#!/bin/bash
#Collecting list of ip addresses connected to port 80
netstat -plan|grep :80|awk {‘print $5′}|cut -d: -f 1|sort|uniq -c|sort -nk 1 >
/root/iplist
#Limit the no of connections
LIMIT=15;
for ip in `cat /root/iplist |awk ‘{print $2}’`;do
if [ `grep $ip /root/iplist | awk '{print $1}'` -gt $LIMIT ]
then
echo “15 connection from $ip… `grep $ip /root/iplist | awk ‘{print $1}’` number of connections… Blocking $ip”;
#Blocking the ip …
CHECK_IF_LOCALIP=0;
/sbin/ifconfig | grep $ip > /dev/null;
if [ $? -ne $CHECK_IF_LOCALIP ]
then {
FLAG=0;
grep $ip /etc/csf/csf.deny > /dev/null;
if [ $? -ne $FLAG ]
then
iptables -I INPUT -s $ip -j DROP;
echo “deny $ip;” >> /usr/local/nginx/conf/vhost/block.conf;
/usr/sbin/csf -d $ip;
~/lnmp reload;
else
echo ” Ipaddress $ip is already blocked “;
fi
}
else
echo ” Sorry, the ip $ip cannot be blocked since this is a local ip of the server “;
fi
fi
done作者: Zoplor 时间: 2014-1-19 22:22
防CC？ 作者: thymol 时间: 2014-1-19 22:25
提示: 作者被禁止或删除 内容自动屏蔽作者: ★Extreme★ 时间: 2014-1-19 23:05
获取所有与你服务器链接的IP，连接数超过15的就通过iptables和nginx封禁。作者: 晓白 时间: 2014-1-20 00:23
提示: 作者被禁止或删除 内容自动屏蔽
