# tree /usr/local/ddos//usr/local/ddos/├── ddos.conf
├── ddos.sh
├── ignore.ip.list
└── LICENSE0directories,4files
# ll /usr/local/sbin/ddos
lrwxrwxrwx 1root root23Sep1315:36/usr/local/sbin/ddos -> /usr/local/ddos/ddos.sh
# cat /etc/cron.d/ddos.cron
SHELL=/bin/sh*/1* * * * root /usr/local/ddos/ddos.sh >/dev/null2>&1
查看關(guān)鍵的幾個(gè)腳本:
# cat ddos.conf
##### Paths of the script and other files
PROGDIR="/usr/local/ddos"PROG="/usr/local/ddos/ddos.sh"IGNORE_IP_LIST="/usr/local/ddos/ignore.ip.list"CRON="/etc/cron.d/ddos.cron"APF="/etc/apf/apf"IPT="/sbin/iptables"##### frequency inminutesfor running the script
##### Caution: Every time thissettingischanged, run the script with --cron
#####? ? ? ? ? option so that the new frequency takes effect
FREQ=1##### How many connections define a bad IP? Indicate that below.
NO_OF_CONNECTIONS=150##### APF_BAN=1(Make sure your APF versionisatleast0.96)
##### APF_BAN=0(Uses iptablesfor banning ips instead of APF)
#APF_BAN=1APF_BAN=0##### KILL=0(Bad IPs are'nt banned, good for interactive execution of script)##### KILL=1 (Recommended setting)
KILL=1##### An email issent to the following address when an IPis banned.
##### Blank would suppress sending of mails
EMAIL_TO="xxx@xxx.com"##### Number of seconds the banned ip should remain in blacklist.
BAN_PERIOD=600
# cat ddos.sh
#!/bin/sh
##############################################################################
# DDoS-Deflate version0.6Author: Zaf ? ? ? ? ? ? ? ? ? ? ? ? #
##############################################################################
# This program isdistributed under the"Artistic License" Agreement? ? ? ? #
#? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? #
# The LICENSE file islocatedinthe same directoryasthis program. Please? #
#? read the LICENSE file before you make copies or distribute this program? #
##############################################################################
load_conf()
{
? ? CONF="/usr/local/ddos/ddos.conf"if[ -f"$CONF"] && [ !"$CONF"=="" ]; then
? ? ? ? source $CONF
? ? else? ? ? ? head
? ? ? ? echo "\$CONF not found."? ? ? ? exit 1? ? fi
}
head()
{
? ? echo "DDoS-Deflate version 0.6"? ? echo "Copyright (C) 2005, Zaf <zaf@vsnl.com>"? ? echo
}
showhelp()
{
? ? head
? ? echo 'Usage: ddos.sh [OPTIONS] [N]'? ? echo 'N : number of tcp/udp? ? connections (default 150)'? ? echo 'OPTIONS:'? ? echo '-h | --help: Show? ? this help screen'? ? echo '-c | --cron: Create cron job to run this script regularly (default 1 mins)'? ? echo '-k | --kill: Block the offending ip making more than N connections'}
unbanip()
{
? ? UNBAN_SCRIPT=`mktemp /tmp/unban.XXXXXXXX`
? ? TMP_FILE=`mktemp /tmp/unban.XXXXXXXX`
? ? UNBAN_IP_LIST=`mktemp /tmp/unban.XXXXXXXX`
? ? echo '#!/bin/sh'> $UNBAN_SCRIPT
? ? echo "sleep $BAN_PERIOD">> $UNBAN_SCRIPT
? ? if[ $APF_BAN -eq1 ]; then
? ? ? ? whileread line;do? ? ? ? ? ? echo "$APF -u $line">> $UNBAN_SCRIPT
? ? ? ? ? ? echo $line >> $UNBAN_IP_LIST
? ? ? ? done < $BANNED_IP_LIST
? ? elsewhileread line;do? ? ? ? ? ? echo "$IPT -D INPUT -s $line -j DROP">> $UNBAN_SCRIPT
? ? ? ? ? ? echo $line >> $UNBAN_IP_LIST
? ? ? ? done < $BANNED_IP_LIST
? ? fi
? ? echo "grep -v --file=$UNBAN_IP_LIST $IGNORE_IP_LIST > $TMP_FILE">> $UNBAN_SCRIPT
? ? echo "mv $TMP_FILE $IGNORE_IP_LIST">> $UNBAN_SCRIPT
? ? echo "rm -f $UNBAN_SCRIPT">> $UNBAN_SCRIPT
? ? echo "rm -f $UNBAN_IP_LIST">> $UNBAN_SCRIPT
? ? echo "rm -f $TMP_FILE">> $UNBAN_SCRIPT
? ? . $UNBAN_SCRIPT &}
add_to_cron()
{
? ? rm -f $CRON
? ? sleep 1? ? service crond restart
? ? sleep 1? ? echo "SHELL=/bin/sh"> $CRON
? ? if[ $FREQ -le2 ]; then
? ? ? ? echo "0-59/$FREQ * * * * root /usr/local/ddos/ddos.sh >/dev/null 2>&1">> $CRON
? ? else? ? ? ? let "START_MINUTE = $RANDOM % ($FREQ - 1)"? ? ? ? let "START_MINUTE = $START_MINUTE + 1"? ? ? ? let "END_MINUTE = 60 - $FREQ + $START_MINUTE"? ? ? ? echo "$START_MINUTE-$END_MINUTE/$FREQ * * * * root /usr/local/ddos/ddos.sh >/dev/null 2>&1">> $CRON
? ? fi
? ? service crond restart
}
load_confwhile[ $1];docase$1in'-h'|'--help'|'?' )
? ? ? ? ? ? showhelp
? ? ? ? ? ? exit
? ? ? ? ? ? ;;
? ? ? ? '--cron'|'-c' )
? ? ? ? ? ? add_to_cron
? ? ? ? ? ? exit
? ? ? ? ? ? ;;
? ? ? ? '--kill'|'-k' )
? ? ? ? ? ? KILL=1? ? ? ? ? ? ;;
? ? ? ? *[0-9]* )
? ? ? ? ? ? NO_OF_CONNECTIONS=$1? ? ? ? ? ? ;;
? ? ? ? * )
? ? ? ? ? ? showhelp
? ? ? ? ? ? exit
? ? ? ? ? ? ;;
? ? esac
? ? shift
done
TMP_PREFIX='/tmp/ddos'TMP_FILE="mktemp $TMP_PREFIX.XXXXXXXX"BANNED_IP_MAIL=`$TMP_FILE`
BANNED_IP_LIST=`$TMP_FILE`
echo "Banned the following ip addresses on `date`"> $BANNED_IP_MAIL
echo >>? ? $BANNED_IP_MAIL
BAD_IP_LIST=`$TMP_FILE`
netstat -ntu | awk'{print $5}'| cut -d: -f1 | sort | uniq -c | sort -nr > $BAD_IP_LIST
cat $BAD_IP_LISTif[ $KILL -eq1 ]; then
? ? IP_BAN_NOW=0whileread line;do? ? ? ? CURR_LINE_CONN=$(echo $line | cut -d""-f1)
? ? ? ? CURR_LINE_IP=$(echo $line | cut -d""-f2)
? ? ? ? if[ $CURR_LINE_CONN -lt $NO_OF_CONNECTIONS ]; then
? ? ? ? ? ? break? ? ? ? fi
? ? ? ? IGNORE_BAN=`grep -c $CURR_LINE_IP $IGNORE_IP_LIST`
? ? ? ? if[ $IGNORE_BAN -ge1 ]; then
? ? ? ? ? ? continue? ? ? ? fi
? ? ? ? IP_BAN_NOW=1? ? ? ? echo "$CURR_LINE_IP with $CURR_LINE_CONN connections">> $BANNED_IP_MAIL
? ? ? ? echo $CURR_LINE_IP >> $BANNED_IP_LIST
? ? ? ? echo $CURR_LINE_IP >> $IGNORE_IP_LIST
? ? ? ? if[ $APF_BAN -eq1 ]; then
? ? ? ? ? ? $APF -d $CURR_LINE_IP
? ? ? ? else? ? ? ? ? ? $IPT -I INPUT -s $CURR_LINE_IP -j DROP
? ? ? ? fi
? ? done < $BAD_IP_LIST
? ? if[ $IP_BAN_NOW -eq1 ]; then
? ? ? ? dt=`date`
? ? ? ? if[ $EMAIL_TO !="" ]; then
? ? ? ? ? ? cat $BANNED_IP_MAIL | mail -s"IP addresses banned on $dt" $EMAIL_TO
? ? ? ? fi
? ? ? ? unbanip
? ? fi
fi
rm -f $TMP_PREFIX.*
# cat ignore.ip.list 127.0.0.110.100.0.5#不防御的ip
?注意權(quán)限:
# ll /etc/cron.d/ddos.cron -rw-r--r--1root root71Sep1417:13/etc/cron.d/ddos.cron
注意軟連接:
# ll /usr/local/sbin/ddos
lrwxrwxrwx 1root root23Sep1315:36/usr/local/sbin/ddos -> /usr/local/ddos/ddos.sh
轉(zhuǎn)載于:https://www.cnblogs.com/bass6/p/7522089.htm
? ? 有服務(wù)器需求請(qǐng)加QQ1911624872咨詢
