1.sshd日志统计脚本

#!/bin/bash

# 检查命令执行状态的函数
check_status() {
  if [ $? -ne 0 ]; then
    echo "命令执行失败，请检查日志文件路径和时间范围是否正确。"
    exit 1
  fi
}

# 获取日志文件路径和时间范围（默认值）

TIME_RANGE=${2:-"1 month ago"}


# 获取最近一个月sshd的日志，提取登录失败的IP并统计
echo "近一个月内尝试登录失败的IP及次数（按次数降序排列）："
journalctl -u sshd --since "$TIME_RANGE" -q \
  | grep -E "Failed password|Invalid user" \
  | sed -n 's/.*from \([0-9.]\+\).*/\1/p' \
  | sort \
  | uniq -c \
  | sort -nr
check_status

# 统计总攻击次数
total=$(journalctl -u sshd --since "$TIME_RANGE" -q \
  | grep -E "Failed password|Invalid user" \
  | sed -n 's/.*from \([0-9.]\+\).*/\1/p' \
  | wc -l)
check_status

echo "==============================="
echo "总计攻击次数：$total 次"

2.数据库备份脚本

#!/bin/bash
set -eo pipefail

# 配置区域
MYSQL_USER="backup_user"#数据库备份用户名
MYSQL_PASSWORD="password"#数据库备份用户密码
MYSQL_SOCKET="/var/run/mysqld/mysqld.sock"
BACKUP_DIR="/backup/mysql"#本地备份目录
FULL_BACKUP_INTERVAL=7 # 全量备份间隔天数
OSS_BUCKET="oss://mysql_bak"
OSS_ENDPOINT="oss-cn-hangzhou-internal.aliyuncs.com"
INCREMENTAL_DIR="${BACKUP_DIR}/incremental"
LOG_FILE="/var/log/mysql_backup.log"
XTRABACKUP_THREADS=4 # 根据CPU核心数调整

# 创建必要目录
mkdir -p ${BACKUP_DIR} ${INCREMENTAL_DIR}

# 日志记录函数
log() {
    echo "[$(date +'%Y-%m-%d %H:%M:%S')] $1" | tee -a ${LOG_FILE}
}

# 错误处理函数
error_exit() {
    log "ERROR: $1"
    exit 1
}

# 检查XtraBackup安装
command -v xtrabackup >/dev/null 2>&1 || error_exit "XtraBackup未安装"

# 检查ossutil配置
OSSUTIL_CONFIG=~/.ossutilconfig
[ -f ${OSSUTIL_CONFIG} ] || error_exit "ossutil配置文件缺失"

# 计算最近的全量备份目录
latest_full=$(find ${BACKUP_DIR} -maxdepth 1 -type d -name "full_*" -printf "%T@ %p\n" | sort -n | tail -1 | cut -d' ' -f2)

# 确定备份类型
#全量备份
if [ -z "${latest_full}" ] || [ $(($(date +%s) - $(stat -c %Y "${latest_full}"))) -gt $((${FULL_BACKUP_INTERVAL} * 86400)) ]; then
    BACKUP_TYPE="full"
    BACKUP_NAME="full_$(date +%Y%m%d_%H%M)"
    BACKUP_PATH="${BACKUP_DIR}/${BACKUP_NAME}"
else
    #增量备份
    BACKUP_TYPE="incremental"
    BACKUP_NAME="incr_$(date +%Y%m%d_%H%M)"
    BACKUP_PATH="${INCREMENTAL_DIR}/${BACKUP_NAME}"
    LATEST_INCR=$(find ${INCREMENTAL_DIR} -maxdepth 1 -type d -name "incr_*" -printf "%T@ %p\n" | sort -n | tail -1 | cut -d' ' -f2)
    [ -n "${LATEST_INCR}" ] && BASE_DIR=${LATEST_INCR} || BASE_DIR=${latest_full}
fi

# 执行备份
log "开始${BACKUP_TYPE}备份: ${BACKUP_NAME}"
if [ "${BACKUP_TYPE}" = "full" ]; then
    xtrabackup \
        --user=${MYSQL_USER} \
        --password=${MYSQL_PASSWORD} \
        --socket=${MYSQL_SOCKET} \
        --backup \
        --parallel=${XTRABACKUP_THREADS} \
        --compress \
        --compress-threads=${XTRABACKUP_THREADS} \
        --target-dir=${BACKUP_PATH} \
        --no-server-version-check 2>>${LOG_FILE} || error_exit "全量备份失败"
else
    xtrabackup \
        --user=${MYSQL_USER} \
        --password=${MYSQL_PASSWORD} \
        --socket=${MYSQL_SOCKET} \
        --backup \
        --parallel=${XTRABACKUP_THREADS} \
        --compress \
        --compress-threads=${XTRABACKUP_THREADS} \
        --target-dir=${BACKUP_PATH} \
        --incremental-basedir=${BASE_DIR} \
        --no-server-version-check 2>>${LOG_FILE} || error_exit "增量备份失败"
fi

log "备份完成: ${BACKUP_PATH}"

# 本地保留策略（示例保留策略）
find ${BACKUP_DIR}/full_* -maxdepth 0 -type d -mtime +30 -exec rm -rf {} \; 2>/dev/null
find ${INCREMENTAL_DIR}/incr_* -maxdepth 0 -type d -mtime +15 -exec rm -rf {} \; 2>/dev/null

# 同步到阿里云OSS
log "开始同步到阿里云OSS..."
ossutil cp --endpoint ${OSS_ENDPOINT} -r --update --maxupspeed 25600 ${BACKUP_PATH} ${OSS_BUCKET}/$(basename ${BACKUP_PATH}) || error_exit "OSS上传失败"

log "OSS同步完成"

# 记录备份元数据
echo "${BACKUP_TYPE} ${BACKUP_NAME} $(date +%s)" >> ${BACKUP_DIR}/backup_meta.log

log "所有操作成功完成"

1.备份环境安装

# 安装Percona XtraBackup
wget https://repo.percona.com/apt/percona-release_latest.$(lsb_release -sc)_all.deb
sudo dpkg -i percona-release_latest*.deb
sudo apt-get update
sudo apt-get install percona-xtrabackup-80

# 安装ossutil
wget https://gosspublic.alicdn.com/ossutil/install.sh
bash install.sh

2.定时任务配置

#执行crontab -e
# 每天凌晨2点执行增量备份
0 2 * * * /path/to/backup_script.sh

# 每周日凌晨1点执行全量备份（由脚本自动判断）
0 1 * * 0 /path/to/backup_script.sh

3.恢复步骤

# 全量恢复
xtrabackup --decompress --target-dir=full_backup
xtrabackup --prepare --apply-log-only --target-dir=full_backup
rsync -avrP full_backup/ /var/lib/mysql/

# 增量恢复
xtrabackup --prepare --apply-log-only --target-dir=full_backup
xtrabackup --prepare --apply-log-only --target-dir=full_backup --incremental-dir=incr_backup
rsync -avrP full_backup/ /var/lib/mysql/