deserts
 大客部
级别: 总版主
精华:
0
发帖: 607
威望: 2 点
金钱: 1061 RMB
贡献值: 0 点
在线时间:1761(小时)
注册时间:2006-01-01
最后登录:2025-02-11
|
linux自动屏蔽IP工具
另存为 firewall.sh 给执行的权限 HA 8A}d~
/6Q]f
#!/bin/sh vRH^
en
# this program is used to check tcp/ip connections F$DA/{.D
# and block those ip with excessive connections
:P}3cl_
j &,Gv@
# my version )M.s<Y
myver="1.0RC1" +HBizJ9K
>({qgzV`
# wake up every 120s if last check found abuse client EP#2it]0]
wakeup_time_min=120 ttUK~%wSx
WI4<2u;
# wake up every 300s if last check found no abuse client ;. Bz' Q
wakeup_time_max=300 &RYdSXM
JyZuj>`
6
# rule timeout 3600s !h4T3sO
rule_timeout=3600 4WvW11q8U
":$4 /b6
# check port list ,Q56A#Y \
portlist="80" >Xk42zvqn
salC4z3
# max established connection per ip EW*sTI3
max_active_conn=8 @w8} ]S
R>O_2`c
# iptables chain name >O?WRC B
iptables_chain_name="RH-Lokkit-0-50-INPUT" )] j3-#
uK@d?u!`
# log facility dhtH&:J< ;
log_facility="local0" 6p4BsWPx
xT"V9t[f
# Block policy 9>&zOITTaL
ipchains_block_policy="DENY" Nu6NyYs
iptables_block_policy="REJECT" iSCkV2
p7
5o1RU
# myself &`I (QY
myself=`basename $0` #gQn3.PX+y
p-}X=O$
mylogger_info() @e)}#kN.
{
X%
'z
logger -p $log_facility.info -t $myself $@ 2>/dev/null <2U@O`
gC
} `f>!/Zm%9
t Ly:F*1i
mylogger_debug() O6hzOyNX@
{ pJ]
Ix *M
logger -p $log_facility.debug -t $myself $@ 2>/dev/null 0
$)Q@#
} lD ,2])>
G]>yk_#/\U
mylogger_notice() )$n% 4 :
{ r
!Aj5
logger -p $log_facility.notice -t $myself $@ 2>/dev/null LDjtkD.r
} '3b\d:hN
N_c44[ z 1
dotimeout() XZIapT
{ Wi&v?nm
mylogger_info "reset firewall when timeout arrives" Ks%0!X?3q
case "$firewall" in t neTOj
ipchains) OBAO(Ke
/etc/init.d/ipchains restart 1>/dev/null 2>/dev/null J9mK9{#q
if [ $? = 0 ] ; then StI
N+S@Z
mylogger_info "ipchains restarted" P zso^^g
else }emUpju<C
mylogger_notice "ipchains restart failed" t*(b F[?
fi cdMSC7l!
;; &42 ]#B"*
iptables) _RIU,uJs
/etc/init.d/iptables restart 1>/dev/null 2>/dev/null qi,) l*?f
if [ $? = 0 ] ; then y*iZ;Bv j
mylogger_info "iptables restarted"
~71U s
else Z Ts*Y,
mylogger_notice "iptables restart failed" z&%i"IY
fi '8q3ub<\
;; "h+
Z [h6T
*) cI2Ps3~"Q
mylogger_notice "neither ipchains nor iptables" Y7t#)?
;; ='m$ O
esac N
)Z>]&5
ZsP^<
} tRo Sq;VrS
v? `R8
blockclient() *wTX
{ |*{*tW C1
if [ -z "$1" ] || [ -z "$2" ]; then %%No XW
mylogger_notice "blockclient() missing client or port to block" X/4CXtX^
return WzzA:X
fi e/D{^ *~S
local ip port SP%X@ ~d
Bq8#'K2i,
ip=$1 ~}_^$l8#-Q
port=$2
| #yu
zb0NqIN:
case "$firewall" in #&|"t< }
ipchains) M1Q&)am
mylogger_notice "blocking $1 to $2 via ipchains" \tgY2 :
found=`ipchains -nL | egrep "^$ipchains_block_policy.*[[:space:]]+$ip[[:space:]]+.*[[:space:]]+\->[[:space:]]+$port"` tb&?BCp
if [ -z "$found" ] ; then o26Y }W
cmd="ipchains -I input 1 -p tcp -s $ip -d 0/0 $port -j $ipchains_block_policy 1>/dev/null 2>/dev/null" ( :bf m
mylogger_debug "cmd: $cmd" \n_
7+[=E
`ipchains -I input 1 -p tcp -s $ip -d 0/0 $port -j $ipchains_block_policy 1>/dev/null 2>/dev/null` L0![SE>
if [ $? != 0 ] ; then &y _t,8>5
mylogger_notice "$cmd call failed" F8w7N$/V",
return =CQfs6np:N
fi MXSD8]j e
new_block=1 SWdmej[
ever_block=1 XIIq0I
else q[A i^79
mylogger_info "$ip already blocked to $port" oRbWqN`
F.
fi ranem0KQ)]
;; DGJ:#U E
iptables) f,ro1Nke
mylogger_notice "blocking $1 to $2 via iptables" M{L<aYe
found=`iptables -nL | egrep "^$iptables_block_policy.*[[:space:]]+$ip[[:space:]]+.*[[:space:]]+dpt:$port[[:space:]]+"` D*.3]3-I
if [ -z "$found" ] ; then URVW5c
cmd="iptables -I $iptables_chain_name 1 -p tcp -m tcp -s $ip --dport $port -j $iptables_block_policy 1>/dev/null 2>/dev/null" !/}4_s`,
mylogger_debug "cmd: $cmd" >"/TiQt
`iptables -I $iptables_chain_name 1 -p tcp -m tcp -s $ip --dport $port -j $iptables_block_policy 1>/dev/null 2>/dev/null` !
hHe`
if [ $? != 0 ] ; then 8g=O0Gb
mylogger_notice "$cmd call failed" w^L `"
return =)bOteWM
fi 7 O)ATb#up
new_block=1 Xf;!w:u
ever_block=1 TD\TVK3P
else /,I?"&FWc
mylogger_info "$ip already blocked to $port" Rc)]A&J
fi n WelM2
;; moM'RO,M
*) :/6:&7s
mylogger_notice "neither ipchains nor iptables" 6%EpF;T`
;; OC5oxL2HTe
esac Rs<S}oeLn
} x6>WvF
Z
UVXruH
restartservice() FBNi (D
{ 6 w!qZ4$
local service em'3 8L|(
if [ -z "$1" ] ; then n}NUe`E_h
mylogger_notice "no port given to see which service to be restart" MeD/)T{G~
return '!X` X=
fi '\H
& EJ'
u
YTyR;a
case "$1" in U;&s=M0 [
80) H"+|n2E^
service="httpd" F\+9u$=
;; SFWS<H(IN
25) MXVCu"g%
service="postfix" 7OZ0 ;fK
;; +L?;g pVE&
110) B%Oi1b O
service="courier-pop3d" 6#d+BBKIc
;; 0Ns Po
21) -}qay@cDt
service="muddleftpd" 8QFRX'i
;; #!z'R20PH
53) "gpfD-BX
service="named" 7<Ut/1$MI
;; :)_P7k`>e/
3306) -J!k|GK#MX
service="mysqld" #$t93E I
;; .@(MNq{"6
esac z<"\I60Fe
if [ ! -z "$service" ] ; then ;hDIoSz
/etc/init.d/$service restart 1>/dev/null 2>/dev/null ' vIVsv<p
if [ $? = 0 ] ; then K0^+2lx
mylogger_notice "$service restarted" )N
^ g0 L
else !]f:dWSLB
mylogger_notice "$service restart failed" h1_KZ[X
fi d~d~Cd`V
fi 3Z)vJC9'
} YsjTC$Tx,
47/YD y%
docheckport() LTY(6we-
{ <
uzDuBN
mylogger_info "do check port $1" z I>,A|yy
local port last_client count client total_count 9%u
J:
c?
_1Iw"K49Qx
if [ -z "$1" ] ; then m>?{
flO
mylogger_notice "docheckport() port not given" a
U*cwR
return cbA90 8@s
fi z Tt6L6:u
Hb *&&
port=$1 \.dvRI'
yX8$LOjE
clientlist=`netstat -an --tcp| grep ESTABLISHED | awk "{ if ( index(\\$4,\":$port\") ) print \\$5}" | awk -F ':' '{print $1}'|sort` q:v&wb%
if [ $? != 0 ] ; then xBcE>^{1.
mylogger_notice "netstat call failed" ZA4vQDW
return M>g\ Y
fi -5yEd>Z
#echo $clientlist rOy-6og
# reset new_block Hlq#X:DCn
new_block=0 {^
^)bf|1'
count=0 2^7VDqLc
total_count=0 Ik4U+'z6
last_client="" DrB PC@^
for client in $clientlist qMe$ Qr8
do }A`4 ae=
#echo "client is $client" %<8lLRl
if [ -z "$last_client" ] ; then C_ = WL(
count=$((count+1)) +
>oA@z
total_count=$((total_count+1)) Ie~#k[ X
last_client=$client hIPU%
else X
aV
h.
if [ "$client" = "$last_client" ] ; then <x),HTJ
count=$((count+1)) ]?`t
spm<t
total_count=$((total_count+1)) Tn qspS2;R
else y-93 >Y
mylogger_debug "$last_client $count connections" x%JtI'sg
if [ $count -ge $max_active_conn ] ; then (P[:g
mylogger_notice "client $last_client connection $count >= $max_active_conn" afcI5w;>}
blockclient $last_client $port X99:/3MXB'
fi io$!z=W
count=1 g,!6, v@
total_count=$((total_count+1)) MGd 7Ont
last_client=$client shOQ/
fi eEIa=MB*
fi g jJ?*N[
done #$QC2;/)F
# check the last client }^;Tt-*k
if [ ! -z "$client" ] ; then ^|?/
y=
count=$((count+1)) i*'
6"
total_count=$((total_count+1)) :;S]jNy}j)
mylogger_debug "$client $count connections" w ^?uBeqR
if [ $count -ge $max_active_conn ] ; then C{<qc,!4
mylogger_notice "client $client connection $count >= $max_active_conn" cWSiJr):r
blockclient $client $port A=/|f$s +
fi %:2<'s2Si
fi :[oFe/1K!4
mylogger_info "total connections on port $port: $total_count" ]?p&sI4
w%&lCu@v
if [ $new_block = 1 ] ; then mr ]IxTv
restartservice $port \e64Us>"x
fi p=v u<xXtD
} E`3yf9"
<taN3
docheckall() P)Vm4u
1
{ J fFOU!F\
# reset wakeup_time p9ligs7V'
wakeup_time=$wakeup_time_max ^fT|Wm<
for port in $portlist o;+$AU1 f
do 48JD >=@7
docheckport $port 6vySOVMj
if [ $new_block = 1 ] ; then Z&gM7Zo8
# set wakeup_time shorter cause we found some abuse client P
MzPe"3M
wakeup_time=$wakeup_time_min E Z95)pk
fi <RfPd+</
done kZ XsL
} dGU io?
<<}t&qE%2%
if [ -z "$firewall" ] && [ -f /etc/sysconfig/ipchains ] ; then :feU
firewall="ipchains" <u2 rb6
fi fG2hCP+
a[;TUc^I1F
if [ -z "$firewall" ] && [ -f /etc/sysconfig/iptables ] ; then :=qblc
firewall="iptables" ?-mDvW
fi #p@8 m_g
kk_$j_0
if [ -z "$firewall" ] ; then * "4d6
echo "Error: This machine does not have ipchains or iptables firewall support" \mRRx#-r%
exit 1 3T)GUzt`
fi <T?H
H$es)
w E^6DNh
mylogger_info "firewall.sh v$myver ValueOf.com starting" FV >j
!>Y
mylogger_info "Firewall is: $firewall" jb~2f2vUa
mylogger_info "Port protected: $portlist" 5ve4u
mylogger_info "Max connection per ip: $max_active_conn" gd~# uR\
mylogger_info "Min time to check: $wakeup_time_min""s" >05_#{up
mylogger_info "Max time to check: $wakeup_time_max""s" $F V!HD
mylogger_info "Timeout circle: $rule_timeout""s" x8H%88!j*
mylogger_info "Output is logged to: $log_facility" 6*3J3Lc_<
t
Dx!m~[
# if new ip blocked at this check run? q:A{@kFq_
new_block=0 V\k?$}
# if new ip blocked at this timeout run? d5?"G Fy
ever_block=0 fNz*E|]8&
# reset wakeup_time x!$Dje}
wakeup_time=$wakeup_time_max 5r1{l%?
dxm_AUM
lasttime=`date +%s` K}^Jf ;
ISo{>@a-
while [ 1 ] Sb_ T _m
do XAN{uD^3\%
curtime=`date +%s` ~_vzss3-C
timediff=$((curtime-lasttime)) )3O0: ]
<H
#echo "timediff: $timediff" u@!iByVAg
if [ $timediff -ge $rule_timeout ] && [ $ever_block = 1 ] ; then W`zY\]
lasttime=$curtime 4 {2)ZI#
ever_block=0 Wj N0KA
dotimeout @D.]P Zf
fi Mp;yv atO
docheckall fn eg[K
mylogger_info "sleep for $wakeup_time""s" }@Mx@ S
sleep $wakeup_time D8+68_BEM
done G$\2@RT9[
L M_/:
u*R9x3&/5
F+e
J9
1. 说明 yK"OZ2Mv
firewall.sh是一个shell脚本程序，每隔一段时间检查tcp连接的统计信息，如果来自某个ip对某个端口的活动连接超过规定的最大数量， -"L)<J@gQ?
则自动将该IP对该端口的访问屏蔽，并重新启动相应的服务。再每隔一段时间，会重设防火墙到初始状态。 -e_+x'uF
该程序可以同时保护多个端口 ,WF)GS|7V
q9n0bw^N
2. 安装 A[juzOn\
tar zxf firewall-1.0b.tar.gz :j/PtNT@
cd firewall-1.0b yVPkJ
install -m 700 firewall.sh /usr/prima/sbin/firewall.sh ?
C2 bA5 M
#80*3vi~F
3. 配置 :=#*[H
主要配置项目如下： I>b-w;cC
# 最小检查周期，缺省为120秒
hA`>SkO
wakeup_time_min=120 Xq&x<td
8uME6]m
i
# 最大检查周期，缺省为300秒 OwGl&
wakeup_time_max=600 (sw1 HR
%l@Q&)f8e
# 重设防火墙状态的时间，缺省为3600秒 t#|E.G:=
rule_timeout=3600 qx5X2@-;:
$ 1(u.Ud
# 保护的端口列表，缺省为80和25，支持的其他端口包括21(ftp), 110(pop3), 53(named), 3306(mysql) maLJ M\C
# 一般的网络攻击都是针对80和25，又以80居多 5Ah-aDBj
portlist="80 25" =K2Dxu_:
*qg9~/
# 每个ip可占用的最大活动（Established）连接数 O?@1</r ^
max_active_conn=8 lwLK#_5u
(H9%a-3
# iptables防火墙规则链名称，必须和/etc/sysconfig/iptables中一致 ovCk :Vz
# 如果用的是ipchains，可以忽略此项 CGg:e:4
iptables_chain_name="RH-Lokkit-0-50-INPUT" 32:, g4!~6
6__@?XzJ
# 日志输出目标 8 Oeg"d
log_facility="local0" C5Q|3 d
(~pcPGUG
**** 关于检查周期 **** }M /w 0U0o
程序定义了两个检查周期，如果上次检查中屏蔽了某个IP，则程序会更频繁地检查连接情况，反之则等待更长时间。通过检查周期 tH:ea $A
的动态调整，可以有效调度在遭受攻击和正常状态下程序的运行次数。 ;JFE7\-mC
'KQ ]7
**** ipchains vs iptables **** uYL6g:]+ZC
目前该程序支持ipchains和iptables两种软件防火墙，使用何种是由程序启动时自动检测的。如果/etc/sysconfig/ipchains和 $E|W |4 N
/etc/sysconfig/iptables都没有检测到，则报错退出。 G"MpA[ a_
Xkl^!,
**** 日志输出 **** XoSjYG(>,
程序的输出信息记录在系统日志中，目标是local0。如果没有特殊配置，可以在/var/log/messages中看到。建议在/etc/syslog.conf vyV n5 s
中加入一条： v}z o v Ei
local0.* /var/log/firewall.log zx-+u7qKH
然后重新启动syslog ENC_#- 1x
/etc/init.d/syslog restart T<54qe4`p
这样，可以将firewall.sh输出的日志单独记到文件/var/log/firewall.log里。 e%bER ds
(53d l(L?
4. 运行 @+1E|4L1vf
/usr/prima/sbin/firewall.sh & <O5 ;w
`N (.10~
范例输出： #j-,#P@
*** firewall.sh v1.0b ValueOf.com*** bwVv#Z\r
Firewall is: ipchains %hrv~ =
Port protected: 80 25 [=U7V;5($
Max connection per ip: 8 =V5.c+
Min time to check: 120s sF+0v p
Max time to check: 300s A^,( Vyd
Timeout circle: 3600s b V9Z[[\
Output is logged to: local0 ys#M*
{?
TdKl`"Iy
察看/var/log/firewall.log，可以看到： "[[fQpe4@
Oct 16 14:08:55 server firewall.sh: do check port 80 // 检查80端口 ~Y'e1w$`
Oct 16 14:08:55 server firewall.sh: 192.168.0.60 2 connections // 有两个来自192.168.0.60的连接 Z}NAH`V`:+
Oct 16 14:08:55 server firewall.sh: total connections on port 80: 2 // 80端口总共2个连接 ZC2C`S\xr
Oct 16 14:08:55 server firewall.sh: do check port 25 // 检查25端口 Vj2GK"$v
Oct 16 14:08:55 server firewall.sh: total connections on port 25: 0 // 25端口没有连接 b,Z&
P|
Oct 16 14:08:55 server firewall.sh: sleep for 300s // 等待300秒 =fsaJ@q ,R
NPo Xz
5. 停止 >`{i[60r
先用ps命令察看firewall.sh进程的进程号，然后用kill命令将其终止，如 2#(7,o}Y5
# ps auxww|grep firewall.sh ;~1r{kXxA"
root 27932 0.0 0.5 2312 1060 pts/2 S 12:38 0:00 /bin/sh /usr/prima/sbin/firewall.sh Ki=7nKs
root 27967 0.0 0.3 1732 592 pts/2 S 12:39 0:00 grep firewall.sh Q}=RG//0*
第一行即firewall.sh的进程，用kill命令： ?1N0+OW
# kill 27932 ?ft_
[1] Terminated /usr/prima/sbin/firewall.sh hf?^#=k
^
即将其终止
|
常州电信/网通机房,100M共享/10M独享/1000M共享/100M独享/电信+网通双线路服务器托管
Tel：0519-89991155 企业QQ：4006023839 5y6s Inc.
|
|
[楼 主]
|
Posted: 2008-01-26 02:12 |
| |
常州五颜六色网络技术有限公司 -> 网站建设 -> linux自动屏蔽IP工具
