '{print $2}'`
            if [ $count -gt 10 ];then
               xx=`grep $ip /etc/hosts.deny |wc -l`
               if [ $xx == 0 ];then
                   echo "ALL:$ip" >> /etc/hosts.deny
               fi
            fi
        done
done
 
[root@test ~]#

2、配置magedu用户的sudo权限，允许magedu用户拥有root权限

方式一：将magedu用户加入到wheel组中，不改动其/etc/sudoers文件

[root@test ~]#id magedu
uid=1004(magedu) gid=1004(magedu) 组=1004(magedu)
[root@test ~]#
[root@test ~]#id magedu
uid=1004(magedu) gid=1004(magedu) 组=1004(magedu)
[root@test ~]#su - magedu
上一次登录：日 12月 22 13:52:50 CST 2019pts/0 上
[magedu@test ~]$cat /etc/sudoers
cat: /etc/sudoers: 权限不够
[magedu@test ~]$su -
密码：
上一次登录：日 12月 22 13:26:01 CST 2019pts/0 上
[root@test ~]#usermod -aG wheel magedu
[root@test ~]#id magedu
uid=1004(magedu) gid=1004(magedu) 组=1004(magedu),10(wheel)
[root@test ~]#su - magedu
上一次登录：日 12月 22 13:55:04 CST 2019pts/0 上
[magedu@test ~]$cat /etc/sudoers
cat: /etc/sudoers: 权限不够
[magedu@test ~]$sudo cat /etc/sudoers
## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.
##
## Examples are provided at the bottom of the file for collections
## of related commands, which can then be delegated out to particular
## users or groups.
##
## This file must be edited with the 'visudo' command.
 
## Host Aliases
## Groups of machines. You may prefer to use hostnames (perhaps using
## wildcards for entire domains) or IP addresses instead.
# Host_Alias     FILESERVERS = fs1, fs2
# Host_Alias     MAILSERVERS = smtp, smtp2
 
## User Aliases
## These aren't often necessary, as you can use regular groups
## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname
## rather than USERALIAS
# User_Alias ADMINS = jsmith, mikem
 
## Command Aliases
## These are groups of related commands...
 
## Networking
# Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool
 
## Installation and management of software
# Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
 
## Services
# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig, /usr/bin/systemctl start, /usr/bin/systemctl stop, /usr/bin/systemctl reload, /usr/bin/systemctl restart, /usr/bin/systemctl status, /usr/bin/systemctl enable, /usr/bin/systemctl disable
 
## Updating the locate database
# Cmnd_Alias LOCATE = /usr/bin/updatedb
 
## Storage
# Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
 
## Delegating permissions
# Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp 
 
## Processes
# Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall
 
## Drivers
# Cmnd_Alias DRIVERS = /sbin/modprobe
 
# Defaults specification
 
#
# Refuse to run if unable to disable echo on the tty.
#
Defaults   !visiblepw
 
#
# Preserving HOME has security implications since many programs
# use it when searching for configuration files. Note that HOME
# is already set when the the env_reset option is enabled, so
# this option is only effective for configurations where either
# env_reset is disabled or HOME is present in the env_keep list.
#
Defaults    always_set_home
Defaults    match_group_by_gid
 
# Prior to version 1.8.15, groups listed in sudoers that were not
# found in the system group database were passed to the group
# plugin, if any. Starting with 1.8.15, only groups of the form
# %:group are resolved via the group plugin by default.
# We enable always_query_group_plugin to restore old behavior.
# Disable this option for new behavior.
Defaults    always_query_group_plugin
 
Defaults    env_reset
Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS"
Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
 
#
# Adding HOME to env_keep may enable a user to run unrestricted
# commands via sudo.
#
# Defaults   env_keep += "HOME"
 
Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin
 
## Next comes the main part: which users can run what software on
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:
##
##      user    MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
qiuhom  ALL=(ALL)        ALL
 
## Allows members of the 'sys' group to run networking, software,
## service management apps and more.
# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS
 
## Allows people in group wheel to run all commands
%wheel  ALL=(ALL)       ALL
 
## Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL
 
## Allows members of the users group to mount and unmount the
## cdrom as root
# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom
 
## Allows members of the users group to shutdown this system
# %users  localhost=/sbin/shutdown -h now
 
## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d
[magedu@test ~]$

说明：此方式能行的原因是/etc/sudoers文件中配置了wheel组允许在其组里的成员运行所有命令

方式二：将magedu用户配置成能够代替root用户做任何事情

[magedu@test ~]$su -
密码：
上一次登录：日 12月 22 13:55:26 CST 2019pts/0 上
[root@test ~]#usermod  -G magedu magedu
[root@test ~]#id magedu
uid=1004(magedu) gid=1004(magedu) 组=1004(magedu)
[root@test ~]#echo "magedu ALL=(root) ALL" >> /etc/sudoers
[root@test ~]#tail /etc/sudoers
## Allows members of the users group to mount and unmount the
## cdrom as root
# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom
 
## Allows members of the users group to shutdown this system
# %users  localhost=/sbin/shutdown -h now
 
## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d
magedu ALL=(root) ALL
[root@test ~]#su - magedu
上一次登录：日 12月 22 13:55:49 CST 2019pts/0 上
[magedu@test ~]$cat /etc/sudoers
cat: /etc/sudoers: 权限不够
[magedu@test ~]$sudo cat /etc/sudoers
[sudo] magedu 的密码：
## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.
##
## Examples are provided at the bottom of the file for collections
## of related commands, which can then be delegated out to particular
## users or groups.
##
## This file must be edited with the 'visudo' command.
 
## Host Aliases
## Groups of machines. You may prefer to use hostnames (perhaps using
## wildcards for entire domains) or IP addresses instead.
# Host_Alias     FILESERVERS = fs1, fs2
# Host_Alias     MAILSERVERS = smtp, smtp2
 
## User Aliases
## These aren't often necessary, as you can use regular groups
## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname
## rather than USERALIAS
# User_Alias ADMINS = jsmith, mikem
 
## Command Aliases
## These are groups of related commands...
 
## Networking
# Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool
 
## Installation and management of software
# Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
 
## Services
# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig, /usr/bin/systemctl start, /usr/bin/systemctl stop, /usr/bin/systemctl reload, /usr/bin/systemctl restart, /usr/bin/systemctl status, /usr/bin/systemctl enable, /usr/bin/systemctl disable
 
## Updating the locate database
# Cmnd_Alias LOCATE = /usr/bin/updatedb
 
## Storage
# Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
 
## Delegating permissions
# Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp 
 
## Processes
# Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall
 
## Drivers
# Cmnd_Alias DRIVERS = /sbin/modprobe
 
# Defaults specification
 
#
# Refuse to run if unable to disable echo on the tty.
#
Defaults   !visiblepw
 
#
# Preserving HOME has security implications since many programs
# use it when searching for configuration files. Note that HOME
# is already set when the the env_reset option is enabled, so
# this option is only effective for configurations where either
# env_reset is disabled or HOME is present in the env_keep list.
#
Defaults    always_set_home
Defaults    match_group_by_gid
 
# Prior to version 1.8.15, groups listed in sudoers that were not
# found in the system group database were passed to the group
# plugin, if any. Starting with 1.8.15, only groups of the form
# %:group are resolved via the group plugin by default.
# We enable always_query_group_plugin to restore old behavior.
# Disable this option for new behavior.
Defaults    always_query_group_plugin
 
Defaults    env_reset
Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS"
Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
 
#
# Adding HOME to env_keep may enable a user to run unrestricted
# commands via sudo.
#
# Defaults   env_keep += "HOME"
 
Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin
 
## Next comes the main part: which users can run what software on
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:
##
##      user    MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
qiuhom  ALL=(ALL)        ALL
 
## Allows members of the 'sys' group to run networking, software,
## service management apps and more.
# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS
 
## Allows people in group wheel to run all commands
%wheel  ALL=(ALL)       ALL
 
## Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL
 
## Allows members of the users group to mount and unmount the
## cdrom as root
# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom
 
## Allows members of the users group to shutdown this system
# %users  localhost=/sbin/shutdown -h now
 
## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d
magedu ALL=(root) ALL
[magedu@test ~]$

说明：以上方式就是把magedu用户配置成能够以root身份执行所有命令
4、配置chrony服务，实现服务器时间自动同步

　　1）安装chrony服务

yum install chrony -y

说明：ntp作为时间同步的服务器软件和客户端软件它都必须运行成守护进程，用ntp作为服务器软件有个缺陷就是同步时间周期很长，所以此实验是chrony作为客户端软件和服务器软件，它比ntp更加精准，其同步周期较短。

　　2）配置chrony.conf 允许其运行为时间服务器并允许内网网段来同步时间并启动服务

[root@test ~]#cat /etc/chrony.conf
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
#server 0.centos.pool.ntp.org iburst
#server 1.centos.pool.ntp.org iburst
#server 2.centos.pool.ntp.org iburst
server 3.centos.pool.ntp.org iburst
 
# Record the rate at which the system clock gains/losses time.
driftfile /var/lib/chrony/drift
 
# Allow the system clock to be stepped in the first three updates
# if its offset is larger than 1 second.
makestep 1.0 3
 
# Enable kernel synchronization of the real-time clock (RTC).
rtcsync
 
# Enable hardware timestamping on all interfaces that support it.
#hwtimestamp *
 
# Increase the minimum number of selectable sources required to adjust
# the system clock.
#minsources 2
 
# Allow NTP client access from local network.
allow 192.168.0.0/16
 
# Serve time even if not synchronized to a time source.
#local stratum 10
 
# Specify file containing keys for NTP authentication.
#keyfile /etc/chrony.keys
 
# Specify directory for log files.
logdir /var/log/chrony
 
# Select which information is logged.
#log measurements statistics tracking
[root@test ~]#

说明：server：时间服务器地址，allow后面跟允许客户端地址/子网掩码或者直接配置成allow all 则表示允许所有客户端来同步时间

systemctl start chronyd

说明：启动chronyd服务后，此时就可以用该服务器作为时间同步服务器，我们可以用chronyc这个工具来查看当前的时间服务器上从那个服务器同步时间的；chronyd默认监听在UDP的123端口和323端口

[root@test ~]#ss -nulp
State       Recv-Q Send-Q             Local Address:Port                            Peer Address:Port
UNCONN      0      0                              *:123                                        *:*                   users:(("chronyd",pid=17074,fd=7))
UNCONN      0      0                      127.0.0.1:323                                        *:*                   users:(("chronyd",pid=17074,fd=5))
UNCONN      0      0                            ::1:323                                       :::*                   users:(("chronyd",pid=17074,fd=6))
[root@test ~]#

[root@test ~]#chronyc sources -v
210 Number of sources = 1
 
  .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
 / .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| /   '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
||                                                 .- xxxx [ yyyy ] +/- zzzz
||      Reachability register (octal) -.           |  xxxx = adjusted offset,
||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
||                                \     |          |  zzzz = estimated error.
||                                 |    |           \
MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================
^* sv1.ggsrv.de                  2   7   377    10   -361us[ -538us] +/-  128ms
[root@test ~]#chronyc sourcestats -v
210 Number of sources = 1
                             .- Number of sample points in measurement set.
                            /    .- Number of residual runs with same sign.
                           |    /    .- Length of measurement set (time).
                           |   |    /      .- Est. clock freq error (ppm).
                           |   |   |      /           .- Est. error in freq.
                           |   |   |     |           /         .- Est. offset.
                           |   |   |     |          |          |   On the -.
                           |   |   |     |          |          |   samples. \
                           |   |   |     |          |          |             |
Name/IP Address            NP  NR  Span  Frequency  Freq Skew  Offset  Std Dev
==============================================================================
sv1.ggsrv.de               22  12   22m     -0.040      2.784   -937ns  1441us
[root@test ~]#

说明：可以看到当前chrony作为客户端是从互联网sv1.ggsrv.de服务器上同步时间的；chronyc 是一个交互工具，它可查看时间服务器的状态以及管理实践服务器，它有很多子命令，其帮助信息可以通过chronyc help 命令查看

　　3）配置客户端，并指定其服务器地址为刚才我们搭建的时间服务器地址

[root@test ~]#yum info chrony
Loaded plugins: fastestmirror, security
Determining fastest mirrors
 * base: mirrors.aliyun.com
 * extras: mirrors.aliyun.com
 * updates: mirrors.aliyun.com
base                                                                                          | 3.7 kB     00:00
epel                                                                                          | 5.3 kB     00:00
epel/primary_db                                                                               | 6.1 MB     00:01
extras                                                                                        | 3.4 kB     00:00
extras/primary_db                                                                             |  29 kB     00:00
updates                                                                                       | 3.4 kB     00:00
updates/primary_db                                                                            | 7.5 MB     00:02
Available Packages
Name        : chrony
Arch        : x86_64
Version     : 2.1.1
Release     : 2.el6_8
Size        : 266 k
Repo        : base
Summary     : An NTP client/server
URL         : http://chrony.tuxfamily.org
License     : GPLv2
Description : A client/server for the Network Time Protocol, this program keeps your
            : computer's clock accurate. It was specially designed to support
            : systems with intermittent internet connections, but it also works well
            : in permanently connected environments. It can use also hardware reference
            : clocks, system real-time clock or manual input as time references.
 
[root@test ~]#yum install chrony -y
Loaded plugins: fastestmirror, security
Setting up Install Process
Loading mirror speeds from cached hostfile
   base: mirrors.aliyun.com
 * extras: mirrors.aliyun.com
 * updates: mirrors.aliyun.com
Resolving Dependencies
There are unfinished transactions remaining. You might consider running yum-complete-transaction first to finish them.
--> Running transaction check
---> Package chrony.x86_64 0:2.1.1-2.el6_8 will be installed
--> Finished Dependency Resolution
 
Dependencies Resolved
 
=====================================================================================================================
 Package                   Arch                      Version                           Repository               Size
=====================================================================================================================
Installing:
 chrony                    x86_64                    2.1.1-2.el6_8                     base                    266 k
 
Transaction Summary
=====================================================================================================================
Install       1 Package(s)
 
Total download size: 266 k
Installed size: 453 k
Downloading Packages:
chrony-2.1.1-2.el6_8.x86_64.rpm                                                               | 266 kB     00:00
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing : chrony-2.1.1-2.el6_8.x86_64                                                                       1/1
  Verifying  : chrony-2.1.1-2.el6_8.x86_64                                                                       1/1 
 
Installed:
  chrony.x86_64 0:2.1.1-2.el6_8                                                                                      
 
Complete!
[root@test ~]#vim /etc/chrony.conf
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
#server 0.rhel.pool.ntp.org iburst
#server 1.rhel.pool.ntp.org iburst
#server 2.rhel.pool.ntp.org iburst
#server 3.rhel.pool.ntp.org iburst
server 192.168.0.99
# Ignore stratum in source selection.
stratumweight 0
 
# Record the rate at which the system clock gains/losses time.
driftfile /var/lib/chrony/drift
 
# In first three updates step the system clock instead of slew
# if the adjustment is larger than 10 seconds.
makestep 10 3
 
# Enable kernel synchronization of the real-time clock (RTC).
rtcsync
 
# Allow NTP client access from local network.
#allow 192.168/16
 
# Serve time even if not synchronized to any NTP server.
#local stratum 10
 
# Specify file containing keys for NTP and command authentication.
keyfile /etc/chrony.keys
 
# Specify key number for command authentication.
commandkey 1
 
# Generate new command key on start if missing.
generatecommandkey
 
# Disable logging of client accesses.
noclientlog
 
# Send message to syslog when clock adjustment is larger than 0.5 seconds.
"/etc/chrony.conf" 46L, 1272C written
[root@test ~]#

说明：客户机上也需要安装chrony软件和运行其服务，当然客户端也可以安装ntp软件包，用ntpdate 加时间服务器地址来同步时间；用ntpdate + 时间服务器地址同步时间简单粗暴，这种方式同步时间实际上是将服务器时间跳到当前时间，中间有一段空白段，强烈不建议这样同步时间。

[root@test ~]#date
Thu Dec 12 12:14:08 CST 2019
[root@test ~]#chronyc sources
210 Number of sources = 1
MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================
^* 192.168.0.99                  3   6    17     3    -21us[-14582m] +/-  131ms
[root@test ~]#date
Sun Dec 22 15:16:15 CST 2019

[root@test ~]#date -s "20191212 12:12:00"
Thu Dec 12 12:12:00 CST 2019
[root@test ~]#date
Thu Dec 12 12:12:02 CST 2019
[root@test ~]#ntpdate 192.168.0.99
22 Dec 15:18:15 ntpdate[3911]: step time server 192.168.0.99 offset 875161.922491 sec
[root@test ~]#date
Sun Dec 22 15:18:17 CST 2019
[root@test ~]#

5、实现cobbler+pxe自动化装机

详情请参考本人博客https://www.cnblogs.com/qiuhom-1874/p/12081310.html

Linux访问权限控制及时间同步实践的更多相关文章

IAM：亚马逊访问权限控制
IAM的策略.用户->服务器(仓库.业务体) IAM:亚马逊访问权限控制(AWS Identity and Access Management )IAM使您能够安全地控制用户对 AWS 服务和资 ...
MongoDB 安全和访问权限控制
MongoDB的访问控制能够有效保证数据库的安全,访问控制是指绑定Application监听的IP地址,设置监听端口,使用账户和密码登录一,访问控制的参数 1,绑定IP地址 mongod 参数:-- ...
(转)浅析Java中的访问权限控制
原文地址: http://www.cnblogs.com/dolphin0520/p/3734915.html 今天我们来一起了解一下Java语言中的访问权限控制.在讨论访问权限控制之前,先来讨论一下 ...
使用nginx和iptables做访问权限控制（IP和MAC）
之前配置的服务器,相当于对整个内网都是公开的而且,除了可以通过80端口的nginx来间接访问各项服务,也可以绕过nginx,直接ip地址加端口访问对应服务这是不对的啊,所以我们要做一些限制因为只 ...
[THINKING IN JAVA]访问权限控制
6 访问权限控制 6.1 包:库单元 package.import.import *.import static: 修改classpath环境变量可以将自己写的类库添加至环境变量并在任何java程序中 ...
Java成员的访问权限控制
Java中的访问权限控制包含两个部分: 类的访问权限控制类成员的访问权限控制对类来说,访问权限控制修饰符可以是public或者无修饰符(默认的包访问权限): 对于类成员来说,访问权限控制修饰符可以 ...
浅析Java中的访问权限控制
浅析Java中的访问权限控制今天我们来一起了解一下Java语言中的访问权限控制.在讨论访问权限控制之前,先来讨论一下为何需要访问权限控制.考虑两个场景: 场景1:工程师A编写了一个类ClassA,但 ...
redis密码设置、访问权限控制等安全设置
redis作为一个高速数据库,在互联网上,必须有对应的安全机制来进行保护,方法有2,如下. 1.比较安全的办法是采用绑定IP的方式来进行控制. 请在redis.conf文件找到如下配置 # If y ...
JAVA访问权限控制[zhuan]
Java的访问权限控制修饰符,从最大权限到最小权限依次是:public.protected.包访问权限(默认,没有关键字)和private.对于类的访问权限只能是:public和包访问权限(但内部类可 ...

随机推荐

css3让元素自适应高度
知识点: viewport:可视窗口,也就是浏览器.vw Viewport宽度, 1vw 等于viewport宽度的1%vh Viewport高度, 1vh 等于viewport高的的1% calc( ...
linux入门系列7--管道符、重定向、环境变量
前面文章我们学习了linux基础命令,如果将不同命令组合使用则可以成倍提高工作效率.本文将学习重定向.管道符.通配符.转义符.以及重要的环境变量相关知识,为后面的shell编程打下基础. 一.IO重定 ...
【PCIE-3】---PCIE设备的枚举扫描（经典好文）
前面两个小节大致总结了下PCIE的基本知识,算是扫盲篇吧.本文主要总结PCIE设备的枚举扫描过程,此部分才是PCIE模块的重点,无论是在BIOS下还是系统驱动下都会用到. 按照国际惯例,先列问题: 1 ...
为什么说ArrayList是线程不安全的？
一.概述对于ArrayList,相信大家并不陌生.这个类是我们平时接触得最多的一个列表集合类. 面试时相信面试官首先就会问到关于它的知识.一个经常被问到的问题就是:ArrayList是否是线程安全的 ...
django 建立安全索引
上篇记录使用“CONCURRENTLY” 命令行执行不锁表索引,对于django, 如何执行呢?这里记录一种方法,修改django迁移文件. 在执行完迁移后,为了方便找到该迁移文件,可以采用指定命名迁 ...
使用vscode运行python出现中文乱码的解决方法
前提:自己安装了code runner的插件快捷键Ctrl+Shift+P,打开设置Open Settings (JSON):
Nginx配置文件模板
主配置文件nginx.conf user nginx; #设置nginx服务的系统使用用户 worker_processes 1; #工作进程数(和cpu核心数保持一致) error_log /var ...
python __init__()类构造方法
构造方法用于创建对象时使用,每当创建一个类的实例对象时,python解释器都会自动调用它. class Person: def __init__(self): print("调用构造方法&q ...
第二阶段冲刺个人任务——four
今日任务: 优化统计团队博客结果界面的显示. 昨日成果: 优化统计个人博客结果页面的显示.
【java面试】java和C/C++的区别
1.内存分配 java中对内存的分配是动态的,JVM自动对内存进行扫描,对长期不用的空间作为"垃圾"进行收集,使得系统资源得到更充分地利用.按照这种机制,程序员不必关注内存管理问题 ...

Linux访问权限控制及时间同步实践

Linux访问权限控制及时间同步实践的更多相关文章

随机推荐

热门专题