deserts
 大客部
级别: 总版主
精华:
0
发帖: 607
威望: 2 点
金钱: 1061 RMB
贡献值: 0 点
在线时间:1759(小时)
注册时间:2006-01-01
最后登录:2024-11-10
|
linux自动屏蔽IP工具
另存为 firewall.sh 给执行的权限 l0`bseN <
dm[cl~[
Q
#!/bin/sh Z!~_# _Ugl
# this program is used to check tcp/ip connections \%Y`>x
.
# and block those ip with excessive connections F nXm;k,9*
^.iRU'{
# my version \V!{z;.fA
myver="1.0RC1" 0$c(<+D
yP# Y:s
# wake up every 120s if last check found abuse client SyI~iW#Y
1
wakeup_time_min=120 <(@S;?ZEW
0Zwx3[bq6K
# wake up every 300s if last check found no abuse client ]
&" `
wakeup_time_max=300 BRM `/s
F7O*%y.';
# rule timeout 3600s Qx,#Hj
rule_timeout=3600 Qd YYWD
%V ]v,
# check port list fXWE4^jU
portlist="80" f!yl&ulKU
FWW@t1)
# max established connection per ip yH-&o,
max_active_conn=8 AQ(n?1LU
[<U=)!Swg
# iptables chain name 0Yq_B+IC
iptables_chain_name="RH-Lokkit-0-50-INPUT" % vy,A*
#tHYCSr]
# log facility nTo? ~=b
log_facility="local0" C}<e3BXc
$mKEx W
# Block policy k
m9#lK
ipchains_block_policy="DENY" QeFt
WjlqC
iptables_block_policy="REJECT" ga\ s5
C.#Ha-@uz
# myself .!L{yU,
myself=`basename $0` (_FeX22+
G$'UK
mylogger_info() >6&Rytcc]
{ cE`qfz
logger -p $log_facility.info -t $myself $@ 2>/dev/null {`*Fu/Upb
} ,.2qh |Ol
_ ~yd
mylogger_debug() /m p !%j~
{ eB9&HD:
logger -p $log_facility.debug -t $myself $@ 2>/dev/null G?LC ! 9MB
} ?8s$RYp14
x|d? '
mylogger_notice() )sK53O$
{ & +k*+
logger -p $log_facility.notice -t $myself $@ 2>/dev/null AZik:C"Q
} \Ezcr=0z{j
+Tx_q1/f5X
dotimeout() 2/A*\
{ uJ0'`Q?6R9
mylogger_info "reset firewall when timeout arrives" HEc.3
case "$firewall" in ` s+kYWg'Z
ipchains) Y d~J(
/etc/init.d/ipchains restart 1>/dev/null 2>/dev/null m:0[as=
if [ $? = 0 ] ; then -O1$jBQ S
mylogger_info "ipchains restarted"
F(lJ
else >/ A'G
mylogger_notice "ipchains restart failed" +C,/B
uG
fi {SXSQ '=
;; @' M"c
q
iptables) gzKMGL
?%?
/etc/init.d/iptables restart 1>/dev/null 2>/dev/null iV#A-9
if [ $? = 0 ] ; then gE^p On
mylogger_info "iptables restarted" yw7(!1j=
else W,80deT
mylogger_notice "iptables restart failed" B@dCCKc%/
fi
!j%
;; q `L )^In"
*) +Q);t,
mylogger_notice "neither ipchains nor iptables" 6`7bk35B
;; kn$_X4^?
esac ;Sg.E 8
T2azHo7
} P,-5af*;
LdNpb;*
blockclient() P3 =#<Q.
{ 9xzow,mi
if [ -z "$1" ] || [ -z "$2" ]; then ,tyPZR_
mylogger_notice "blockclient() missing client or port to block" 8{i}^.p
return HB }rpiB
fi <BZC5b6
local ip port _JNYvng m
N#e9w3Rli
ip=$1 {}Is&^3Z
port=$2 yOKzw~;0 %
9"gu >
case "$firewall" in em
0 Y' J
ipchains) ?f q!BV
mylogger_notice "blocking $1 to $2 via ipchains" wik<# ke
found=`ipchains -nL | egrep "^$ipchains_block_policy.*[[:space:]]+$ip[[:space:]]+.*[[:space:]]+\->[[:space:]]+$port"` T=M##`jP%
if [ -z "$found" ] ; then 62 _k`)k
cmd="ipchains -I input 1 -p tcp -s $ip -d 0/0 $port -j $ipchains_block_policy 1>/dev/null 2>/dev/null"
3rMJC\
h
mylogger_debug "cmd: $cmd" wi
jO2F
`ipchains -I input 1 -p tcp -s $ip -d 0/0 $port -j $ipchains_block_policy 1>/dev/null 2>/dev/null` C f d* Q
if [ $? != 0 ] ; then vWeY[>oGur
mylogger_notice "$cmd call failed" GxG~J4
return Q/0gd? U?
fi },JJ!3
new_block=1 3Z*o5@RI
ever_block=1 z5M6
else !Pnjr T
mylogger_info "$ip already blocked to $port" >|kD(}Axf
fi _\tv ${
;; [
fzYC'A=
iptables) -XCs?@8EQ
mylogger_notice "blocking $1 to $2 via iptables" XJ3sqc S
found=`iptables -nL | egrep "^$iptables_block_policy.*[[:space:]]+$ip[[:space:]]+.*[[:space:]]+dpt:$port[[:space:]]+"` ^ `Ozw^~
if [ -z "$found" ] ; then n^ fUKi*;
cmd="iptables -I $iptables_chain_name 1 -p tcp -m tcp -s $ip --dport $port -j $iptables_block_policy 1>/dev/null 2>/dev/null" h L [ eA
mylogger_debug "cmd: $cmd" -# ;xfJE
`iptables -I $iptables_chain_name 1 -p tcp -m tcp -s $ip --dport $port -j $iptables_block_policy 1>/dev/null 2>/dev/null` k"& o)*d
if [ $? != 0 ] ; then ,7)
h rA$(
mylogger_notice "$cmd call failed" ;; +AdN5
return G)}[!'<rR
fi ur'<8pDb$
new_block=1 H@xS<=:lM
ever_block=1 -]z b3P
else A[;
deHg=
mylogger_info "$ip already blocked to $port" N?vb^?
fi ;NRh0)%|o
;; 0!dNW,NfJ
*) -\? -
mylogger_notice "neither ipchains nor iptables" @ y ;VV*
;; g-d{"ZXd J
esac k Mch
} lF}@ @e)N
m k1R~4v
restartservice() t f6m .
{ ,R`CAf%*
local service 'M"z3j]m-,
if [ -z "$1" ] ; then a pa&'%7
mylogger_notice "no port given to see which service to be restart" JL87a^ro
return }/1^Lqfnz
fi ,ZJ}X 9$<
/ =6_2t#vA
case "$1" in UDi(7c0.
80) (v/L
service="httpd" _ D4qnb@
;; PM[ W7g T
25) M{24 MF
service="postfix" #h=V@Dh
;; *bFWNJ}`q
110) EX{%CPp7}
service="courier-pop3d" L D[ \eJ _
;; k(H]IL L
21) i_*yS+Z;
service="muddleftpd" bDWL Hdu
a
;; 9]=J + (M
53) 1r> ]XhRFZ
service="named" x
W )
;; Nxe1^F33
3306) !8UIyw
service="mysqld" ZskX!
{
;; Q9OCf"n $
esac pl
r@
if [ ! -z "$service" ] ; then M4)U
[v
/etc/init.d/$service restart 1>/dev/null 2>/dev/null "W+>?u )
if [ $? = 0 ] ; then b(N\R_IQ~
mylogger_notice "$service restarted" ~vDa2D<9%
else )@DDs(q=i
mylogger_notice "$service restart failed" vai w*?jV
fi Vc5> I_
fi -'qVnu
} $`Gl
XiV
=M-=94
docheckport() OcV,pJ
{ 2Pm}wD^`
mylogger_info "do check port $1" 3 orZ BT
local port last_client count client total_count Z4Q]By:/L
$)NS]wJ]3
if [ -z "$1" ] ; then 0'6ai=W
mylogger_notice "docheckport() port not given" }&/>v' G
return &C b,C+q
fi h=`$ec
V5$ Gb6?K
port=$1 rkji#\_-FV
Kw" e4 a
clientlist=`netstat -an --tcp| grep ESTABLISHED | awk "{ if ( index(\\$4,\":$port\") ) print \\$5}" | awk -F ':' '{print $1}'|sort` 2iM}YCV
if [ $? != 0 ] ; then G@Z%[YNw
mylogger_notice "netstat call failed" R K-
bsf
return 4>oM5Yf8
fi ?=4oxPe
#echo $clientlist ]wDqdD y7S
# reset new_block }Fu1Y@M%
new_block=0 u-&V , *3l
count=0 D~ 3@v+d
total_count=0 [;I
E Z/ZX
last_client="" n\D/WL v M
for client in $clientlist @yb'h`f]
do &iw,||#
#echo "client is $client" _4)
t
if [ -z "$last_client" ] ; then
y
_ap T<P
count=$((count+1)) 9Br+ ]F _i
total_count=$((total_count+1)) M887 Q'HSi
last_client=$client RQWUO^&e^
else @1'OuX^
if [ "$client" = "$last_client" ] ; then PTe$dPB
count=$((count+1))
Txo{6nd/
total_count=$((total_count+1)) TJRp/BP
else ?;](;n#lU
mylogger_debug "$last_client $count connections" mY"Dw^)
if [ $count -ge $max_active_conn ] ; then |0
F o{
mylogger_notice "client $last_client connection $count >= $max_active_conn" >CKa?N;
blockclient $last_client $port 9$v\D3< Z
fi 9Oj b~
count=1 _5n2'\] H`
total_count=$((total_count+1)) *g}==o `
last_client=$client BeRs;^r+
fi " Vc|D (g
fi jS3@Z?x?*
done N%: uOX8{
# check the last client 1G`5FU
if [ ! -z "$client" ] ; then m oVf(7
count=$((count+1)) 6k,@+ @]t.
total_count=$((total_count+1)) _`QME r?
mylogger_debug "$client $count connections" 0j;|IU\
if [ $count -ge $max_active_conn ] ; then AS0(NlV
mylogger_notice "client $client connection $count >= $max_active_conn" Gg6cjc =dC
blockclient $client $port '% Oo1:wJ
fi G@ybx[_[@
fi 25, [<Ao
mylogger_info "total connections on port $port: $total_count" *sfz +8Y
B7{j$0fm*
if [ $new_block = 1 ] ; then QKz2ONV=)
restartservice $port E. VEW;=
fi \h zx?
} #lVSQZO~a
*Lm zGF|
docheckall() . 55aY~We
{ mW_A 3S5
# reset wakeup_time y7*^
H
wakeup_time=$wakeup_time_max XnvaT(k7Y
for port in $portlist +fIy eX
do J _| >rfW
docheckport $port >y q L
if [ $new_block = 1 ] ; then 'Uo:b<
# set wakeup_time shorter cause we found some abuse client Xg"Mjmr
wakeup_time=$wakeup_time_min JeCEj=_Z
fi Ipmr@%~
done X4*/h$48 w
} qdu:kA :]
` }Hnj*
if [ -z "$firewall" ] && [ -f /etc/sysconfig/ipchains ] ; then 3vs2}IV'
firewall="ipchains" q+G1#5
fi r*3XM{bZ/@
]g+(#x_.?
if [ -z "$firewall" ] && [ -f /etc/sysconfig/iptables ] ; then \S2'3SD d/
firewall="iptables" )I}G:bBa
fi I~T?tm
pcl _$2_
if [ -z "$firewall" ] ; then ta 4<d)nB
echo "Error: This machine does not have ipchains or iptables firewall support" SO&;]YO
exit 1 <(t<gS #
fi ^
pR&
1Q$ M/}
mylogger_info "firewall.sh v$myver ValueOf.com starting" p.IfJ|
mylogger_info "Firewall is: $firewall" e
O}mZN
mylogger_info "Port protected: $portlist" )T+htD)
mylogger_info "Max connection per ip: $max_active_conn" \^:f4Z T
mylogger_info "Min time to check: $wakeup_time_min""s" fj JIF%
mylogger_info "Max time to check: $wakeup_time_max""s" Q'Tn+}B&
mylogger_info "Timeout circle: $rule_timeout""s" 1f: k:Y9i
mylogger_info "Output is logged to: $log_facility" pL-$N p] V
Q&LkST-i
# if new ip blocked at this check run? Vqr&)i"b$
new_block=0 dA~6{*)
# if new ip blocked at this timeout run? ij),DbWd
ever_block=0 lb('r"*.
# reset wakeup_time 3^a"$VW1
wakeup_time=$wakeup_time_max ^eRuj)$5A
x @ O:
lasttime=`date +%s` YGO@X(ej,
m~ K]|]iqQ
while [ 1 ] FRW.
do ;rKYWj>IR
curtime=`date +%s` .%A2
timediff=$((curtime-lasttime)) on\\;V_ /Q
#echo "timediff: $timediff" L9@jmh*E
if [ $timediff -ge $rule_timeout ] && [ $ever_block = 1 ] ; then URgF8?n
lasttime=$curtime 96avg yc
ever_block=0 gib]#n1!p
dotimeout i.] zq
fi xTMTkVa+B
docheckall M}Mzm2d#`
mylogger_info "sleep for $wakeup_time""s" `,Gk1~Wv
sleep $wakeup_time [4 j;FN Fa
done v2 {s2kB=
vNbA/sM
b3lpNJ J
F948%?a
1. 说明 VHCzlg
firewall.sh是一个shell脚本程序，每隔一段时间检查tcp连接的统计信息，如果来自某个ip对某个端口的活动连接超过规定的最大数量， (xed(uFEK
则自动将该IP对该端口的访问屏蔽，并重新启动相应的服务。再每隔一段时间，会重设防火墙到初始状态。 tqCg<NH.!m
该程序可以同时保护多个端口 ud D[hPJd
,IE0+!I
2. 安装 QO k"UP
tar zxf firewall-1.0b.tar.gz w.p'Dpw
cd firewall-1.0b ,0]28 D
install -m 700 firewall.sh /usr/prima/sbin/firewall.sh o q) "1
%)Dd{|c
3. 配置 cV,Dl`1r
主要配置项目如下： P'9io!Z-s
# 最小检查周期，缺省为120秒 L W5ggU/
wakeup_time_min=120 -U[`pUY?f
O/oYaAlFF@
# 最大检查周期，缺省为300秒 y/hv
H"f
wakeup_time_max=600 iGVb.=)
ky$:
C,1t
# 重设防火墙状态的时间，缺省为3600秒
G;c
0
rule_timeout=3600 s
FYJQ90it
\'t z|
# 保护的端口列表，缺省为80和25，支持的其他端口包括21(ftp), 110(pop3), 53(named), 3306(mysql) oHd0
<TO
# 一般的网络攻击都是针对80和25，又以80居多 4 Olv8nOe<
portlist="80 25" L00 ;rTs>
qZ_fQ@
# 每个ip可占用的最大活动（Established）连接数 {)9HS~e T
max_active_conn=8 ieRBD6_
3nC#$L-
# iptables防火墙规则链名称，必须和/etc/sysconfig/iptables中一致 _QUu'zJ
# 如果用的是ipchains，可以忽略此项 B "F`OS[
iptables_chain_name="RH-Lokkit-0-50-INPUT" @ TPgA(5NR
#0<y 0uJ(y
# 日志输出目标 q
'{<c3&
log_facility="local0" cc(r,ij~4
DEp%\sj?
**** 关于检查周期 **** *5_ 8\7d
程序定义了两个检查周期，如果上次检查中屏蔽了某个IP，则程序会更频繁地检查连接情况，反之则等待更长时间。通过检查周期 ""v`0OP&J
的动态调整，可以有效调度在遭受攻击和正常状态下程序的运行次数。
1C,C)
FDd>(!>
**** ipchains vs iptables **** w H_n$w
目前该程序支持ipchains和iptables两种软件防火墙，使用何种是由程序启动时自动检测的。如果/etc/sysconfig/ipchains和 ,dj* p ,J
/etc/sysconfig/iptables都没有检测到，则报错退出。
6:@t=C
l88a#zUQDN
**** 日志输出 **** k s%7W
-
程序的输出信息记录在系统日志中，目标是local0。如果没有特殊配置，可以在/var/log/messages中看到。建议在/etc/syslog.conf c<h!QnJ
中加入一条： Xlqz8cI
local0.* /var/log/firewall.log T:g4D z*2\
然后重新启动syslog r0g/ :lJi
/etc/init.d/syslog restart
kF+ }.x%
这样，可以将firewall.sh输出的日志单独记到文件/var/log/firewall.log里。 oLqb R?
R<lN k<
4. 运行 [ *?_
/usr/prima/sbin/firewall.sh & Hr <C2p^a
|:(23O
范例输出： Vh#Mp!
*** firewall.sh v1.0b ValueOf.com*** r}y[r }vk
Firewall is: ipchains EOBs}M;
Port protected: 80 25 iO9n vM<
Max connection per ip: 8 Q 9yGQu
Min time to check: 120s %CxEZPe$
Max time to check: 300s &'huS?g A9
Timeout circle: 3600s f
E .L
Output is logged to: local0 U BhciZ
y Nri nYw
察看/var/log/firewall.log，可以看到： j Ne(w<',P
Oct 16 14:08:55 server firewall.sh: do check port 80 // 检查80端口 eC>"my`
Oct 16 14:08:55 server firewall.sh: 192.168.0.60 2 connections // 有两个来自192.168.0.60的连接 yV J dZ I
Oct 16 14:08:55 server firewall.sh: total connections on port 80: 2 // 80端口总共2个连接 Sg. +`xww3
Oct 16 14:08:55 server firewall.sh: do check port 25 // 检查25端口 mFqSD
Oct 16 14:08:55 server firewall.sh: total connections on port 25: 0 // 25端口没有连接 <$ i"zb
Oct 16 14:08:55 server firewall.sh: sleep for 300s // 等待300秒 @cu D8<\i
i \ =z'
5. 停止 F-BJe]
先用ps命令察看firewall.sh进程的进程号，然后用kill命令将其终止，如 a>wfhmr
# ps auxww|grep firewall.sh <`R|a *
root 27932 0.0 0.5 2312 1060 pts/2 S 12:38 0:00 /bin/sh /usr/prima/sbin/firewall.sh G3RrjWtO
root 27967 0.0 0.3 1732 592 pts/2 S 12:39 0:00 grep firewall.sh lQV| U;~D
第一行即firewall.sh的进程，用kill命令： 7$!`p,@we/
# kill 27932 ?xtt7*'D
[1] Terminated /usr/prima/sbin/firewall.sh EKZ$Q4YE
即将其终止
|
常州电信/网通机房,100M共享/10M独享/1000M共享/100M独享/电信+网通双线路服务器托管
Tel：0519-89991155 企业QQ：4006023839 5y6s Inc.
|
|
[楼 主]
|
Posted: 2008-01-26 02:12 |
| |
常州五颜六色网络技术有限公司 -> 网站建设 -> linux自动屏蔽IP工具
