deserts
 大客部
级别: 总版主
精华:
0
发帖: 607
威望: 2 点
金钱: 1061 RMB
贡献值: 0 点
在线时间:1761(小时)
注册时间:2006-01-01
最后登录:2025-02-11
|
linux自动屏蔽IP工具
另存为 firewall.sh 给执行的权限 D'U\]'.
Fj[ dO&
#!/bin/sh
^XjvJa
# this program is used to check tcp/ip connections aM~M@wS
# and block those ip with excessive connections ]x! vPIyq
9J*m!- hOY
# my version [K,&s8N5
myver="1.0RC1" ACc.&,!IZ
zS]Yd9;X1
# wake up every 120s if last check found abuse client pz~AsF
wakeup_time_min=120 g;Bq#/w
Sw>AgES
# wake up every 300s if last check found no abuse client Gb\}e}TB[
wakeup_time_max=300 }fUV*U:3
$U3s:VQ'
# rule timeout 3600s g tJUQu p2
rule_timeout=3600 yD(0:g#
D O(FG-R
# check port list "3W!p+W
portlist="80" PKty'}KF
Jcy
# max established connection per ip Q];+?Pu.
max_active_conn=8 kL{2az3"c
.^fq$7Y}7
# iptables chain name ySL 31%
iptables_chain_name="RH-Lokkit-0-50-INPUT" +3!um
JO1KkIV
# log facility M8Q-x-7
log_facility="local0" JIQS'r
/k l0(='
# Block policy )W(?wv!,
ipchains_block_policy="DENY" pTX{j=n!
iptables_block_policy="REJECT" "n=`{ ~F
OIe {Sx{y
# myself ==l p\
myself=`basename $0` cL7j e
{|O8)bW'
mylogger_info() %
Lhpj[C
{ y9?BvPp+
logger -p $log_facility.info -t $myself $@ 2>/dev/null !FX;QD@"
}
![18+Q\
C7[_#1Oz
mylogger_debug() |)B&-~a+p
{ z;xp1t @
logger -p $log_facility.debug -t $myself $@ 2>/dev/null p3M)gH=N
} 7
g8SK
?54=TA|5`F
mylogger_notice() *!ZU" q}i
{ \SHYwD}*Pr
logger -p $log_facility.notice -t $myself $@ 2>/dev/null be|k"s|6)
} (_^g:>)Cs
b'pbf
dotimeout() YR@@:n'TP
{ ;EP7q[
mylogger_info "reset firewall when timeout arrives" 2l}FO dq
case "$firewall" in |"8Az0[!
ipchains) j7 K9T
/etc/init.d/ipchains restart 1>/dev/null 2>/dev/null UeIu
-[R
if [ $? = 0 ] ; then "WdGY*r
mylogger_info "ipchains restarted"
Z3<>Z\6D
else
o3P`y:&
mylogger_notice "ipchains restart failed" Kn SXygT
fi T;XEU%:LK
;; OB)V k
iptables) Qw!cd-zc
/etc/init.d/iptables restart 1>/dev/null 2>/dev/null bg[k8*.:F
if [ $? = 0 ] ; then kj~)#KDN
mylogger_info "iptables restarted" ~
'
81
else ~aQ>DpSEf
mylogger_notice "iptables restart failed" i[`n u#n/
fi =G]} L<
;; !MS z%Qc O
*) M7-piRnd4
mylogger_notice "neither ipchains nor iptables" gQ3Co./
;; zNofI$U
esac &F1h3q)L
}0 0mJ]H (
} C(Ujx=G+3
s\_-` [B0
blockclient() 58,_
{ *M\Qt_[
if [ -z "$1" ] || [ -z "$2" ]; then D-\\L[
mylogger_notice "blockclient() missing client or port to block" ]|18tVXc
return x tg3~/H
fi V|zzj[c
local ip port IE.JIi^w
KT~J@] ;Fb
ip=$1 O|m-Uz"+
port=$2 zB/$*Hd
uy)iB'st&
case "$firewall" in Yxz(g]
ipchains) dFD0l?0 N
mylogger_notice "blocking $1 to $2 via ipchains" ]^$&Ejpe#
found=`ipchains -nL | egrep "^$ipchains_block_policy.*[[:space:]]+$ip[[:space:]]+.*[[:space:]]+\->[[:space:]]+$port"` V9z/yN o
if [ -z "$found" ] ; then Pwf2dm$,+
cmd="ipchains -I input 1 -p tcp -s $ip -d 0/0 $port -j $ipchains_block_policy 1>/dev/null 2>/dev/null" &?YbAo_K
mylogger_debug "cmd: $cmd" mwVH>3{j
`ipchains -I input 1 -p tcp -s $ip -d 0/0 $port -j $ipchains_block_policy 1>/dev/null 2>/dev/null` XFeHkU`C
if [ $? != 0 ] ; then L$6{{Tw"2
mylogger_notice "$cmd call failed" Ar7vEa81
return ,u7: l
fi O&!>C7
new_block=1 Ta`=c
0
ever_block=1 )%Z<9k
else A+w51Q
mylogger_info "$ip already blocked to $port" 0][PL%3Z
fi Z
y _A3m{
;; {r Q6IV3=
iptables) YA9 Xe+g
mylogger_notice "blocking $1 to $2 via iptables" ^ +tAgK2
found=`iptables -nL | egrep "^$iptables_block_policy.*[[:space:]]+$ip[[:space:]]+.*[[:space:]]+dpt:$port[[:space:]]+"` ~K]5`(KV
if [ -z "$found" ] ; then LPX@oh a
cmd="iptables -I $iptables_chain_name 1 -p tcp -m tcp -s $ip --dport $port -j $iptables_block_policy 1>/dev/null 2>/dev/null" 4<fKB&
mylogger_debug "cmd: $cmd" S"0<`{Gv
`iptables -I $iptables_chain_name 1 -p tcp -m tcp -s $ip --dport $port -j $iptables_block_policy 1>/dev/null 2>/dev/null` pE
<dK .v6
if [ $? != 0 ] ; then H4 p N+
mylogger_notice "$cmd call failed" y<jW 7GNt
return T(zE RWo
fi @T [}] e
new_block=1 aF1i!Z
ever_block=1 v
MTWtc!6
else /\P 3UrQ&]
mylogger_info "$ip already blocked to $port" B
3 <T#
fi hbdq'2!Qr
;; 8$9<z
*) vpu20?E>5z
mylogger_notice "neither ipchains nor iptables" _tDSG]
;; "
UaUaSg#
esac 6c H.s+
} v
&6I\1
QII-9 RxX"
restartservice() e]F4w(*=
{ t@(S=i7}-
local service MQ7d IUs
if [ -z "$1" ] ; then
'Vq_/g!?1
mylogger_notice "no port given to see which service to be restart" .: gZ*ks~
return '|
(#^jAj
fi MNd8#01 q`
bV c"'RQ
case "$1" in FVw;`{
80) '4 T}$a"i
service="httpd" n<RvL^T=
;; g=W1y
25) k~
Z9og
service="postfix" _Q&O#f
;;
peW4J<,
110) ;Z:zL^rvn
service="courier-pop3d" ^f][;> c
;; K(bid0 Y
21) `-Yo$b;:
service="muddleftpd" rBNl%+ sB
;; 2e~ud9,
53) -jN:~.
service="named" Z*r;" WHB
;; NlLgXn!
3306) .FV
wZ :d
service="mysqld" N=4`jy =
;; 1 /@ lZ
esac ::'DWD1
if [ ! -z "$service" ] ; then > wsS75n1
/etc/init.d/$service restart 1>/dev/null 2>/dev/null 2AN 6(k4o
if [ $? = 0 ] ; then E<=h 6Ha
mylogger_notice "$service restarted" M? 7
CBqZ
else r7dvj#^
mylogger_notice "$service restart failed" f+A!w
8E
fi 8M9LY9C
fi aX`@WXK
} sqKLz
R.ZC|bPiD
docheckport() -v]v m3N a
{ <qGVOAnz+
mylogger_info "do check port $1" "0BuQ{ CQ
local port last_client count client total_count |q0MM^%"
I,rs&m?/m
if [ -z "$1" ] ; then > J!J:
mylogger_notice "docheckport() port not given" g 7>p,
return 1w30Vj 2<
fi ,ypD0Q
drv"I[}{A
port=$1 _6Ex}`fyJ
h~\bJ*Zp
clientlist=`netstat -an --tcp| grep ESTABLISHED | awk "{ if ( index(\\$4,\":$port\") ) print \\$5}" | awk -F ':' '{print $1}'|sort` ]t 4 9Efw
if [ $? != 0 ] ; then K/^70;/!.
mylogger_notice "netstat call failed" 4tZnYGvqe
return f76bEe/B9
fi `#v(MK{9+V
#echo $clientlist d-cK`pSB
# reset new_block 0O_acO 4
new_block=0 *{/L7])gm
count=0 ,{KjVv<
total_count=0 vocXk_
last_client="" fJj trvNy)
for client in $clientlist QvPG
6A]T
do |?a 4Nl ?
#echo "client is $client" mAI<zh&SQ
if [ -z "$last_client" ] ; then 8ec 6J*b
count=$((count+1)) z } L3//
total_count=$((total_count+1)) k1EAmA
l
last_client=$client M*& tVG
else +`@)87O
if [ "$client" = "$last_client" ] ; then ?O]iX;2vM
count=$((count+1)) {95z\UE}
total_count=$((total_count+1)) ;O E= ; \
else 3A~53W$M
mylogger_debug "$last_client $count connections" Pk9 4O
if [ $count -ge $max_active_conn ] ; then ^t|CD|,K_O
mylogger_notice "client $last_client connection $count >= $max_active_conn" <($'jlZ
blockclient $last_client $port `L-GI{EJ
fi ;M<jQntqS{
count=1 qac4GZ
total_count=$((total_count+1)) 9c /&+j
last_client=$client sQBl9E'!be
fi rP k=9I
fi q yfw$$X
done FwdRM)1)
# check the last client O<@S,/Q4
if [ ! -z "$client" ] ; then Cg~GlZk}
count=$((count+1)) 5
#v
total_count=$((total_count+1)) B&
tU~
mylogger_debug "$client $count connections" Nb) )_+/
if [ $count -ge $max_active_conn ] ; then ~S\Ee 2e>
mylogger_notice "client $client connection $count >= $max_active_conn" uC _&?
blockclient $client $port %&c+} m
fi Ol}^'7H
fi 1:.0^?Gz
mylogger_info "total connections on port $port: $total_count" 5`$.GV
LK
" 47
if [ $new_block = 1 ] ; then g$qNK`y
restartservice $port D6 2xC5
fi jIZpv|t)
} X[ERlw1q4Q
6LGy 0dWpG
docheckall() @KM !g,f
{ {Jv m *
# reset wakeup_time Cf-R?g n]
wakeup_time=$wakeup_time_max qO yg&]7
for port in $portlist =Q % F~
do L*2YA
IG
docheckport $port w7.I0)MH
if [ $new_block = 1 ] ; then TFX*kk &R
# set wakeup_time shorter cause we found some abuse client hOI| #(-
wakeup_time=$wakeup_time_min ]fN\LY 6p
fi
u$7o d$&S
done Ppw0vaJ^
} [B} $U|V0
xWY%-CWY.
if [ -z "$firewall" ] && [ -f /etc/sysconfig/ipchains ] ; then "3kIQsD|j
firewall="ipchains" O|t@p=]
fi S>W_p~ @
A}(&At%n4
if [ -z "$firewall" ] && [ -f /etc/sysconfig/iptables ] ; then + tbG^w %
firewall="iptables" ZK
=`Y@
fi efj[7K.h
}9w?[hXW"
if [ -z "$firewall" ] ; then 3I87|5V,Z
echo "Error: This machine does not have ipchains or iptables firewall support" by
'P}
exit 1 _*d8:|qw
fi D4e*Wwk
i%jti6z$Hr
mylogger_info "firewall.sh v$myver ValueOf.com starting" -O.
q$D=as
mylogger_info "Firewall is: $firewall" )<_e{_ h
mylogger_info "Port protected: $portlist" D%L}vugxK
mylogger_info "Max connection per ip: $max_active_conn" ~YQC!x
mylogger_info "Min time to check: $wakeup_time_min""s" fq-zgqF<
mylogger_info "Max time to check: $wakeup_time_max""s" Ns?8N":
mylogger_info "Timeout circle: $rule_timeout""s" {q=( x]C
mylogger_info "Output is logged to: $log_facility" C&Nga
`J
R>BZQugZ~
# if new ip blocked at this check run? _wMc7`6F
new_block=0 84xA/BRW
# if new ip blocked at this timeout run? =og5Mh,
ever_block=0 gIGyY7{(s8
# reset wakeup_time wR)U&da`@
wakeup_time=$wakeup_time_max A 9 I5
99G
zh X _
lasttime=`date +%s` r_m*$r~f
a: C h"la
while [ 1 ] S
;pKL,d>r
do L
'=mDb
curtime=`date +%s` 0K+a/G@
n\
timediff=$((curtime-lasttime)) * z,] mi%
#echo "timediff: $timediff" ~
Z kSYW<
if [ $timediff -ge $rule_timeout ] && [ $ever_block = 1 ] ; then [^o TC;
lasttime=$curtime Ie 12d@
ever_block=0 Wq
5Nc
dotimeout 7w}PYp1Z'~
fi ^0 z WiX
docheckall |wef[|@%
mylogger_info "sleep for $wakeup_time""s" 2P&KU%D)0s
sleep $wakeup_time 2[^p6s[
done 3&3 9 M&
dm;C @.ML
;|C[.0;kgv
UEm~5,>$0
1. 说明 W~EDLL Z
firewall.sh是一个shell脚本程序，每隔一段时间检查tcp连接的统计信息，如果来自某个ip对某个端口的活动连接超过规定的最大数量， K x8>
则自动将该IP对该端口的访问屏蔽，并重新启动相应的服务。再每隔一段时间，会重设防火墙到初始状态。 "pa}']7#
该程序可以同时保护多个端口 ymNL`GYN[
S"}G/lBx.
2. 安装 ;v}f7v '
tar zxf firewall-1.0b.tar.gz \{g;|Z
1
cd firewall-1.0b 71g\fGG\
install -m 700 firewall.sh /usr/prima/sbin/firewall.sh -XbO[_Wf
J83{&N2u
3. 配置 [xm{4Ba2X
主要配置项目如下： TbK;_
pg
# 最小检查周期，缺省为120秒 ( E8(np
wakeup_time_min=120 _^Ds[VAgA
do-mkvk
# 最大检查周期，缺省为300秒 f@G3,u!]i
wakeup_time_max=600 f:w #r.]
:o2^?k8k&#
# 重设防火墙状态的时间，缺省为3600秒 "s?!1v(v
rule_timeout=3600 G!%Cc0d"7
sKIpL(_I$
# 保护的端口列表，缺省为80和25，支持的其他端口包括21(ftp), 110(pop3), 53(named), 3306(mysql) -5&|"YYjr{
# 一般的网络攻击都是针对80和25，又以80居多 P7 X':
portlist="80 25" J2va Kl
2 c%*u {=:
# 每个ip可占用的最大活动（Established）连接数 ^Z6N&s#6
max_active_conn=8 \[!k`6#t7
CO)BF%?B
# iptables防火墙规则链名称，必须和/etc/sysconfig/iptables中一致 ^")SU(`
# 如果用的是ipchains，可以忽略此项 sz7|2OV"
iptables_chain_name="RH-Lokkit-0-50-INPUT" + A =*C
v? 9
# 日志输出目标 ,hg gmzA~
log_facility="local0" & rsNB:!
_NkVi_UX
**** 关于检查周期 **** 2X=
pu. ;F
程序定义了两个检查周期，如果上次检查中屏蔽了某个IP，则程序会更频繁地检查连接情况，反之则等待更长时间。通过检查周期 0\Q/$ #3
的动态调整，可以有效调度在遭受攻击和正常状态下程序的运行次数。 Fq-A vU
n c0!ag
**** ipchains vs iptables **** SF 7p/gG
目前该程序支持ipchains和iptables两种软件防火墙，使用何种是由程序启动时自动检测的。如果/etc/sysconfig/ipchains和 m$w'`[H
/etc/sysconfig/iptables都没有检测到，则报错退出。 ++Z,U
&4m\``//9
**** 日志输出 **** }u C C~ <^
程序的输出信息记录在系统日志中，目标是local0。如果没有特殊配置，可以在/var/log/messages中看到。建议在/etc/syslog.conf o'`:$
(
中加入一条： }8zw| (GR,
local0.* /var/log/firewall.log V>Zw" #Q
然后重新启动syslog ~S$\ PG4
/etc/init.d/syslog restart iaq+#k@V
这样，可以将firewall.sh输出的日志单独记到文件/var/log/firewall.log里。 Pd~{XM,yfW
Jxq;Uu9
4. 运行 65~X!90k
/usr/prima/sbin/firewall.sh & ~0^d-,ZD5
+ROwk
范例输出： j3J \%7^i
*** firewall.sh v1.0b ValueOf.com*** +TWk}#G
Firewall is: ipchains LRuB&4r8
Port protected: 80 25 (P M!{u=
Max connection per ip: 8 t r<iFT}C
Min time to check: 120s 9(CY"Tc3
Max time to check: 300s zFq8xw
Timeout circle: 3600s =MsQ=:ZV
Output is logged to: local0 }3Mnq?.-
S
6|# 9C&
察看/var/log/firewall.log，可以看到： y>5??q
Oct 16 14:08:55 server firewall.sh: do check port 80 // 检查80端口 WqHsf1? N
Oct 16 14:08:55 server firewall.sh: 192.168.0.60 2 connections // 有两个来自192.168.0.60的连接 $YNWT\FE
Oct 16 14:08:55 server firewall.sh: total connections on port 80: 2 // 80端口总共2个连接 O\"k[V?.V
Oct 16 14:08:55 server firewall.sh: do check port 25 // 检查25端口 Hkv4 ^|
Oct 16 14:08:55 server firewall.sh: total connections on port 25: 0 // 25端口没有连接 9c}mAg4
Oct 16 14:08:55 server firewall.sh: sleep for 300s // 等待300秒 KcK,%! >B
<u Yeev%
5. 停止 $$ tFP"pZ
先用ps命令察看firewall.sh进程的进程号，然后用kill命令将其终止，如 VsrY
U@V
# ps auxww|grep firewall.sh K4{1}bU{>
root 27932 0.0 0.5 2312 1060 pts/2 S 12:38 0:00 /bin/sh /usr/prima/sbin/firewall.sh Si:
$zGL$(
root 27967 0.0 0.3 1732 592 pts/2 S 12:39 0:00 grep firewall.sh FD+y?U
F
第一行即firewall.sh的进程，用kill命令： I_k!'zR[N
# kill 27932 a
S t
[1] Terminated /usr/prima/sbin/firewall.sh "3r7/>xy
即将其终止
|
常州电信/网通机房,100M共享/10M独享/1000M共享/100M独享/电信+网通双线路服务器托管
Tel：0519-89991155 企业QQ：4006023839 5y6s Inc.
|
|
[楼 主]
|
Posted: 2008-01-26 02:12 |
| |
常州五颜六色网络技术有限公司 -> 网站建设 -> linux自动屏蔽IP工具
