超级NB的防DDOS(小量级)攻击的脚本
# tree /usr/local/ddos/
/usr/local/ddos/
├── ddos.conf
├── ddos.sh
├── ignore.ip.list
└── LICENSE directories, files
# ll /usr/local/sbin/ddos
lrwxrwxrwx root root Sep : /usr/local/sbin/ddos -> /usr/local/ddos/ddos.sh
# cat /etc/cron.d/ddos.cron
SHELL=/bin/sh
*/ * * * * root /usr/local/ddos/ddos.sh >/dev/null >&
查看关键的几个脚本:
# cat ddos.conf
##### Paths of the script and other files
PROGDIR="/usr/local/ddos"
PROG="/usr/local/ddos/ddos.sh"
IGNORE_IP_LIST="/usr/local/ddos/ignore.ip.list"
CRON="/etc/cron.d/ddos.cron"
APF="/etc/apf/apf"
IPT="/sbin/iptables" ##### frequency in minutes for running the script
##### Caution: Every time this setting is changed, run the script with --cron
##### option so that the new frequency takes effect
FREQ= ##### How many connections define a bad IP? Indicate that below.
NO_OF_CONNECTIONS= ##### APF_BAN= (Make sure your APF version is atleast 0.96)
##### APF_BAN= (Uses iptables for banning ips instead of APF)
#APF_BAN=
APF_BAN= ##### KILL= (Bad IPs are'nt banned, good for interactive execution of script)
##### KILL= (Recommended setting)
KILL= ##### An email is sent to the following address when an IP is banned.
##### Blank would suppress sending of mails
EMAIL_TO="xxx@xxx.com" ##### Number of seconds the banned ip should remain in blacklist.
BAN_PERIOD=
# cat ddos.sh
#!/bin/sh
##############################################################################
# DDoS-Deflate version 0.6 Author: Zaf <zaf@vsnl.com> #
##############################################################################
# This program is distributed under the "Artistic License" Agreement #
# #
# The LICENSE file is located in the same directory as this program. Please #
# read the LICENSE file before you make copies or distribute this program #
##############################################################################
load_conf()
{
CONF="/usr/local/ddos/ddos.conf"
if [ -f "$CONF" ] && [ ! "$CONF" == "" ]; then
source $CONF
else
head
echo "\$CONF not found."
exit
fi
} head()
{
echo "DDoS-Deflate version 0.6"
echo "Copyright (C) 2005, Zaf <zaf@vsnl.com>"
echo
} showhelp()
{
head
echo 'Usage: ddos.sh [OPTIONS] [N]'
echo 'N : number of tcp/udp connections (default 150)'
echo 'OPTIONS:'
echo '-h | --help: Show this help screen'
echo '-c | --cron: Create cron job to run this script regularly (default 1 mins)'
echo '-k | --kill: Block the offending ip making more than N connections'
} unbanip()
{
UNBAN_SCRIPT=`mktemp /tmp/unban.XXXXXXXX`
TMP_FILE=`mktemp /tmp/unban.XXXXXXXX`
UNBAN_IP_LIST=`mktemp /tmp/unban.XXXXXXXX`
echo '#!/bin/sh' > $UNBAN_SCRIPT
echo "sleep $BAN_PERIOD" >> $UNBAN_SCRIPT
if [ $APF_BAN -eq ]; then
while read line; do
echo "$APF -u $line" >> $UNBAN_SCRIPT
echo $line >> $UNBAN_IP_LIST
done < $BANNED_IP_LIST
else
while read line; do
echo "$IPT -D INPUT -s $line -j DROP" >> $UNBAN_SCRIPT
echo $line >> $UNBAN_IP_LIST
done < $BANNED_IP_LIST
fi
echo "grep -v --file=$UNBAN_IP_LIST $IGNORE_IP_LIST > $TMP_FILE" >> $UNBAN_SCRIPT
echo "mv $TMP_FILE $IGNORE_IP_LIST" >> $UNBAN_SCRIPT
echo "rm -f $UNBAN_SCRIPT" >> $UNBAN_SCRIPT
echo "rm -f $UNBAN_IP_LIST" >> $UNBAN_SCRIPT
echo "rm -f $TMP_FILE" >> $UNBAN_SCRIPT
. $UNBAN_SCRIPT &
} add_to_cron()
{
rm -f $CRON
sleep
service crond restart
sleep
echo "SHELL=/bin/sh" > $CRON
if [ $FREQ -le ]; then
echo "0-59/$FREQ * * * * root /usr/local/ddos/ddos.sh >/dev/null 2>&1" >> $CRON
else
let "START_MINUTE = $RANDOM % ($FREQ - 1)"
let "START_MINUTE = $START_MINUTE + 1"
let "END_MINUTE = 60 - $FREQ + $START_MINUTE"
echo "$START_MINUTE-$END_MINUTE/$FREQ * * * * root /usr/local/ddos/ddos.sh >/dev/null 2>&1" >> $CRON
fi
service crond restart
} load_conf
while [ $ ]; do
case $ in
'-h' | '--help' | '?' )
showhelp
exit
;;
'--cron' | '-c' )
add_to_cron
exit
;;
'--kill' | '-k' )
KILL=
;;
*[-]* )
NO_OF_CONNECTIONS=$
;;
* )
showhelp
exit
;;
esac
shift
done TMP_PREFIX='/tmp/ddos'
TMP_FILE="mktemp $TMP_PREFIX.XXXXXXXX"
BANNED_IP_MAIL=`$TMP_FILE`
BANNED_IP_LIST=`$TMP_FILE`
echo "Banned the following ip addresses on `date`" > $BANNED_IP_MAIL
echo >> $BANNED_IP_MAIL
BAD_IP_LIST=`$TMP_FILE`
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr > $BAD_IP_LIST
cat $BAD_IP_LIST
if [ $KILL -eq ]; then
IP_BAN_NOW=
while read line; do
CURR_LINE_CONN=$(echo $line | cut -d" " -f1)
CURR_LINE_IP=$(echo $line | cut -d" " -f2)
if [ $CURR_LINE_CONN -lt $NO_OF_CONNECTIONS ]; then
break
fi
IGNORE_BAN=`grep -c $CURR_LINE_IP $IGNORE_IP_LIST`
if [ $IGNORE_BAN -ge ]; then
continue
fi
IP_BAN_NOW=
echo "$CURR_LINE_IP with $CURR_LINE_CONN connections" >> $BANNED_IP_MAIL
echo $CURR_LINE_IP >> $BANNED_IP_LIST
echo $CURR_LINE_IP >> $IGNORE_IP_LIST
if [ $APF_BAN -eq ]; then
$APF -d $CURR_LINE_IP
else
$IPT -I INPUT -s $CURR_LINE_IP -j DROP
fi
done < $BAD_IP_LIST
if [ $IP_BAN_NOW -eq ]; then
dt=`date`
if [ $EMAIL_TO != "" ]; then
cat $BANNED_IP_MAIL | mail -s "IP addresses banned on $dt" $EMAIL_TO
fi
unbanip
fi
fi
rm -f $TMP_PREFIX.*
# cat ignore.ip.list
127.0.0.1
10.100.0.5
#不防御的ip
注意权限:
# ll /etc/cron.d/ddos.cron
-rw-r--r-- root root Sep : /etc/cron.d/ddos.cron
注意软连接:
# ll /usr/local/sbin/ddos
lrwxrwxrwx root root Sep : /usr/local/sbin/ddos -> /usr/local/ddos/ddos.sh
超级NB的防DDOS(小量级)攻击的脚本的更多相关文章
- 转:nginx防DDOS攻击的简单配置
文章来自于: 近期由于工作需要,做了些防DDOS攻击的研究,发现nginx本身就有这方面的模块ngx_http_limit_req_module和ngx_http_limit_conn_module. ...
- Azure上Linux VM防DDOS攻击:使用Apache mod_evasive
部署在云端的虚拟机和web服务,很容易受到DoS护着DDoS的服务攻击,让一些新上线的业务苦不堪言,当然各个云服务提供商也有不同层面DDOS的防护,然而由于防护粒度,攻击复杂度的关系,未必可以满足你的 ...
- nginx防DDOS、cc、爬虫攻击
一.防止DDOS.CC攻击 http { limit_conn_zone $binary_remote_addr zone=perip:10m; limit_conn_zone $server_nam ...
- DDos、CC攻击与防御
DDoS介绍 DDoS是英文Distributed Denial of Service的缩写,意即"分布式拒绝服务",那么什么又是拒绝服务(Denial of Service)呢? ...
- Apache设置防DDOS模块mod_evasive
mod_evasive 是Apache(httpd)服务器的防DDOS的一个模块.对于WEB服务器来说,是目前比较好的一个防护DDOS攻击的扩展模块.虽然并不能完全防御 DDOS攻击,但在一定条件下, ...
- DDOS和cc攻击的防御
DDOS和cc攻击的防御 author:headsen chen 2017-10-21 10:47:39 个人原创,转载请注明作者,否则依法追究法律责任: DDOS攻击形式:黑客挟持多个电脑( ...
- 关于Apache (httpd)服务器防DDOS模块mod_evasive的使用说明
关于Apache (httpd)服务器防DDOS模块mod_evasive的使用说明 1. mod_evasive 介绍: mod_evasive 是Apache(httpd)服务器的防DDOS的一个 ...
- nginx防ddos配置
Nginx limit_zone与limit_req_zone (防DDOS攻击模块) http { limit_req_zone $binary_remote_addr zone=one:100m ...
- nginx服务器防sql注入/溢出攻击/spam及禁User-agents
本文章给大家介绍一个nginx服务器防sql注入/溢出攻击/spam及禁User-agents实例代码,有需要了解的朋友可进入参考. 在配置文件添加如下字段即可 代码如下 复制代码 server { ...
随机推荐
- 073 HBASE的读写以及client API
一:读写思想 1.系统表 hbase:namespace 存储hbase中所有的namespace的信息 hbase:meta rowkey:hbase中所有表的region的名称 column:re ...
- golang 反向代理
服务器 package main import ( "bytes" "encoding/base64" "encoding/json" &q ...
- 汇合confluence
Confluence是一个专业的企业知识管理与协同软件,也可以用于构建企业wiki.使用简单,但它强大的编辑和站点管理特征能够帮助团队成员之间共享信息.文档协作.集体讨论,信息推送. 空间 空间是页面 ...
- Cocos Creator 的Hello World
1,创建项目[参考来源:官方文档] 在 Dashboard 中,打开 新建项目 选项卡,选中 Hello World 项目模板. 然后在项目路径栏中指定一个新项目存放路径,路径的最后一部分就是项目文件 ...
- innodb文件
参数文件 日志文件 socket文件 pid文件 mysql表结构文件 存储引擎文件 1. 错误日志 启用错误日志方法 /etc/init.d/mysql启动文件中 /usr/bin/mysqld_s ...
- Reactor 3 学习笔记(2)
接上篇继续学习各种方法: 4.9.reduce/reduceWith @Test public void reduceTest() { Flux.range(1, 10).reduce((x, y) ...
- 机器学习笔记(2):线性回归-使用gluon
代码来自:https://zh.gluon.ai/chapter_supervised-learning/linear-regression-gluon.html from mxnet import ...
- Ubuntu GNOME 13.04将关闭窗口的按钮放在最右边
转载请注明:转自http://blog.csdn.net/u010811449/article/details/9426187 先上图: 首先打开dconf系统配置编译器. 找到 rog -> ...
- Hive总结(八)Hive数据导出三种方式
今天我们再谈谈Hive中的三种不同的数据导出方式. 依据导出的地方不一样,将这些方式分为三种: (1).导出到本地文件系统. (2).导出到HDFS中: (3).导出到Hive的还有一个表中. 为了避 ...
- Win8下枚举任意进程的句柄表。。。(VB6 Code)
添加一个Command1.一个List1,代码: Private Type PROCESS_HANDLE_TABLE_ENTRY_INFO HandleValue As Long HandleCoun ...