linux批量配置iptables防火墙【expect】

比眉伴天荒 2022-10-14 12:54 398阅读 0赞

### 文章目录 ###

*  前提准备
 *   *  环境说明
     *  iptebls的rpm包准备和安装
     *  iptables配置
 *  rpm包和文件拷贝
 *   *  代码
     *  执行效果
 *  安装和启动服务
 *   *  代码
     *  执行效果

# 前提准备 #

## 环境说明 ##

*  我的镜像挂载ip：`192.168.59.133`
 *  脚本执行IP：`192.168.59.133`
 *  测试机器：`192.168.59.128-130`

## iptebls的rpm包准备和安装 ##

*  服务器上的镜像必须挂载【后面所有服务器均从这用scp拷贝这个镜像rpm包】
 *  iptables安装很简单，一个包就可以了，在主服务器上上传一台和当前系统一致的镜像，进到镜像中的`Packages`目录中，会有一个iptables-services的包，我们直接`rpm -ivh`安装这个包就可以了，安装完毕以后就会自动生成iptables的目录文件了，路径为：`/etc/sysconfig/iptables`

[root@controll Packages]# pwd
    /home/centos/Packages
    [root@controll Packages]# ls | grep iptables-servi
    iptables-services-1.4.21-28.el7.x86_64.rpm
    [root@controll Packages]# yum -y install iptables-services-1.4.21-28.el7.x86_64.rpm
    # 安装完毕以后就会自动生成iptables的目录文件了
    [root@controll ccx]# cat /etc/sysconfig/iptables
    # sample configuration for iptables service
    # you can edit this manually or use system-config-firewall
    # please do not ask us to add additional ports/services to this default configuration
    *filter
    :INPUT ACCEPT [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A INPUT -p icmp -j ACCEPT
    -A INPUT -i lo -j ACCEPT
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
    -A INPUT -j REJECT --reject-with icmp-host-prohibited
    -A FORWARD -j REJECT --reject-with icmp-host-prohibited
    COMMIT

## iptables配置 ##

*  iptables的配置是文件写入内容，路径为：`/etc/sysconfig/iptables`
 *  主服务器配置完毕iptables策略【后面所有服务器策略直接拷贝这个文件即可】
 *  当前配置文件内容如下【因为我是在测试机上做的，所以配置信息就没有策略】

[root@controll Packages]# tail -n 5 /etc/sysconfig/iptables
    # test iptables1
    # test iptables2
    # test iptables3
    # test iptables4
    # test iptables5
    [root@controll Packages]#

# rpm包和文件拷贝 #

## 代码 ##

*  其实`/etc/sysconfig/iptables`安装iptables后自动生成，但我们手动直接拷贝也无所谓的。
 *  拷贝这个还是建议单独放在一台连接过所有服务器的IP上执行【否则每次连接会出现第一次连接的提示，让输入yes，这样不仅达不到自动化的意义，还容易导致夯住（屏幕一直打印`y`）】

[root@controll ccx]# cat iptable.sh 
    #!/bin/bash
    if [ $# -eq 0 ] ;then
            echo "Usage: /ccx/iplist.txt"
            elif [ -f $1 ] ; then
                    for ip in `cat $1` ; do
                    #下面rpm包的路径自定义的啊
                    scp /home/centos/Packages/iptables-services-1.4.21-28.el7.x86_64.rpm $ip:/root
                    # 文件拷贝这个是固定格式
                    scp /etc/sysconfig/iptables $ip:/etc/sysconfig/iptables
                    done
            else
                    echo "Input file not found"
    fi
    
    [root@controll ccx]# # 下面这个文件用来放IP，一行一个
    [root@controll ccx]# cat iplist1.txt 
    192.168.59.128
    192.168.59.129
    192.168.59.130
    [root@controll ccx]#

## 执行效果 ##

*  执行方式：`sh iptable.sh iplist1.txt`
 *  如果没有设置免密，需要每次都输入密码，一台服务器2次

[root@controll ccx]# sh iptable.sh iplist1.txt 
    root@192.168.59.128's password: iptables-services-1.4.21-28.el7.x86_64.rpm 100% 52KB 15.9MB/s 00:00 root@192.168.59.128's password: 
    iptables                                                                                                                          100%  636   505.7KB/s   00:00    
    root@192.168.59.129's password: iptables-services-1.4.21-28.el7.x86_64.rpm 100% 52KB 15.7MB/s 00:00 root@192.168.59.129's password: 
    iptables                                                                                                                          100%  636   561.4KB/s   00:00    
    root@192.168.59.130's password: iptables-services-1.4.21-28.el7.x86_64.rpm 100% 52KB 3.8MB/s 00:00 root@192.168.59.130's password: 
    iptables                                                                                                                          100%  636   484.7KB/s   00:00    
    [root@controll ccx]#

# 安装和启动服务 #

## 代码 ##

\-注：expect调用的脚本，IP文件中不能有空白行【不影响结果，但有类似报错的内容产生】

[root@controll ccx]# cat expect.sh
    
    #!/bin/bash
    # 这定义ip文件 格式为： IP 密码
    file=/ccx/iplist.txt
    
    cat $file|while read line
    do
    a=($line)    
    /usr/bin/expect<<EOF spawn ssh root@${a[0]} expect { "*yes/no" { send "yes\r"; exp_continue} "*password:" { send "${a[1]}\r" } } expect "#" #send "scp 192.168.59.133:/home/centos/Packages/iptables-services-1.4.21-28.el7.x86_64.rpm /root\r" send "rpm -ivh /root/iptables-services-1.4.21-34.el7.x86_64.rpm\r" #send "scp 192.168.59.133:/etc/sysconfig/iptables /etc/sysconfig/iptables\r" send "tail -n 5 /etc/sysconfig/iptables\r" send "rpm -qa | grep iptable\r" send "systemctl restart iptables.service\r" send "exit\r" expect eof EOF
    done
    [root@controll ccx]# cat iplist.txt 
    192.168.59.128 root
    192.168.59.129 root
    192.168.59.130 root
    [root@controll ccx]#

*  如果把rpm包和文件拷贝放这里面执行，就会产生下面这种死循环，所以单独拷贝最为稳妥。  
    ![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N1aWNob25neGlu_size_16_color_FFFFFF_t_70]

## 执行效果 ##

*  执行方式：`sh expect.sh`
 *  因为ip文件中定义了密码，所以不需要输入密码了  
    注：rpm安装过程要有并且重启iptables过程没有报错才行。

[root@controll ccx]# sh expect.sh 
    spawn ssh root@192.168.59.128
    root@192.168.59.128's password: Last login: Sat May 22 01:18:19 2021 from 192.168.59.133 [root@centso76_1 ~]# rpm -ivh /root/iptables-services-1.4.21-28.el7.x86_64.rpm 警告：/root/iptables-services-1.4.21-28.el7.x86_64.rpm: 头V3 RSA/SHA256 Signature, 密钥 ID f4a80eb5: NOKEY 准备中... ################################# [100%] 正在升级/安装... 1:iptables-services-1.4.21-28.el7 警告：/etc/sysconfig/iptables 已建立为 /etc/sysconfig/iptables.rpmnew ################################# [100%] [root@centso76_1 ~]# tail -n 5 /etc/sysconfig/iptables # test iptables1 # test iptables2 # test iptables3 # test iptables4 # test iptables5 [root@centso76_1 ~]# rpm -qa | grep iptable iptables-1.4.21-28.el7.x86_64 iptables-services-1.4.21-28.el7.x86_64 [root@centso76_1 ~]# systemctl restart iptables.service [root@centso76_1 ~]# exit 登出 Connection to 192.168.59.128 closed. spawn ssh root@192.168.59.129 root@192.168.59.129's password: 
    Last login: Fri May 21 05:29:31 2021 from 192.168.59.133
    [root@centos76_2 ~]# rpm -ivh /root/iptables-services-1.4.21-28.el7.x86_64.rpm
    warning: /root/iptables-services-1.4.21-28.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
    Preparing...                          ################################# [100%]
    Updating / installing...
       1:iptables-services-1.4.21-28.el7  warning: /etc/sysconfig/iptables created as /etc/sysconfig/iptables.rpmnew
    ################################# [100%]
    [root@centos76_2 ~]# tail -n 5 /etc/sysconfig/iptables
    # test iptables1
    # test iptables2
    # test iptables3
    # test iptables4
    # test iptables5
    [root@centos76_2 ~]# rpm -qa | grep iptable
    iptables-1.4.21-28.el7.x86_64
    iptables-services-1.4.21-28.el7.x86_64
    [root@centos76_2 ~]# systemctl restart iptables.service
    [root@centos76_2 ~]# exit
    logout
    Connection to 192.168.59.129 closed.
    spawn ssh root@192.168.59.130
    root@192.168.59.130's password: 
    Last login: Fri May 21 17:23:26 2021 from 192.168.59.133
    [root@centos76_3 ~]# rpm -ivh /root/iptables-services-1.4.21-28.el7.x86_64.rpm
    warning: /root/iptables-services-1.4.21-28.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
    Preparing...                          ################################# [100%]
    Updating / installing...
       1:iptables-services-1.4.21-28.el7  warning: /etc/sysconfig/iptables created as /etc/sysconfig/iptables.rpmnew
    ################################# [100%]
    [root@centos76_3 ~]# tail -n 5 /etc/sysconfig/iptables
    # test iptables1
    # test iptables2
    # test iptables3
    # test iptables4
    # test iptables5
    [root@centos76_3 ~]# rpm -qa | grep iptable
    iptables-1.4.21-28.el7.x86_64
    iptables-services-1.4.21-28.el7.x86_64
    [root@centos76_3 ~]# systemctl restart iptables.service
    [root@centos76_3 ~]# exit
    logout
    Connection to 192.168.59.130 closed.
    [root@controll ccx]#

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N1aWNob25neGlu_size_16_color_FFFFFF_t_70]: /images/20221014/dfa1fd7598f347a5a2baefd1911f1e3a.png