动态获取bind dns日志IP脚本

#!/usr/bin/env python
#_*_coding:utf-8_*_
'''
python deny_dns_allip.py your_filelog_name
动态获取dns日志的IP地址，把不满足条件的都drop掉
此脚本修改后可以动态拒绝任何日志内的IP
相当于 tail -f filename | awk -F "你的条件" ，然后 把结果输送到iptables -I INPUT -s %s -j DROP
'''
from sys import argv
import collections
import time,os,re
o = open(argv[1], 'r')
print(''.join(collections.deque(o, 5)).strip('\n')) # last 5 lines
o.seek(0,2) # jump to last line 

ip_list = []
while 1:
    line = o.readline()
    if not line:
        time.sleep(0.1)
        continue
    ret = line.strip('\n')
    try:
        #正则的条件，根据该字段获取该字段的IP
        ip = str(ret.split("query: hoffmeister.be IN ANY +E")[0])
        ipstr = re.search('\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}',ip).group()
        #排除部分IP，排除172网段124网段211网段，根据需要自己定义
        exclude_ips = str(ipstr.split(".")[0])
        allow_ips = ['','','']
        #
        #print("ip_list:",ip_list)
        if ipstr not in ip_list and exclude_ips not in allow_ips:
            ip_list.append(ipstr)
            #取最新的IP，然后drop掉
            print("======>>i:",ip_list[-1])
            os.system("iptables -I INPUT -s %s -j DROP"%(ip_list[-1]))
            print("iptables -I INPUT -s %s -j DROP"%(ip_list[-1]))
        else:
            pass
    except:
        b=None

加强版

动态获取日志，然后调用淘宝ip查询的API 智能判断 来源IP属于什么地方，当是国外的IP时，直接干掉。

解决了部分用户 使用手机4G测试时的被意外干掉的情况。

# -*- coding: utf-8 -*-
import requests,os

def checkip(ip):

  URL = 'http://ip.taobao.com/service/getIpInfo.php'
  try:
    r = requests.get(URL, params=ip, timeout=2)
  except requests.RequestException as e:
     #pass
    print(e)
  else:
    json_data = r.json()
    if json_data[u'code'] == 0:
      #print "ipvalues",type(ip.values())
      ret = json_data[u'data'][u'country'].encode('utf-8') + str(ip.values())
      #print ret
      country = json_data[u'data'][u'country'].encode('utf-8')
      if country != '中国':
        ret_ip = ip.values()[0]
        print "---------------country and ip",country, ret_ip
        os.system("iptables -I INPUT -s %s -j DROP"%(ret_ip))
        print("iptables -I INPUT -s %s -j DROP"%(ret_ip))
      else:
        print"----china",ip.values()[0]
      #return json_data[u'data'][u'country'].encode('utf-8') + str(ip.values())
      #print '所在地区： ' + json_data[u'data'][u'area'].encode('utf-8')
      #print '所在省份： ' + json_data[u'data'][u'region'].encode('utf-8')
      #print '所在城市： ' + json_data[u'data'][u'city'].encode('utf-8')
      #print '所属运营商：' + json_data[u'data'][u'isp'].encode('utf-8')
    else:
       #pass
      print '查询失败,请稍后再试！'

#ip= {'ip':'67.177.203.45'}
#checkip(ip)

#!/usr/bin/env python
#_*_coding:utf-8_*_

from sys import argv
import collections
import time,os,re
import ip_check

o = open(argv[1], 'r')
print(''.join(collections.deque(o, 5)).strip('\n')) # last 5 lines
o.seek(0,2) # jump to last line 

ip_list = []
while 1:
    line = o.readline()
    if not line:
        time.sleep(2)
        continue
    ret = line.strip('\n')
    try:
        ip = str(ret.split("query: hoffmeister.be IN ANY +E")[0])
        ipstr = re.search('\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}',ip).group()
        #
        exclude_ips = str(ipstr.split(".")[0])
        allow_ips = ['','','']
        #
        #print("ip_list:",ip_list)
        if ipstr not in ip_list and exclude_ips not in allow_ips:
            ip_list.append(ipstr)
            print("======>>i:",ip_list[-1])
            #f = open('ip.txt','a+')
            #f.write(ip_list[-1]+'\n')
            #f.close()
            check_ips = {'ip':ip_list[-1]}
            ip_check.checkip(check_ips)
        else:
            pass
    except:
        b=None

bind dns日志配置 添加如下行。有点诡异 日志的路径并非 根下的var  而是运行bind的根下的var

[root@localhost var]# ls
log  named  run  tmp
[root@localhost var]# cd log/
[root@localhost log]# ls
den_txt_ip.py          deny_dns_ip.py  ip-check.txt  query.log    query_log.  query_log.  query_log.  query_log.  query_log.  query_log.  test.log
deny_dns_allip.py      ip_check.py     ip.txt        query_log.  query_log.  query_log.  query_log.  query_log.  query_log.  query_log.  test.py
deny_dns_allip.py.bak  ip_check.pyc    query_log     query_log.  query_log.  query_log.  query_log.  query_log.  query_log.  read_ip.py
[root@localhost log]# pwd
/var/named/chroot/var/log
[root@localhost log]# ps -ef |grep "named"
root               Jun22 ?        :: named -d
named             : ?        :: /usr/sbin/named -u named -t /var/named/chroot
root         : pts/    :: grep named
root             Jun22 ?        :: named -d 

logging {
    /*指定服务器日志记录的内容和日志信息来源*/
    channel "default_syslog" {
        syslog daemon; /* 发送给syslog 的daemon facility */
        severity info; /* 只发送此优先级和更高优先级的信息 */
    };
    channel default_debug {
        file "data/named.run"; /* 写入工作目录下的named.run 文件。注意：如果服务器用-f 参数启动，则"named.run"会被stderr 所替换。*/
        severity dynamic; /*  按照服务器当前的debug 级别记录日志 */
        };
    channel xfer_in_log {
        file "/var/log/named/xfer_in_log" versions  size 10m;
        severity info;
        print-category yes;
        print-severity yes;
        print-time yes;
    };  

    channel xfer_out_log {
        file "/var/log/named/xfer_out_log" versions  size 10m;
        severity info;
        print-category yes;
        print-severity yes;
        print-time yes;
    };  

    channel notify_log {
        file "/var/log/named/notify_log" versions  size 10m;
        severity info;
        print-category yes;
        print-severity yes;
        print-time yes;
    };  

    channel general_log {
        file "/var/log/named/general_log" versions  size 100m;
        severity info;
        print-category yes;
        print-severity yes;
        print-time yes;
    };  

    channel default_log {
        file "/var/log/named/default_log" versions  size 100m;
        severity info;
        print-category yes;
        print-severity yes;
        print-time yes;
    };  

    channel update_log {
        file "/var/log/named/update_log" versions  size 10m;
        severity info;
        print-category yes;
        print-severity yes;
        print-time yes;
    };  

    channel query_log {
        file "/var/log/query_log" versions  size 100m;
        severity info;
        print-category no;
        print-severity no;
        print-time yes;
    };  

    category queries { query_log; };
    category default { default_log; };
    category general { general_log; };
    category xfer-in { xfer_in_log; };
    category xfer-out { xfer_out_log; };
    category notify { notify_log; };
    category update { update_log; };
};