nginx网站被持续***1个月后最终防攻策略
#!/bin/bash#write: lijing QQ 858080796
#date:20160528 v2.0
#description:拦截非法IP
#定义变量
RETVAL=0
Date=$(date '+%Y-%m-%d')
Time=$(date '+%Y:%H:%M' -d '-1 minute')
MON=$(date|awk -F" " '{print $2}')
TODAY=$(date|awk -F" " '{print $3}')
Log="/data/logs/nginx/access.log "
LINE="70000"
#关键字
Key01="sendPhoneCode"
Status=/tmp/statuS_deny_ip
/sbin/service iptables status > $Status
#定义函数
#禁止时间函数
secure_deny_time(){
Time01=$(date "+%H:%M:%S" -d " -10 second")
Time02=$(date "+%H:%M:%S" -d " -9second")
Time03=$(date "+%H:%M:%S" -d " -8second")
Time04=$(date "+%H:%M:%S" -d " -7second")
Time05=$(date "+%H:%M:%S" -d " -6second")
Time06=$(date "+%H:%M:%S" -d " -5second")
Time07=$(date "+%H:%M:%S" -d " -4second")
Time08=$(date "+%H:%M:%S" -d " -3second")
Time09=$(date "+%H:%M:%S" -d " -2second")
Time10=$(date "+%H:%M:%S" -d " -1second")
echo"$Time01$Time02 $Time03 $Time04 $Time05 $Time06 $Time07 $Time08 $Time09 $Time10 "
}
# 禁止关键字函数
secure_key(){
tail -n $LINE $LOG |grep "$TODAY\/$MON"|grep -v ^$|grep $TIME|grep $1 |grep $2 |grep $3|grep $4 |awk -F " " '{print $1}' |sort >> $Deny
echo " grep "$TODAY\/$MON" $LOG |grep -v ^$|grep $TIME|grep $1 |grep $2 |grep $3|grep $4 |awk '{print $1}' |sort"
}
#执行防火墙拦截函数
secure_deny_ip()
{
cat $Deny
echo ......................
cat $Deny02
for i in $IP;do
NUM=$(cat $Deny02|grep $i|awk -F" " '{print $1}')
if [ -z $NUM ];then
echo " "
else
if [ $NUM -ge $Dot ];then
for y in $i;do
grep $y $Status>/dev/null 2>&1
RETVAL=$?
[ $RETVAL != 0] && echo "/sbin/iptables -I INPUT -s $y-j DROP"
[ $RETVAL != 0] && /sbin/iptables -I INPUT -s $y-j DROP
[ $RETVAL != 0] && echo "$(date "+%H:%M:%S") $y " >> /tmp/$Date
#[ $RETVAL != 0] && /sbin/iptables -I INPUT -s $y -ptcp-j REJECT
done
fi
fi
done
}
NUMBER="1 2 3 4 5 6"
forNUMBER in$NUMBER ;do
sleep 10s
#定义点击次数 Dot
Dot=5
Deny=/tmp/secure_deny_tmp_$NUMBER
Deny02=/tmp/secure_deny_$NUMBER
#第1次,检查当前时间以前10s.如: 0-10秒
echo "第$NUMBER 次,检查当前时间以前第$NUMBER 个10s.大于 $Dot 次***阻止"
echo > $Deny
for LOG in `echo $Log` ;do
secure_deny_time
for TIME in $Time01$Time02 $Time03 $Time04 $Time05 $Time06 $Time07 $Time08 $Time09 $Time10 ;do
secure_key$Key01
done
cat $Deny|sort|uniq -c > $Deny02
IP=$(cat $Deny02|awk -F" " '{print $2}')
secure_deny_ip
done
done
exit
页:
[1]