centos redhat系列对抗ddos之居家必备利器 banip.txt
<p class="codetitle"><span><u>复制代码</u></span> 代码如下:</p>
<p class="codebody">
<br>
##############################################<br>
#version="20100718"<br>
#author="phpsir"<br>
#author_email="phpsir@phpsir.com"<br>
##############################################<br>
maxnum=50<br>
runmin_max=300<br>
#runmin_max is clear time<br>
ipfile="/tmp/80link.txt"<br>
banip_data_file="/root/banip_data.txt"<br>
ipopenfile="/root/openip.txt"<br>
nsfile="/tmp/netstat80.txt"<br><br>
myip=`/sbin/ifconfig eth0 | grep inet | awk '{print $2}' | sed 's/addr://' | grep .`<br>
if [ ! -f $ipopenfile ]<br>
then<br>
echo "init $ipopenfile"<br>
touch $ipopenfile<br>
fi<br>
if [ -f $banip_data_file ]<br>
then<br>
source $banip_data_file<br>
echo "last runtime=$runtime"<br>
else<br>
echo "init $banip_data_file"<br>
echo 'runtime='`date "+%s"` > $banip_data_file<br>
source $banip_data_file<br>
runmin_max=-1<br>
fi<br><br>
echo "start shell" `date "+%Y-%m-%d %H:%M:%S"`<br>
runmin=$((`date "+%s"`-$runtime))<br>
if [ $runmin -gt $runmin_max ]<br>
then<br>
echo $runmin "is bigger than " $runmin_max<br>
echo "clear ips"<br>
/sbin/iptables -F<br>
echo 'runtime='`date "+%s"` > $banip_data_file<br>
else<br>
echo $runmin "is lowwer than " $runmin_max<br>
fi<br><br>
netstat -an | grep "$myip:80" > $nsfile<br><br>
echo "Total Links = " `cat $nsfile | wc -l `<br>
echo "Total Links ESTABLISHED = " `cat $nsfile | grep ESTABLISHED | wc -l `<br>
echo "Total Links SYNC = " `cat $nsfile | grep SYN | wc -l `<br><br>
cat $nsfile | awk '{print $5}' | awk -F: '{print $1}' | sort|uniq -c|sort -rn | head -n 10 > $ipfile<br><br>
cat $ipfile | while read oneline<br>
do<br>
ip=`echo $oneline | cut -d " " -f 2`<br>
num=`echo $oneline | cut -d " " -f 1`<br>
str="$ip has linked $num "<br>
banme="yes"<br><br>
for allowip in `cat $ipopenfile`<br>
do<br>
echo $ip | grep $allowip > /dev/null<br>
if [ $? -eq 0 ]<br>
then<br>
banme="no"<br>
echo $allowip "banme = " $banme<br>
/sbin/iptables -D INPUT -p tcp -s $ip -d $myip --dport 80 -j REJECT > /dev/null 2>&1<br>
continue<br>
fi<br>
done<br><br>
if [ $banme = "yes" ]<br>
then<br>
if [ $num -gt "$maxnum" ]<br>
then<br>
/sbin/iptables -L -n | grep "$ip" >/dev/null<br>
status=`echo $?`<br>
if [ $status -eq 1 ]<br>
then<br>
echo "deny $ip ,because $str "<br>
/sbin/iptables -A INPUT -p tcp -s $ip -d $myip --dport 80 -j REJECT<br>
echo "BAN " $ip " OK "<br>
#/sbin/iptables -L -n | grep "$ip"<br>
else<br>
echo > /dev/null<br>
#echo "$str alread reject"<br>
fi<br>
else<br>
echo > /dev/null<br>
#echo "$str $ip ok ,less $maxnum "<br>
fi<br>
fi<br><br>
done<br><br>
echo "stop shell" `date "+%Y-%m-%d %H:%M:%S"`</p>
頁:
[1]