一种通过DHCP+DNS服务器对内网DHCP客户端进行定向柔性非侵入式劫持的方法 架构图 在我的环境中，由于没有实施严格的网络准入配置，且前期没有全面覆盖EDR，导致出现了一种神奇的现象，态势感知系统检测到某IP中毒，查找主机名资产中查不到，并且主机只在晚上上线，无法定位物理机的实际位置；如果直接断网，可能会引起客户投诉，那么有没有一种柔性的方法解决这个非技术问题呢？有的；在本方法中，可以通过DHCP绑定，固定目标客户端请求的IP，固定后单独设置DNS服务器地址，并且自行架设DNS服务器，将所有请求进行重定向；当目标客户端上网时，任意网站请求均会重定向至拦截页面，拦截页面为http服务器+自定义html页面，方便用户联系处理。预览 目标客户端访问任意网站，均出现拦截提醒。配置 配置DNS服务器https://90apt.com/4048配置DHCP服务器1、为目标保留指定IP2、为目标保留的IP配置独立DNS，目标再次DHCP续约时，DNS地址将被替换3、配置HTTP服务器，监听*域名，同时监听https端口总结 简单实用，用户抵触度低。

Python 实现DNS服务器(Python域名解析服务器) 版权声明：本文为CSDN博主「RobinTang」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。原文链接：https://blog.csdn.net/trbbadboy/article/details/8093256''' Created on 2012-10-15 @author: RobinTang ''' import socketserver import struct # DNS Query class SinDNSQuery: def __init__(self, data): i = 1 self.name = '' while True: d = data[i] if d == 0: break; if d < 32: self.name = self.name + '.' else: self.name = self.name + chr(d) i = i + 1 self.querybytes = data[0:i + 1] (self.type, self.classify) = struct.unpack('>HH', data[i + 1:i + 5]) self.len = i + 5 def getbytes(self): return self.querybytes + struct.pack('>HH', self.type, self.classify) # DNS Answer RRS # this class is also can be use as Authority RRS or Additional RRS class SinDNSAnswer: def __init__(self, ip): self.name = 49164 self.type = 1 self.classify = 1 self.timetolive = 190 self.datalength = 4 self.ip = ip def getbytes(self): res = struct.pack('>HHHLH', self.name, self.type, self.classify, self.timetolive, self.datalength) s = self.ip.split('.') res = res + struct.pack('BBBB', int(s[0]), int(s[1]), int(s[2]), int(s[3])) return res # DNS frame # must initialized by a DNS query frame class SinDNSFrame: def __init__(self, data): (self.id, self.flags, self.quests, self.answers, self.author, self.addition) = struct.unpack('>HHHHHH', data[0:12]) self.query = SinDNSQuery(data[12:]) def getname(self): return self.query.name def setip(self, ip): self.answer = SinDNSAnswer(ip) self.answers = 1 self.flags = 33152 def getbytes(self): res = struct.pack('>HHHHHH', self.id, self.flags, self.quests, self.answers, self.author, self.addition) res = res + self.query.getbytes() if self.answers != 0: res = res + self.answer.getbytes() return res # A UDPHandler to handle DNS query class SinDNSUDPHandler(socketserver.BaseRequestHandler): def handle(self): data = self.request[0].strip() dns = SinDNSFrame(data) socket = self.request[1] namemap = SinDNSServer.namemap if(dns.query.type==1): # If this is query a A record, then response it name = dns.getname(); if namemap.__contains__(name): # If have record, response it dns.setip(namemap[name]) socket.sendto(dns.getbytes(), self.client_address) elif namemap.__contains__('*'): # Response default address dns.setip(namemap['*']) socket.sendto(dns.getbytes(), self.client_address) else: # ignore it socket.sendto(data, self.client_address) else: # If this is not query a A record, ignore it socket.sendto(data, self.client_address) # DNS Server # It only support A record query # user it, U can create a simple DNS server class SinDNSServer: def __init__(self, port=53): SinDNSServer.namemap = {} self.port = port def addname(self, name, ip): SinDNSServer.namemap[name] = ip def start(self): HOST, PORT = "0.0.0.0", self.port server = socketserver.UDPServer((HOST, PORT), SinDNSUDPHandler) server.serve_forever() # Now, test it if __name__ == "__main__": sev = SinDNSServer() sev.addname('www.aa.com', '192.168.0.1') # add a A record sev.addname('www.bb.com', '192.168.0.2') # add a A record sev.addname('*', '0.0.0.0') # default address sev.start() # start DNS server # Now, U can use "nslookup" command to test it # Such as "nslookup www.aa.com"

0基础上手python编程，企业微信值班提醒助手 架构图 通过数据库查询并推送值班人员信息，其中allday字段代表24小时值班，24小时值班时8点和17点均进行推送，不填写此字段时只在17点推送。预览 值班人员提醒人员未维护提醒数据库维护，按此格式维护renyuan表zhibanbiao表系统组成 zhibantouch.py 初始化数据库zhiban.py 主程序初始化数据库 首先手动创建库和用户，通过zhibantouch.py初始化，生成表import mysql.connector mqdb = mysql.connector.connect( host="127.0.0.1", user="zhiban", passwd="passwd", database="zhiban" ) mqcursor = mqdb.cursor() mqcursor.execute("CREATE TABLE renyuan (id INT AUTO_INCREMENT PRIMARY KEY,name VARCHAR(255), phone VARCHAR(255))charset=utf8mb4") mqcursor.execute("CREATE TABLE zhibanbiao (id INT AUTO_INCREMENT PRIMARY KEY, time VARCHAR(255), name VARCHAR(255), allday VARCHAR(255))charset=utf8mb4") mqdb.commit() mqcursor.close()初始化后的数据库监控主程序通过定时任务运行zhiban.py主程序定时任务，每天的8:01和17:01执行脚本1 8,17 * * * python3 /root/zhibancheck/zhiban.py 程序代码import requests,time import mysql.connector def check_user(): nowtime = time.strftime("%Y-%m-%d", time.localtime()) mqdb = mysql.connector.connect( host="127.0.0.1", user="zhiban", passwd="passwd", database="zhiban" ) mqcursor = mqdb.cursor() mqcursor.execute("SELECT * FROM zhibanbiao WHERE time = '%s'" % (nowtime)) if mqcursor.fetchall() == []: return None else: mqcursor.execute( "select renyuan.name,renyuan.phone,zhibanbiao.allday from zhibanbiao inner join renyuan on zhibanbiao.name=renyuan.name where zhibanbiao.time='%s'" % ( nowtime)) info = mqcursor.fetchall() return info def post_weixin(data): url = 'https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=用你自己的' body = { "msgtype": "news", "news": { "articles": [ { "title": "值班信息", "description": data, "url": "90apt.com", "picurl": "用你自己的图片" } ] } } headers = {"Content-Type": "application/json"} response = requests.post(url, json=body) print(response.text) print(response.status_code) checkuser = check_user() if time.strftime("%H", time.localtime()) == "8": if checkuser == None: post_weixin("没有维护值班人员信息") elif checkuser[0][2] == "1": post_weixin("今日值班人员 "+checkuser[0][0]+"\n电话："+checkuser[0][1]) else: None elif time.strftime("%H", time.localtime()) == "17": if checkuser == None: post_weixin("没有维护值班人员信息") elif checkuser[0][2] == "1": None else: post_weixin("今晚值班人员 " + checkuser[0][0] + "\n电话：" + checkuser[0][1]) else: print("禁止推送时间")总结 简单

0基础上手python、PHP编程，ActiveMQ监控、报警、查询系统 架构图 通过定时任务采集解析MQ XML数据存储到MYSQL数据库中，当前MQ积累值超过100时，说明消费异常，通过企业微信报警，MQ.php可查询历史记录。预览 告警页面查询页面，显示最后1000行数据系统组成 MQchecktouch.py 初始化数据库MQcheck.py 监控主程序MQ.php 历史记录查询程序初始化数据库 首先手动创建库和用户，通过MQchecktouch.py初始化，生成表import mysql.connector mqdb = mysql.connector.connect( host="127.0.0.1", user="mquser", passwd="mqpasswd", database="mq" ) mqcursor = mqdb.cursor() mqcursor.execute("CREATE TABLE mqdata (id INT AUTO_INCREMENT PRIMARY KEY,time VARCHAR(255), name VARCHAR(255), number VARCHAR(255))") mqcursor.execute("CREATE TABLE configkey (name VARCHAR(255), config VARCHAR(255))") insert_sql = "INSERT INTO configkey (name, config) VALUES ('config','1')" mqcursor.execute(insert_sql) mqdb.commit() mqcursor.close()初始化后的数据库监控主程序 通过定时任务运行主程序import requests,time import xml.etree.cElementTree as ET import mysql.connector def get_mqxml(): mqreq = requests.post(url='http://你的MQ地址:8161/admin/xml/queues.jsp', auth=('admin', 'admin')) mqxml = ET.fromstring(mqreq.content.decode()) mqname_list = [] mqnumbers_list = [] for queue in mqxml.iter('queue'): mqname_list.append(queue.get("name")) mqnumbers_list.append(queue.find('stats').get("size")) return mqname_list,mqnumbers_list def post_weixin(num,mqnumber): if num == 0: data = "6啊，MQ恢复了，当前累计值：" else: data = "G了，MQ当前累计值：" url = 'https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=你自己的企业微信机器人' body = { "msgtype": "news", "news": { "articles": [ { "title": "MQ监控机器人", "description": data+str(mqnumber), "url": "90apt.com", "picurl": "你自己的图片" } ] } } headers = {"Content-Type": "application/json"} response = requests.post(url, json=body) print(response.text) print(response.status_code) def save_mysql(): total = 0 mqdb = mysql.connector.connect( host="127.0.0.1", user="mquser", passwd="mqpasswd", database="mq" ) mqcursor = mqdb.cursor() nowtime = time.asctime() for ele in range(0, len(mqnumbers_list)): sql = "INSERT INTO mqdata (time ,name, number) VALUES (%s, %s, %s)" val = (nowtime, mqname_list[ele], mqnumbers_list[ele]) mqcursor.execute(sql, val) total = total + int(mqnumbers_list[ele]) mqdb.commit() print(total) if total > 10: getconfig_sql = "SELECT * FROM configkey WHERE name ='config'" mqcursor.execute(getconfig_sql) mqconfig = mqcursor.fetchall()[0][1] if mqconfig == "0": updateconfig_sql = "UPDATE configkey SET config = '1' WHERE name = 'config'" mqcursor.execute(updateconfig_sql) mqdb.commit() mqcursor.close() post_weixin(1,total) else: None else: getconfig_sql = "SELECT * FROM configkey WHERE name ='config'" mqcursor.execute(getconfig_sql) mqconfig = mqcursor.fetchall()[0][1] if mqconfig == "1": updateconfig_sql = "UPDATE configkey SET config = '0' WHERE name = 'config'" mqcursor.execute(updateconfig_sql) post_weixin(0, total) mqdb.commit() mqcursor.close() else: None mqname_list = get_mqxml()[0] mqnumbers_list = get_mqxml()[1] save_mysql() 历史记录查询程序<?php $con=mysqli_connect("localhost","mquser","mqpasswd","mq"); // 检测连接 if (mysqli_connect_errno()) { echo "连接失败: " . mysqli_connect_error(); } $result = mysqli_query($con,"SELECT * FROM mqdata order by time desc limit 1,1000"); while($row = mysqli_fetch_array($result)) { echo $row['time'] . " " . $row['name'] . " " . $row['number']; echo "<br>"; } $conn = null; ?>

CentOS 8 官方仓库的 PHP 安装 Redis 扩展 文章来源https://www.vvave.net/archives/how-to-install-php-pecl-redis-on-centos8-official-repo-php.html本文由 柒 创作，采用 知识共享署名4.0 国际许可协议进行许可。转载本站文章前请注明出处，文章作者保留所有权限。最后编辑时间： 2020-03-30 15:19 PM在 CentOS 新版本上部署 LNMP 架构时，因开发环境一直是 PHP 7.2 ，结果发现 C8 系统官方仓库内自带的 PHP 版本就是 7.2 ，后续使用过程中发现缺少部分扩展。官方构建版本中没有 Redis 扩展，因此需要自行编译安装。始切换到工作目录# cd /usr/local/src到官方扩展源中下载源码包小贴士：需要注意的是，扩展的版本和所需依赖的版本和 PHP 版本有关，请自行确定需要的版本。# wget http://pecl.php.net/get/redis-5.2.1.tgz对源码包进行解包# tar xf redis-5.2.1.tgz对本地环境进行检测生成安装配置# phpize小贴士：如果没有找到此命令说明在部署时，只安装了 php-fpm 组件，此命令需要额外安装 php-cli 组件。如果执行时遇到以下报错# phpize Can't find PHP headers in /usr/include/php The php-devel package is required for use of this command.需要补全开发组件# dnf install php-devel正常结果如下# phpize Configuring for: PHP Api Version: 20170718 Zend Module Api No: 20170718 Zend Extension Api No: 320170718然后即可开始编译扩展的库文件# cd redis-5.2.1/ # ./configure --with-php-config=/usr/bin/php-config安装库文件# make install Installing shared extensions: /usr/lib64/php/modules/续接下来的步骤需要注意，需要将扩展的库文件进行注册，以便 PHP 程序对其进行识别和加载先检查是否存在编译后的库文件 (.so)# ls -l /usr/lib64/php/modules/ total 13348 -rwxr-xr-x 1 root root 3363488 Mar 30 15:22 redis.so然后找到系统扩展配置文件# ls -l /etc/php.ini扩展：在其中可以看到配置中将 /etc/php.d/ 中的配置全部加载进了主配置中，因此只需操作子目录加载配置文件即可。# cd /etc/php.d/ # ll total 128 -rw-r--r-- 1 root root 4848 Nov 14 12:04 10-opcache.ini -rw-r--r-- 1 root root 44 Nov 14 12:09 20-bz2.ini -rw-r--r-- 1 root root 54 Nov 14 12:09 20-calendar.ini -rw-r--r-- 1 root root 48 Nov 14 12:09 20-ctype.ini -rw-r--r-- 1 root root 46 Nov 14 12:09 20-curl.ini -rw-r--r-- 1 root root 44 Nov 14 12:09 20-dom.ini -rw-r--r-- 1 root root 46 Nov 14 12:09 20-exif.ini -rw-r--r-- 1 root root 54 Nov 14 12:09 20-fileinfo.ini -rw-r--r-- 1 root root 44 Nov 14 12:09 20-ftp.ini -rw-r--r-- 1 root root 42 Nov 14 12:09 20-gd.ini -rw-r--r-- 1 root root 52 Nov 14 12:09 20-gettext.ini -rw-r--r-- 1 root root 48 Nov 14 12:09 20-iconv.ini -rw-r--r-- 1 root root 46 Nov 14 12:09 20-json.ini -rw-r--r-- 1 root root 54 Nov 14 12:09 20-mbstring.ini -rw-r--r-- 1 root root 52 Nov 14 12:09 20-mysqlnd.ini -rw-r--r-- 1 root root 44 Nov 14 12:09 20-pdo.ini -rw-r--r-- 1 root root 46 Nov 14 12:09 20-phar.ini -rw-r--r-- 1 root root 56 Nov 14 12:09 20-simplexml.ini -rw-r--r-- 1 root root 52 Nov 14 12:09 20-sockets.ini -rw-r--r-- 1 root root 52 Nov 14 12:09 20-sqlite3.ini -rw-r--r-- 1 root root 56 Nov 14 12:09 20-tokenizer.ini -rw-r--r-- 1 root root 44 Nov 14 12:09 20-xml.ini -rw-r--r-- 1 root root 56 Nov 14 12:09 20-xmlwriter.ini -rw-r--r-- 1 root root 44 Nov 14 12:09 20-xsl.ini -rw-r--r-- 1 root root 50 Nov 14 12:09 30-mysqli.ini -rw-r--r-- 1 root root 56 Nov 14 12:09 30-pdo_mysql.ini -rw-r--r-- 1 root root 58 Nov 14 12:09 30-pdo_sqlite.ini -rw-r--r-- 1 root root 46 Nov 14 12:09 30-wddx.ini -rw-r--r-- 1 root root 56 Nov 14 12:09 30-xmlreader.ini -rw-r--r-- 1 root root 47 Nov 14 12:49 40-zip.ini -rw-r--r-- 1 root root 645 Nov 14 12:09 opcache-default.blacklist可以看到官方构建的版本为了防止冲突，为全部的扩展进行了分类，并加上了序号。效仿其规律，防止与系统自带的扩展冲突，自行创建配置文件并命名# touch 99-redis.ini写入以下配置; Enable Redis extension module extension=redis.so保存后重启 PHP 即可看到效果# php -m [PHP Modules] bz2 calendar Core ctype curl date dom exif fileinfo filter ftp gd gettext hash iconv json libxml mbstring mysqli mysqlnd openssl pcntl pcre PDO pdo_mysql pdo_sqlite Phar readline redis Reflection session SimpleXML sockets SPL sqlite3 standard tokenizer wddx xml xmlreader xmlwriter xsl Zend OPcache zip zlib [Zend Modules] Zend OPcache

0基础上手python、PHP编程，域自助服务台，具备第三方APP提醒，自助改密解锁等功能 王工自研域自助服务台架构图，具备长期未改密企业微信提醒、自助改密解锁等功能全面对标宁盾微软AD自助修改密码解决方案https://www.nington.com/solution-adpassword/每年可为公司节省5W-10W元说明 王工域控为windows2022，Self Service Password搭建在OracleLinux8上，python版本为python3最新版本，PHP为OracleLinux8默认源中的PHP7预览 通知改密自助改密架构解析： 1、域控上域账户维护pager属性(寻呼机)，修改为企业微信ID2、域控运行扫描脚本，通过计算上次修改密码时间，超过指定日期，进行企业微信提醒；如果未维护pager属性，写入日志3、Self Service Password域控自助服务台二次开发，改为企业微信接收验证码改密4、进行企业微信提醒时，先查询redis缓存，如果access_token不存在，则获取一次，如果存在，直接使用，缓存5400秒自动过期。5、建立企业微信应用，可参考我的zabbix文章搭建前提1、已维护域控pager属性为企业微信userid，此信息需要企业微信管理员后台查询。2、已正确部署Self Service Password，可以看我之前的文章。3、已部署redis，建议使用docker部署，一定要设置redis密码4、已为php增加php-redis扩展docker一键部署redis 红帽系系统默认为podman替代dockerpodman pull redis podman run --restart=always -p 6379:6379 --name myredis -d redis --requirepass passwd@123持久化参数--appendonly yes扫描脚本： 扫描脚本同样有两部分组成，第一部分是powershell脚本，用于获取域用户信息 可指定OU、可自定义要获取的用户属性，生成的文件放在C盘根目录下1.txt，与python脚本对应 adgetuser.ps1Get-ADUser -Filter 'Name -like "*"' -SearchBase "OU=测试组,OU=用户OU,DC=90apt,DC=com" -Properties * | Select-Object name,passwordlastset,pager > c:/1.txt运行结果 name passwordlastset pager ---- --------------- ----- 王忘杰1 2023/5/18 16:39:05 WangWangJie1 王忘杰2 2022/9/26 16:50:41 WangWangJie2第二部分是扫描通知脚本，由主python文件和配置文件ad.config组成，运行后生成errlog.txt日志文件ad.config属性说明corpid:appsecret:agentid:content:内容1content1:内容2content2:内容3admin:闲置属性ip:redis地址port:redis端口passwd:redis密码passwddate:密码多少天未修改进行提醒{ "corpid" : "xxxx", "appsecret" : "xxxx", "agentid" : "xxxx", "content" : "亲爱的 ", "content1" : " 域用户 :\n您的计算机域账户已经超过 ", "content2" : " 天没有修改密码了（电脑登录密码），请您立即更改。\n重置密码过程请遵循以下原则：\n○密码长度最少 8 位；\n○密码中不可出现公司和本人中英文拼写\n○密码符合复杂性需求（大写字母、小写字母、数字和符号四种中必须有三种）\n操作方式：\n您可以通过 自助密码服务台http://xx/修改密码，在公司内网中，手机、笔记本、台式机均可访问", "admin" : "xxxx", "ip" : "xxxx", "port" : "xxxx", "passwd" : "xxxx", "passwddate" : xx }主python文件import requests,json,redis,time,logging from datetime import datetime, timedelta def get_weixintoken(): #获取微信token token_url = 'https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=' + config[0] + '&corpsecret=' + config[1] req = requests.get(token_url) accesstoken = req.json()['access_token'] return accesstoken def get_redistoken(): readredis = redis.Redis(connection_pool=redis.ConnectionPool(host=config[7],port=config[8],password=config[9],decode_responses=True)) if readredis.get('key') == None: readredis.set('key', get_weixintoken(),ex=5400) return (readredis.get('key')) else: return readredis.get('key') def post_weixin(userweixin,content): body = { "touser": userweixin, "msgtype": "text", "agentid": config[2], "text": { "content": content } } postweixin = requests.post( 'https://qyapi.weixin.qq.com/cgi-bin/message/send?access_token='+get_redistoken(),data=json.dumps(body)) return(postweixin.text) def get_config(): config = json.loads(open("ad.config", encoding='utf-8').read()) return [config['corpid'],config['appsecret'],config['agentid'],config['content'],config['content1'],config['content2'],config['admin'],config['ip'],config['port'],config['passwd'],config['passwddate']] def user_check(): f = open("C:\\1.txt", "r", encoding='utf-16') lines = f.readlines() f = open('errlog.txt', 'w') for line in lines: try: x = line.replace("/", "-") y = x.split() time_1 = y[1] time_2 = time.strftime("%Y-%m-%d", time.localtime()) time_1_struct = datetime.strptime(time_1, "%Y-%m-%d") time_2_struct = datetime.strptime(time_2, "%Y-%m-%d") day = (time_2_struct - time_1_struct).days userweixin = y[3] username= y[0] if day > config[10]: day = str(day) time.sleep(1) try: post = post_weixin(userweixin,config[3]+username+config[4]+day+config[5]) postjson=json.loads(post) if postjson['errmsg'] != "ok": f.write("发送失败,可能微信号错误 " + userweixin+"\n") except : None else: None except: f.write("没有微信号 "+ line) f.close() config = get_config() #post_weixin() user_check()脚本使用 编译为EXE文件，和ad.config，放在域控服务器通过定时任务运行即可。Self Service Password企业微信脚本项目目录/usr/share/self-service-password/配置文件/usr/share/self-service-password/conf/config.inc.local.php配置文件中修改短信通知方式## SMS # Use sms $use_sms = true; # SMS method (mail, api) $sms_method = "api"; $sms_api_lib = "lib/weixin.inc.php"; # GSM number attribute $sms_attributes = array( "pager" );编写企业微信通知脚本 /usr/share/self-service-password/lib/weixin.inc.php<?php //连接本地的 Redis 服务 function get_token(){ $redis = new Redis(); $redis->connect('修改用自己的IP地址', 修改用自己的端口); $redis->auth('修改用自己的redis密码'); $key = $redis->get("key"); if ($key) { return $key; } else { $url='https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=修改用自己的&corpsecret=修改用自己的'; $jsondb = file_get_contents($url); $jsondb = json_decode($jsondb, true); $key = $jsondb['access_token']; $redis->set("key", $key); $redis->expire("key", 5400); return $key; } } function send_sms_by_api($mobile, $message) { $postdata = array( 'touser' => "$mobile", 'msgtype' => 'text', 'agentid' => '修改用自己的', 'text' => array( 'content' => "$message" ) ); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, 'https://qyapi.weixin.qq.com/cgi-bin/message/send?access_token=' . get_token()); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($postdata)); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $errmsg = json_decode(curl_exec($ch))->errmsg; if ($errmsg=="ok") { return 1; } else { return 0; } } ?>修改中文显示 比如把短信修改成企业微信，可直接修改语言文件/usr/share/self-service-password/lang/zh-CN.inc.phpPHP安装redis扩展 https://www.vvave.net/archives/how-to-install-php-pecl-redis-on-centos8-official-repo-php.html 总结 简单

中小型企业开源或免费网络安全方案建设 依托等级保护2.0一、二、三级指导以及开源或免费安全软件进行网络安全建设，但注意，此方案并不能让你顺利通过等保认证，等保是生意不是技术。传统企业架构王工开源或免费网络安全方案

HFish威胁捕捉与诱骗蜜罐系统 项目官网https://hfish.net/工作原理部署架构安装步骤 项目提供一键安装https://hfish.net/#/2-0-deploy增加节点 按生成的一键包安装即可特色功能 1、云端高交互蜜罐，由Hfish提供云端环境进行渗透过程记录2、攻击态势大屏

遭遇一起典型钓鱼邮件攻击 钓鱼邮件为APT（高级持续性攻击）常用攻击手段，有针对性、目的明确、持续时间长。钓鱼邮件伪装成合同链接诱导点击钓鱼网站伪装为网易企业邮箱官网，使用linkpc.net免费二级域名，并填充邮件接收方地址网易企业邮箱官网实际为一张截图通过代码在图片上建立伪装登录窗口，无论输入任何内容都会显示无效密码输入两次密码后，跳转邮件接收方官网，欺骗点击者认为只是登陆错误此时对方已获取邮箱密码，完成钓鱼攻击过程。

Algorius Net Viewer网络可视化监控管理软件 官网https://algorius.com/价格 免费版支持25个设备，好用请支持正版哦https://algorius.com/purchase/pricing.html程序下载https://algorius.com/download/resources.html安装均为下一步程序界面配置设备配置ping最后我的使用情况

可视化Uptime状态监控平台Uptime Kuma 项目地址https://github.com/louislam/uptime-kuma可以监控 HTTP(s) / TCP / HTTP(s) Keyword / Ping / DNS Record / Push / Steam Game Server / Docker Containers的正常运行时间一键安装docker run -d --restart=always -p 3001:3001 -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:1升级docker pull louislam/uptime-kuma:1 docker stop uptime-kuma docker rm uptime-kuma docker run -d --restart=always -p 3001:3001 -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:1主页面配置独立状态页配置企业微信通知

0基础上手python编程，批量自动备份H3C交换机配置并进行企业微信通知 王工已重新编写脚本，请查看最新文章交换机自动备份配置(h3c)python2备份基于CSDN@willwillwanghttps://blog.csdn.net/wq298102526/article/details/108796824python3自行编写定时计划，每天7点备份，7点40发送告警0 7 * * * python2 /root/swbackup.py > /root/swbackup.log 40 7 * * * python3 /root/swbackupweixin.py >> /root/swbackup.logpython2备份脚本 swbackup.py利用telnetlib交互登录查看交换机配置并保存，可修改命令后用于任意品牌交换机#!/usr/bin/python2 # -*- coding: UTF-8 -*- import telnetlib import time import re import codecs import time import os now = time.strftime("%y%m%d") path = "/root/backup/%s"%now if not os.path.exists(path): os.makedirs(path) Hostall = """172.16.1.1 172.16.1.2 """ Hostlist = Hostall.splitlines() for Host in Hostlist: try: tn = telnetlib.Telnet(Host, timeout=15) time.sleep(5) tn.write(b'admin\n') time.sleep(5) tn.write(b'admin@123\n') time.sleep(5) tn.write(b'screen-length disable\n') tn.write(b'dis cur\n') tn.read_some() tn.write(b'undo screen-length disable\n') tn.write(b'quit\n') mac1 = tn.read_all() f1 = open('%s/%s'%(path,Host),'wb') f1.write(mac1) f1.close() print ("%s finish"%Host) except: print("fail %s"%Host) python3通知脚本拥有python3企业微信应用通知和企业微信机器人通知，其中企业微信应用通知、温湿度使用了zabbix中现有脚本。#!/usr/bin/python3 # -*- coding: UTF-8 -*- import time,os,requests,json,subprocess from datetime import datetime from collections import Counter lines = open("/root/swbackup.log", "r", encoding='utf-8').read().split() finish = lines.count('finish') fail = lines.count('fail') total = str(finish + fail) finish = str(finish) fail = str(fail) time_2 = time.strftime("%Y-%m-%d", time.localtime()) printfinish = (time_2+"-总计备份交换机"+total+"台-成功"+finish+"台-失败"+fail+"台") os.system("/usr/lib/zabbix/alertscripts/weixin.py %s %s %s" % ("wangwangjie","交换机备份报告",printfinish)) response2 = requests.get("https://devapi.qweather.com/v7/weather/now?用自己的和风天气API") data1=json.loads(response2.text) data2=json.dumps(data1['now']) data2=json.loads(data2) data3 ="早上好！ \n当前天气情况\n环境温度"+data2['temp']+" 体感温度"+data2['feelsLike']+" 天气状况 "+data2['text']+"\n风向 "+data2['windDir']+" 风力等级"+data2['windScale']+" 风速"+data2['windSpeed']+" 湿度"+data2['humidity']+" 能见度"+data2['vis']+"公里\n" data4 = "备份交换机"+total+"台-成功"+finish+"台-失败"+fail+"台\n" data5 = "机房温度"+str(os.popen("/etc/zabbix/script/get_temp.sh").read())+"机房湿度"+str(os.popen("/etc/zabbix/script/get_hum.sh").read()) url = 'https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=用自己的企业微信机器人通知' body = body = { "msgtype": "news", "news": { "articles" : [ { "title" : time_2, "description" : data3+data4+data5, "url" : "90apt.com", "picurl" : "微信机器人上方图片" } ] } } headers = {"Content-Type": "application/json"} response = requests.post(url,json=body,headers=headers) print(response.text) print(response.status_code)