deserts
 大客部
级别: 总版主
精华:
0
发帖: 607
威望: 2 点
金钱: 1061 RMB
贡献值: 0 点
在线时间:1761(小时)
注册时间:2006-01-01
最后登录:2025-10-20
|
linux自动屏蔽IP工具
另存为 firewall.sh 给执行的权限 2W LL I8
X n~\Vb
#!/bin/sh *" OlO}o
# this program is used to check tcp/ip connections K8&) kfyI
# and block those ip with excessive connections )Ft+eMYti[
n5oX 51J
# my version iD cYyNE
myver="1.0RC1" Jza ?DhSAZ
mcid A%
# wake up every 120s if last check found abuse client _PGd\>Ve
wakeup_time_min=120 }%c>Hh
MtF^}/0w!`
# wake up every 300s if last check found no abuse client E`xpZ>$mPx
wakeup_time_max=300 @@-TW`G7
FSz<R*2
# rule timeout 3600s $e4N4e2x/
rule_timeout=3600 Y~!A"$
$ !$I f(
7
# check port list } 7:T?
`V:
portlist="80" }/\`'LQ
[n&ES
\o#(
# max established connection per ip )}"`$6:k`
max_active_conn=8 ~z]VDEJ{q
gMZ+kP`
# iptables chain name z`$c4p6G6
iptables_chain_name="RH-Lokkit-0-50-INPUT" 4Z=`;
4M]l~9;A
# log facility m]} U!XT
log_facility="local0" l Ix./Nf
sSwY!";
# Block policy ?*xH
HI/
ipchains_block_policy="DENY" CCt\[hl
iptables_block_policy="REJECT" z%T|L[(6
XpkOC o 02
# myself 1 tI=Dw x
myself=`basename $0` 7TI6EKr
b$D h|-8
mylogger_info() Wb cm1I)
{ X6(s][Wn
logger -p $log_facility.info -t $myself $@ 2>/dev/null 9iM%kY# )W
} Q
(q&(/
#pK"
^O*!
mylogger_debug() rev*G:
{ v[8+fd)}S
logger -p $log_facility.debug -t $myself $@ 2>/dev/null ZMiOKVl
} *TI? t
D
6@8z3JW.A
mylogger_notice() 7m]J7 +4
{ q TN)2G
logger -p $log_facility.notice -t $myself $@ 2>/dev/null 1 JIU5u)
} SA =>9L,2
to,\n"$~!
dotimeout() )$df6sq
{ Qr7v^H~E4.
mylogger_info "reset firewall when timeout arrives" RB % y($
case "$firewall" in NV9JMB{q
ipchains) d(ypFd9z
/etc/init.d/ipchains restart 1>/dev/null 2>/dev/null .PR+_a-X
if [ $? = 0 ] ; then 7 [u>#8
mylogger_info "ipchains restarted" ! d!u{1Y&
else &{+ 0a[rN
mylogger_notice "ipchains restart failed" 6W =V8
fi R(VOHFvW6
;; ^w.]1x
iptables) xb9+- { <J
/etc/init.d/iptables restart 1>/dev/null 2>/dev/null e3 :L]4t
if [ $? = 0 ] ; then l$EN7^%w
mylogger_info "iptables restarted" ArNQ }F/
else N8#j|yf
mylogger_notice "iptables restart failed"
lG94^|U
fi YE{t?Y\5
;; <"P-7/j3j
*) ^ W?cuJ8
mylogger_notice "neither ipchains nor iptables" X|eZpIA45
;; )rG4Nga5}
esac Kob,}NgqZ
GjHR.
p?-
} !@8i(!xb
T:Klr=&V
blockclient() 9N}\>L)_
{ c AEvv[
if [ -z "$1" ] || [ -z "$2" ]; then :\His{%
mylogger_notice "blockclient() missing client or port to block" 0C/ZcfFU~
return p T 8?z
fi lYQ|NL():
local ip port o1$u;}^ |
%(lO>4>|
ip=$1 }\7UU?@ n
port=$2 NSB6 2
#[lhem] IC
case "$firewall" in r%ES#\L6+|
ipchains) b h
pku=ov
mylogger_notice "blocking $1 to $2 via ipchains" 67&
hXIp
found=`ipchains -nL | egrep "^$ipchains_block_policy.*[[:space:]]+$ip[[:space:]]+.*[[:space:]]+\->[[:space:]]+$port"` K ?!qNK
if [ -z "$found" ] ; then DdgiY9a.
cmd="ipchains -I input 1 -p tcp -s $ip -d 0/0 $port -j $ipchains_block_policy 1>/dev/null 2>/dev/null" PFh ^Z L
mylogger_debug "cmd: $cmd" s.}K?)mH
`ipchains -I input 1 -p tcp -s $ip -d 0/0 $port -j $ipchains_block_policy 1>/dev/null 2>/dev/null` U@mznf* J
if [ $? != 0 ] ; then %7)=k}4
mylogger_notice "$cmd call failed" 3N+lWuE}K
return m,E$KHt (
fi .9qK88fU R
new_block=1 S 13cQ?4
ever_block=1 XWp8[Cx s
else (hzN(Dh
mylogger_info "$ip already blocked to $port" KT(Z
#$
fi ~t`s& t'c|
;; +tqErh?Al
iptables) /9w>:i81
mylogger_notice "blocking $1 to $2 via iptables" ~9dpB>+
found=`iptables -nL | egrep "^$iptables_block_policy.*[[:space:]]+$ip[[:space:]]+.*[[:space:]]+dpt:$port[[:space:]]+"` %SM;B-/zHt
if [ -z "$found" ] ; then }~XW tWbd-
cmd="iptables -I $iptables_chain_name 1 -p tcp -m tcp -s $ip --dport $port -j $iptables_block_policy 1>/dev/null 2>/dev/null" y LX $SR
mylogger_debug "cmd: $cmd" 1PkCWRpR
`iptables -I $iptables_chain_name 1 -p tcp -m tcp -s $ip --dport $port -j $iptables_block_policy 1>/dev/null 2>/dev/null` 6Dq4Q|C
if [ $? != 0 ] ; then $"^ K~5Q
mylogger_notice "$cmd call failed" >1~
/:DJ
return _IDZ.\'>$
fi $<^t][{
new_block=1 t;&XIG~
ever_block=1 <\aeC2~M
else x *eU~e_jP
mylogger_info "$ip already blocked to $port" <>cS@V5j
fi ?{{w[U6NE
;; ~U9K<_U
*) ff"wg\O4
mylogger_notice "neither ipchains nor iptables" P#,u9EIJ
;; #o.e
(C
esac z$32rt8{`v
} 1j<( ?MT-
nM
)C^$3<t
restartservice() H",B[
YK
{ Ed JL&*
local service 3FEJ
9ZyG
if [ -z "$1" ] ; then RpHl
q
mylogger_notice "no port given to see which service to be restart" o`?rj!\
return ?9b9{c'an
fi *2'8d8>R%]
dhl[=Y `
Q
case "$1" in n/H
OP
80)
--$o$ EP`
service="httpd" I UcL*
;; ${+u-Wfau
25) [M_{~1xX
service="postfix" <#63tN9
;; ]Z JoC!u
110) Q M,!-~t
service="courier-pop3d" weitDr6
;; l.[pnL D
21) |m19fg3u
service="muddleftpd" B[vj X" yg
;; BG{f)2F\
53) R
;& >PFmq
service="named" G4&s_ M$
;; \>L,X _DL
3306) `sxfj )s
service="mysqld" '[F:uA
;; Z5{a7U4z_
esac }fpya2Xt
if [ ! -z "$service" ] ; then ajbe7#}
/etc/init.d/$service restart 1>/dev/null 2>/dev/null k1 5vs
if [ $? = 0 ] ; then X
@nBj;
mylogger_notice "$service restarted" kH!Z|P s?R
else [;E%o^/^
mylogger_notice "$service restart failed" $o6/dEKQ
fi X/ ]@EF
fi a(Y'C`x
}
~/:vr
E(qYCafC
docheckport() U%{GLO
{ 7AG|'s['=
mylogger_info "do check port $1" ^({
)t
local port last_client count client total_count fBO/0u W
T& U}}iWN
if [ -z "$1" ] ; then V>$ ( N/1
mylogger_notice "docheckport() port not given" Y~ ~Dg?e
return 8(3(kZx S
fi pj l%Jm
N'^>pSc4W|
port=$1 ];r!
M0
\BOoY# !a
clientlist=`netstat -an --tcp| grep ESTABLISHED | awk "{ if ( index(\\$4,\":$port\") ) print \\$5}" | awk -F ':' '{print $1}'|sort` W? 7l-k=S
if [ $? != 0 ] ; then EIi<g2pM(
mylogger_notice "netstat call failed" hW7u#PY
return 6fwNlC/9
fi $Dg-;I
#echo $clientlist >Wg=
Tuef
# reset new_block T+8Yd(:hX
new_block=0 $0* sj XV
count=0 jKS j );
total_count=0 eg mUUuO
last_client="" '. }}k! #
for client in $clientlist o$_0Qs$
do J
_s`G
#echo "client is $client" 7j&
t{q5
if [ -z "$last_client" ] ; then xL* psj
count=$((count+1)) Zl
V
total_count=$((total_count+1)) "tEp8 m
last_client=$client M-WSdG[AJ
else ITPE2x
if [ "$client" = "$last_client" ] ; then z$ ^d_)
count=$((count+1)) 7o4E_ .*
total_count=$((total_count+1)) A#>wbHjWF
else 'CBwE&AL
mylogger_debug "$last_client $count connections" a %go[_w
if [ $count -ge $max_active_conn ] ; then ] #~J[uk
mylogger_notice "client $last_client connection $count >= $max_active_conn" 0 '&C5v'
blockclient $last_client $port lM-\: Q!
fi Quth5
count=1 Nr4Fp`b8
total_count=$((total_count+1)) Q`CuZkP(
last_client=$client e\)%<G5
fi q/U-WQ<+
fi ,#a4P`q'iC
done TtJX(N~
# check the last client LP3#f {U
if [ ! -z "$client" ] ; then kV- <[5AWW
count=$((count+1)) QW..=}pL
total_count=$((total_count+1)) )\U:e:Z ae
mylogger_debug "$client $count connections" =i~
= |K!
if [ $count -ge $max_active_conn ] ; then @Y
~gd
K
mylogger_notice "client $client connection $count >= $max_active_conn" J~x]~}V&
blockclient $client $port 6 `6 I<OJ\
fi {\Pk;M {Y&
fi COi15( G2
mylogger_info "total connections on port $port: $total_count" _ $PeFE2
b
esc7!S
if [ $new_block = 1 ] ; then {[uhIJD3g6
restartservice $port (~|)Gmq2
fi za>%hZf\
} |E13W
N\|B06X
docheckall() O!PG ZuF
{ jS,Pu%f R
# reset wakeup_time E2Sj IR}
wakeup_time=$wakeup_time_max erI&XI
for port in $portlist ['QhC( {
do o. $ 48h
(
docheckport $port eg~
Dm>Es
if [ $new_block = 1 ] ; then [KUkv
# set wakeup_time shorter cause we found some abuse client _Q:ot'(~0-
wakeup_time=$wakeup_time_min %g*nd#wG
fi 9#H0|zL
done 2k!uk6
} I'D 3~UI f
NO/$} vw
if [ -z "$firewall" ] && [ -f /etc/sysconfig/ipchains ] ; then %X\J %Fj
firewall="ipchains" Qc33C A
fi hW~% :v
qY&(O`?m&
if [ -z "$firewall" ] && [ -f /etc/sysconfig/iptables ] ; then tzl,r "k3
firewall="iptables" }?b\/l <
fi
TrZ!E`~
e_Zs4\^ef
if [ -z "$firewall" ] ; then =}ZY`O*/
echo "Error: This machine does not have ipchains or iptables firewall support" {\?f|mm q
exit 1 @"cnPLh&
fi [:,|g;=Y}
c[1{>z {G
mylogger_info "firewall.sh v$myver ValueOf.com starting" qZQm*q(jM
mylogger_info "Firewall is: $firewall" Fpt
tH?^
mylogger_info "Port protected: $portlist" qHrIs-NR
mylogger_info "Max connection per ip: $max_active_conn" [)Ia Xa
mylogger_info "Min time to check: $wakeup_time_min""s" &x j40IZ
mylogger_info "Max time to check: $wakeup_time_max""s" X"8$,\wX ,
mylogger_info "Timeout circle: $rule_timeout""s" qvsfU*wo?
mylogger_info "Output is logged to: $log_facility" yl <=_Q
z:n
JN%Qb
# if new ip blocked at this check run? o
W7;t
new_block=0 Nf~B 1vkp
# if new ip blocked at this timeout run? 2 }{[ J
ever_block=0 G*v,-O
# reset wakeup_time qztL M?iV
wakeup_time=$wakeup_time_max e mq%"
;.
Xp^>SSt:4
lasttime=`date +%s` >03JQe_#*L
jaTCRn3|<
while [ 1 ] ^-}3 +YA
do ~ "~uXNd
curtime=`date +%s` BD ,3JDqT
timediff=$((curtime-lasttime)) D@mqfi(x
#echo "timediff: $timediff" ,g)9ZP.F
if [ $timediff -ge $rule_timeout ] && [ $ever_block = 1 ] ; then I>3G"[t
lasttime=$curtime atFu
KYI
ever_block=0 I8hmn@ ce
dotimeout q r/N ?,
fi 6 d CqS
docheckall ffQ&1T<
mylogger_info "sleep for $wakeup_time""s" E }w<-] 8
sleep $wakeup_time j%&^q D,
done Bo a?Ghg
X/wqfP
|}roR{gc|
=HvLuVc
1. 说明 j#XU\G
firewall.sh是一个shell脚本程序，每隔一段时间检查tcp连接的统计信息，如果来自某个ip对某个端口的活动连接超过规定的最大数量， lO|H:7
则自动将该IP对该端口的访问屏蔽，并重新启动相应的服务。再每隔一段时间，会重设防火墙到初始状态。 d3C*]|gQ
该程序可以同时保护多个端口 z//6yr
D#9W [6
2. 安装 ^coJ" [D
tar zxf firewall-1.0b.tar.gz ZGOI8M]@
cd firewall-1.0b
I1(,
J
install -m 700 firewall.sh /usr/prima/sbin/firewall.sh 7,"1%^tU
,
v6[#NU_Z
3. 配置 86@@j*c(@k
主要配置项目如下： ~F]- +|
# 最小检查周期，缺省为120秒 M:(k7a+[^
wakeup_time_min=120 #/1,Cv yj
yz2NB?)
# 最大检查周期，缺省为300秒 f;% 4O'
wakeup_time_max=600
S,v9\wN.
Z)(C7,Xu
# 重设防火墙状态的时间，缺省为3600秒 G>{;@u
rule_timeout=3600 1 8!0H l>
]Ikj Z=
# 保护的端口列表，缺省为80和25，支持的其他端口包括21(ftp), 110(pop3), 53(named), 3306(mysql) an<tupi[E
# 一般的网络攻击都是针对80和25，又以80居多 _B|g)Rdv
portlist="80 25" HW GlC <
^IM;D)X&:
# 每个ip可占用的最大活动（Established）连接数 X;p,Wq#D'
max_active_conn=8 p2 y
h
s\Cl3
# iptables防火墙规则链名称，必须和/etc/sysconfig/iptables中一致 }EO n=*
# 如果用的是ipchains，可以忽略此项 d8
ve$X
iptables_chain_name="RH-Lokkit-0-50-INPUT"
Y rgwR
z0Gh |N@)
# 日志输出目标 Qo{^jDe,c*
log_facility="local0" &ze'V
, :
H, =??wN
**** 关于检查周期 **** '&T4ryq3"
程序定义了两个检查周期，如果上次检查中屏蔽了某个IP，则程序会更频繁地检查连接情况，反之则等待更长时间。通过检查周期 r"rID
RQ"
的动态调整，可以有效调度在遭受攻击和正常状态下程序的运行次数。 |g 4!Yd
y)#Ib*?
**** ipchains vs iptables **** J/wot, j^
目前该程序支持ipchains和iptables两种软件防火墙，使用何种是由程序启动时自动检测的。如果/etc/sysconfig/ipchains和 6 576
RT
/etc/sysconfig/iptables都没有检测到，则报错退出。 /5r[M=_ihr
.Fh5:W N
**** 日志输出 ****
[?Aq#av
程序的输出信息记录在系统日志中，目标是local0。如果没有特殊配置，可以在/var/log/messages中看到。建议在/etc/syslog.conf _.FxqH>
中加入一条： S)$ES6]9/
local0.* /var/log/firewall.log =UNzjmP503
然后重新启动syslog +\ .gd L)
/etc/init.d/syslog restart UwdcU^xt9
这样，可以将firewall.sh输出的日志单独记到文件/var/log/firewall.log里。 eB!0: nHN
Z^`>;n2
4. 运行 Dw6Q2Gnv
/usr/prima/sbin/firewall.sh & )Cyrs~
pU`Q[HOs
范例输出： }L@!TWR-Qu
*** firewall.sh v1.0b ValueOf.com*** &Cdk%@Tj]B
Firewall is: ipchains 0xC {Lf&
Port protected: 80 25 P* R`3Y,
Max connection per ip: 8 V!3O
1
Min time to check: 120s 81H04L9K 7
Max time to check: 300s ~XQN4Tv-
Timeout circle: 3600s 0rA&_K[#-<
Output is logged to: local0 S1;#5 8
+ lU:I
察看/var/log/firewall.log，可以看到： cq
% =D
Z
Oct 16 14:08:55 server firewall.sh: do check port 80 // 检查80端口 $0sU h]7y
Oct 16 14:08:55 server firewall.sh: 192.168.0.60 2 connections // 有两个来自192.168.0.60的连接 Ry[VEn>C1
Oct 16 14:08:55 server firewall.sh: total connections on port 80: 2 // 80端口总共2个连接 :%)l* [
Oct 16 14:08:55 server firewall.sh: do check port 25 // 检查25端口 m_Z%[@L
Oct 16 14:08:55 server firewall.sh: total connections on port 25: 0 // 25端口没有连接 K
)1K ]
Oct 16 14:08:55 server firewall.sh: sleep for 300s // 等待300秒 xAQ=oF
+
lJu2}XR iU
5. 停止 )1Os +0az
先用ps命令察看firewall.sh进程的进程号，然后用kill命令将其终止，如 qnv9?Xh
# ps auxww|grep firewall.sh 6#KRI%adw`
root 27932 0.0 0.5 2312 1060 pts/2 S 12:38 0:00 /bin/sh /usr/prima/sbin/firewall.sh .z7F58
root 27967 0.0 0.3 1732 592 pts/2 S 12:39 0:00 grep firewall.sh
\ d+&&ns
第一行即firewall.sh的进程，用kill命令： X9#Od9cNaC
# kill 27932 Mfuw y
[1] Terminated /usr/prima/sbin/firewall.sh $2
~RZpS
即将其终止
|
常州电信/网通机房,100M共享/10M独享/1000M共享/100M独享/电信+网通双线路服务器托管
Tel：0519-89991155 企业QQ：4006023839 5y6s Inc.
|
|
[楼 主]
|
Posted: 2008-01-26 02:12 |
| |
常州五颜六色网络技术有限公司 -> 网站建设 -> linux自动屏蔽IP工具
