Commit: 6e23bd2211b14669630226b07d401c871e824cdd - Scripts (git)

Scripts collections

Commit MetaInfo

• Revisión: 6e23bd2211b14669630226b07d401c871e824cdd (tree)
• Tiempo: 2016-01-09 19:32:25
• Autor: Mathewka <mathewka@git....>
• Commiter: Mathewka

Log Message

cc_iptables

Cambiar Resumen

• add: cc_iptables/block_attack_ips.sh
• add: cc_iptables/cc_iptables1.sh
• add: cc_iptables/cc_iptables2.sh
• add: cc_iptables/cc_nginx.sh
• add: cc_iptables/ddos.sh
• add: cc_iptables/ddos1.sh
• add: cc_iptables/ddos2.sh
• add: cc_iptables/iptables.sh
• add: cc_iptables/netstat.sh
• add: cc_iptables/nginx_log_cc_iptables.sh

Diferencia incremental

--- /dev/null
+++ b/cc_iptables/block_attack_ips.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+# http://www.111cn.net/sys/linux/61035.htm
+
+logfile=/webserver/blog/logs/rainbow_access.log
+function check_root(){
+  if [ $EUID -ne 0 ]; then
+    echo "This script must be run as root"
+    exit 1
+  fi
+}
+function block_ips(){
+  blacklist=$@
+  if [ ! -z "${blacklist}" ]; then
+    for ip in ${blacklist}
+    do
+      if ! $(/sbin/iptables-save | grep -wq ${ip}); then
+        echo /sbin/iptables -I INPUT -s ${ip}/32 -p tcp -m tcp --dport 80 -j DROP
+        /sbin/iptables -I INPUT -s ${ip}/32 -p tcp -m tcp --dport 80 -j DROP
+      fi
+    done
+  fi
+}
+function check_login(){
+  tailnum=10000
+  page=wp-login.php
+  retry=5
+  
+  command="grep -w POST ${logfile} |tail -n ${tailnum} |grep -w ${page} |awk '{print $1}' |sort |uniq -c |awk '($1 > ${retry}){print $2}'"
+  blacklist=$(eval ${command})
+  block_ips ${blacklist}
+}
+function check_others(){
+  tailnum=10000
+  retry=400
+  
+  command="tail -n ${tailnum} ${logfile} |awk '{print $1}' |sort |uniq -c |awk '($1 > ${retry}){print $2}'"
+  blacklist=$(eval ${command})
+  block_ips ${blacklist}
+}
+check_root
+check_login
+check_others
\ No newline at end of file

--- /dev/null
+++ b/cc_iptables/cc_iptables1.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+##http://www.vsyour.com/post/140.html
+num=100 #ÉÏÏÞ
+cd /home/wwwlogs
+#¶ÁÈ¡×îÐÂ1000Ìõ¼Ç¼£¬Èç¹ûµ¥IP³¬¹ý100Ìõ¾Í·âµô¡£
+for i in tail access.log -n 1000|awk '{print $1}'|sort|uniq -c|sort -rn|awk '{if ($1>$num){print $2}}'
+do
+      iptables -I INPUT -p tcp -s $i --dport 80 -j DROP
+done
\ No newline at end of file

--- /dev/null
+++ b/cc_iptables/cc_iptables2.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+##http://yzs.me/2050.html
+#º¯Êýban_now
+ban_now() {
+#Êä³öIPµÄÄÚÈÝ
+echo $1
+#Ö´ÐÐiptables¶Ô¸ÃIP·â½û
+iptables -I INPUT -s $1 -p all -j DROP
+#·â½ûºóÖ´ÐÐmailÃüÁ¸øÖ¸¶¨ÓÊÏä·¢Ò»·âÓʼþ
+echo -e "IP:$1 was banned at $(date).\n\niptables filter tables:\n\n$(iptables -L -n -t filter)" | mail -s "IP:$1 was banned at $(date)" [e-mail]
+}
+#Ñ­»·µÄ¿ªÊ¼
+while [ "$loop" = "" ]
+do
+#Çå¿ÕÈÕÖ¾Îļþ
+cat>/var/log/nginx/iponly.log<<EOF
+EOF
+#ÑÓ³ÙÎåÃë
+ping -c 5 127.0.0.1 >/dev/null 2>&1
+#ºÏ²¢£¬ÅÅÐòIP£¬Êä³ö»ñÈ¡ÇëÇóÊý×î´óµÄIP¼°ÆäÇëÇóÊý£¬ÇëÇóÊýÓëIPÖ®¼äʹÓÃÓ¢ÎĶººÅ¸ô¿ª£¬È»ºó¸³Öµ¸øconnections
+connections=$(cat /var/log/nginx/iponly.log | sort -n | uniq -c | sort -nr | awk '{print $1 "," $2}')
+#ÅжϱäÁ¿connectionsÊÇ·ñΪ¿Õ
+if [ "$connections" != "" ];then
+#Êä³ö±äÁ¿connectionsµÄÄÚÈÝ
+  echo $connections
+#Á¬½ÓÊýµÄforÑ­»·¿ªÊ¼
+  for ipconntctions in $connections
+    do
+#½ØÈ¡Á¬½ÓÊý
+      connectnumber=$(echo $ipconntctions | cut -d "," -f 1)
+#ÅжϸÃIPÁ¬½ÓÊýÊÇ·ñ´óÓÚ200
+      test $connectnumber -ge 200 && banit=1
+#´óÓÚ200£¬°ÑIP¸³Öµ¸ø±äÁ¿fuckingip
+      if [ "$banit" = "1" ];then
+          fuckingip=$(echo $ipconntctions | cut -d "," -f 2)
+          ban_now $fuckingip
+          unset banit
+      else
+#·ñÔò£¬½áÊøforÑ­»·
+          break
+      fi
+     done
+fi
+done
\ No newline at end of file

--- /dev/null
+++ b/cc_iptables/cc_nginx.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+##http://os.51cto.com/art/201103/249725_1.htm
+nginx_home = /usr/local/nginx
+log_path = /home/wwwroot/logs
+
+/usr/bin/tail -n 50000 $log_path/access.log \
+
+|awk ¡®$8 ~/aspx/{print $2,$13}¡¯ \
+
+|grep -i -v -E ¡°google|yahoo|baidu|msnbot|FeedSky|sogou¡± \
+
+|awk ¡®{print $1}¡¯|sort|uniq -c |sort -rn \
+
+|awk ¡®{if($1>150)print ¡°deny ¡°$2¡å;¡±}¡¯> $nginx_home/conf/vhosts/blockip.conf
+
+/bin/kill -HUP `cat $nginx_home/nginx.pid`
\ No newline at end of file

--- /dev/null
+++ b/cc_iptables/ddos.sh
@@ -0,0 +1,85 @@
+#!/bin/sh
+#1
+if [ -d '/usr/local/ddos' ]; then
+        echo; echo; echo "Please un-install the previous version first"
+	echo; 
+	echo 'Uninstall:'; 
+	echo ;
+	echo 'wget http://www.ctohome.com/linux-vps-pack/soft/ddos/uninstall.ddos;sh uninstall.ddos;';
+	echo; 
+	echo; 
+        exit 0
+else
+        mkdir /usr/local/ddos
+fi
+clear
+echo; echo 'Installing DOS-Deflate 0.6'; echo
+echo; echo -n 'Downloading source files...'
+wget -q -O /usr/local/ddos/ddos.conf http://www.ctohome.com/linux-vps-pack/soft/ddos/ddos.conf
+echo -n '.'
+wget -q -O /usr/local/ddos/LICENSE http://www.inetbase.com/scripts/ddos/LICENSE
+echo -n '.'
+wget -q -O /usr/local/ddos/ignore.ip.list http://www.ctohome.com/linux-vps-pack/soft/ddos/ignore.ip.list
+
+/sbin/ifconfig -a|grep inet|grep -v 127.0.0.1|grep -v inet6|awk '{print $2}'|tr -d "addr:" >>  /usr/local/ddos/ignore.ip.list;
+chattr +i /usr/local/ddos/ignore.ip.list;
+
+echo -n '.'
+wget -q -O /usr/local/ddos/ddos.sh http://www.ctohome.com/linux-vps-pack/soft/ddos/ddos-deflate.sh
+chmod 0755 /usr/local/ddos/ddos.sh
+cp -s /usr/local/ddos/ddos.sh /usr/local/sbin/ddos
+echo '...done'
+
+echo; echo -n 'Creating cron to run script every minute.....(Default setting)'
+/usr/local/ddos/ddos.sh --cron > /dev/null 2>&1
+echo '.....done'
+echo; echo 'DOS-Deflate Installation has completed.'
+echo 'Config file is at /usr/local/ddos/ddos.conf'
+echo 'ignore ip is at /usr/local/ddos/ignore.ip.list '
+echo 'if you want edit it please use chattr -i /usr/local/ddos/ignore.ip.list first'
+
+service iptables restart
+
+clear
+
+echo 'Script license: /usr/local/ddos/LICENSE';
+echo '';
+echo '';
+echo '';
+echo '';
+echo '=========================================================';
+echo "======  DOS-Deflate Installation has completed     ======";
+echo "======                                             ======";
+echo "======  http://www.ctohome.com/FuWuQi/df/318.html  ======";
+echo "======                                             ======";
+echo "======                                             ======";
+echo "======                                             ======";
+echo "======       How to edit ddos configure file       ======";
+echo "======                                             ======";
+echo "====== http://www.ctohome.com/FuWuQi/df/318.html   ======";
+echo "======                                             ======";
+echo "======                                             ======";
+echo "======         How to edit ignore IP list          ======";
+echo "======                                             ======";
+echo "====== http://www.ctohome.com/FuWuQi/df/318.html   ======";
+echo "======                                             ======";
+echo "======                                             ======";
+echo "======       Block IP more than 50 connections     ======";
+echo "======                                             ======";
+echo "======        /usr/local/ddos/ddos.sh -k 50        ======";
+echo "======                                             ======";
+echo "======                                             ======";
+echo "======                                             ======";
+echo "======           *  List blocked IPs *             ======";
+echo "======                                             ======";
+echo "======                 iptables -L                 ======";
+echo "======                                             ======";
+echo "======                                             ======";
+echo '=========================================================';
+echo '';
+echo '';
+echo '******** Check ip connections now: ********';
+echo '';
+echo "netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n";
+echo '';
+echo '';
\ No newline at end of file

--- /dev/null
+++ b/cc_iptables/ddos1.sh
@@ -0,0 +1,9 @@
+#!/bin/bash 
+##http://blog.liuts.com/post/101/#topreply
+/bin/netstat -na|grep ESTABLISHED|awk ¡®{print $5}¡¯|awk -F: ¡®{print $1}¡¯|sort|uniq -c|sort -rn|head -10|grep -v -E ¡¯192.168|127.0¡ä|awk ¡®{if ($2!=null && $1>4) {print $2}}¡¯>/tmp/dropip 
+
+for i in $(cat /tmp/dropip) 
+do         
+    /sbin/iptables -A INPUT -s $i -j DROP         
+    echo "$i kill at `date`">>/var/log/ddos 
+done 
\ No newline at end of file

--- /dev/null
+++ b/cc_iptables/ddos2.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+##http://www.oschina.net/code/snippet_17_9265
+############### KILL DDOS ##############
+iptables_log="/data/logs/iptables_conf.log"
+### Iptables ÅäÖõ¼³öµÄ·¾¶£¬¿ÉÈÎÒâÐÞ¸Ä ###
+########################################
+status=`netstat -na|awk '$5 ~ /[0-9]+:[0-9]+/ {print $5}'|awk -F ":" -- '{print $1}' |sort -n|uniq -c |sort -n|tail -n 1|grep -v 127.0.0.1`
+NUM=`echo $status|awk '{print $1}'`
+IP=`echo $status|awk '{print $2}'`
+result=`echo "$NUM > 200" | bc`
+### Èç¹ûͬʱÁ¬½ÓÊý´óÓÚ 200 Ôò¸Éµô£¡###
+if [ $result = 1 ]
+then
+echo IP:$IP is over $NUM, BAN IT!
+/sbin/iptables -I INPUT -s $IP -j DROP
+fi
+########################################
+iptables-save > ${iptables_log}
+### Êä³öµ±Ç°µÄ iptable ÅäÖÃ×÷ΪÈÕÖ¾ ###
+########################################
\ No newline at end of file

--- /dev/null
+++ b/cc_iptables/iptables.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+modprobe ip_tables
+modprobe iptable_nat
+modprobe ip_nat_ftp
+modprobe ip_conntrack
+modprobe ip_conntrack_ftp
+
+ipt=/sbin/iptables
+
+lan=10.0.0.0/255.255.255.0
+lo=127.0.0.1
+
+$ipt -F
+$ipt -t nat  -F
+$ipt -X
+$ipt -Z
+
+$ipt -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
+$ipt -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+$ipt -A OUTPUT -j ACCEPT
+$ipt -A INPUT -s $lo -j ACCEPT
+$ipt -A INPUT -s $lan -j ACCEPT
+$ipt -A INPUT -s 111.11.11.11 -j ACCEPT
+$ipt -A INPUT  -p udp --sport 53  -j ACCEPT
+$ipt -A INPUT  -p udp --sport 123  -j ACCEPT
+$ipt -A INPUT  -p tcp --dport 25  -j ACCEPT
+$ipt -A INPUT  -p tcp --dport 80  -j ACCEPT
+$ipt -A INPUT  -p tcp --dport 22  -j ACCEPT
+$ipt -A INPUT  -p tcp --dport 3306  -j ACCEPT
+$ipt -A INPUT  -p tcp --dport 9988  -j ACCEPT
+$ipt -A INPUT -j REJECT
+$ipt -A FORWARD -j REJECT
+$ipt -I INPUT -s 123.45.6.7 -j DROP
+
+
+####NAT
+#echo '1' > /proc/sys/net/ipv4/ip_forward
+#$ipt  -t nat -A POSTROUTING -s 10.0.0.6  -j SNAT --to-source 198.7.56.11
+#$ipt  -t nat -A POSTROUTING -s 10.0.0.7  -j SNAT --to-source 198.7.56.11
+
+/sbin/service iptables save
+echo ok

--- /dev/null
+++ b/cc_iptables/netstat.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+#netstat -na|grep ESTABLISHED|awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -n |tail -1 |awk 'FS="[ ]+" {print $2}'
+netstat -na|grep ESTABLISHED|awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -n
+echo "ESTABLISHED ok"
+netstat -an| grep :80 | grep -v 127.0.0.1 |awk '{ print $5 }' | sort|awk -F: '{print $1,$4}' | uniq -c | awk '$1>2 {print $1,$2}'
+echo "80 ok"

--- /dev/null
+++ b/cc_iptables/nginx_log_cc_iptables.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+##email: ppabc#qq.com
+##ppabc
+tail www.aqzt.com.access.log  -n 9999 |awk '{print $1}'|sort|uniq -c|sort -rn|awk '{if ($1>200){print $2}}'  > /data/nginxlogs/block_attack_ips.log
+
+/sbin/iptables -nL |grep DROP | awk '{print $4}' > /data/nginxlogs/iptables.log
+
+filename=`cat /data/nginxlogs/block_attack_ips.log`
+for ip in $filename
+do
+if [ `grep $ip /data/nginxlogs/iptables.log` ]
+then
+    echo "Already exists"
+else
+    echo "add"
+      /sbin/iptables -I INPUT -p tcp -s $ip --dport 80 -j DROP
+fi
+ 
+done
\ No newline at end of file