{"id":1939,"date":"2020-12-18T11:08:37","date_gmt":"2020-12-18T03:08:37","guid":{"rendered":"http:\/\/www.menshours.com\/?p=1939"},"modified":"2021-01-06T14:21:23","modified_gmt":"2021-01-06T06:21:23","slug":"nginxshellip-cc-ddos","status":"publish","type":"post","link":"https:\/\/www.menshours.com\/index.php\/2020\/12\/18\/nginxshellip-cc-ddos\/","title":{"rendered":"\u5b9d\u5854\u9762\u677fNginx\u914d\u5408shell\u811a\u672c\u5b9e\u73b0\u81ea\u52a8\u5c01\u7981IP \u9632\u5fa1CC DDOS\u653b\u51fb\u65b9\u6cd5"},"content":{"rendered":"\n

\u5b9d\u5854\u9762\u677f\u73b0\u5728\u5f88\u591a\u5c0f\u767d\u7528\u6237\u4f7f\u7528\u7684\u975e\u5e38\u591a\uff0c\u529f\u80fd\u6bd4\u8f83\u7b80\u5355\u6613\u7528\uff0c\u4f46\u662f\u5176\u4e2d\u9632\u5fa1\u529f\u80fd\u8f83\u5f31\uff0c\u5185\u7f6e\u7684WAF\u5e76\u4e0d\u80fd\u5b9e\u73b0\u670d\u52a1\u5668\u7ea7\u522b\u7684\u9632\u706b\u5899\u5c01IP\uff0c\u6240\u4ee5\u6211\u4eec\u53ea\u80fd\u501f\u7528\u4e00\u4e0b\u5176\u4e2d\u7684\u529f\u80fd\uff0c\u52a0\u4e0aLINUX\u7cfb\u7edf\u5929\u7136\u81ea\u5e26\u7684SHELL+IPTABLES\u9632\u706b\u5899\u6765\u5c01\u7981IP<\/p>\n\n\n\n

\u5b9d\u5854\u5b89\u88c5\u7684NGINX\u6309\u4e0b\u9762\u914d\u7f6e<\/strong><\/p>\n\n\n\n

\u8f6f\u4ef6\u7ba1\u7406-Nginx\u7ba1\u7406-\u914d\u7f6e\u4fee\u6539<\/p>\n\n\n\n

\u5c06<\/p>\n\n\n\n

error_log  \/www\/wwwlogs\/nginx_error.log  crit;<\/p>\n\n\n\n

\u6539\u6210<\/p>\n\n\n\n

error_log  \/www\/wwwlogs\/nginx_error.log  error;<\/p>\n\n\n\n

\u7136\u540e\u5230\u9700\u8981\u5f00\u542f\u9632\u5fa1\u7684\u7f51\u7ad9\u7ba1\u7406 \u70b9 \u8bbe\u7f6e-\u6d41\u91cf\u9650\u5236<\/p>\n\n\n\n

\u8fd9\u91cc\u542f\u7528\u6d41\u91cf\u9650\u5236,\u5e76\u5c06\u5355IP\u5e76\u53d1\u6570\u8fdb\u884c\u9650\u5236,\u4e00\u822c\u5982\u679c\u7f51\u7ad9\u9875\u9762\u4e0d\u590d\u6742\u8bbe\u7f6e\u4e3a10\u5c31\u884c\u3002\u5982\u679c\u7f51\u9875\u6709\u5f88\u591a\u8c03\u7528CSS,JS\u4e4b\u7c7b\u7684\uff0c\u81ea\u884c\u8ba1\u7b97\u4e00\u4e0b<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u8fd9\u6837\u91cd\u542f NGINX \u540e\u5f53\u6709\u5ba2\u6237\u7aef\u9891\u7e41\u5237\u65b0\u4f60\u7684\u7f51\u9875\uff0c\u53d1\u8d77\u7684\u8bf7\u6c42\u5c06\u5728\u8d85\u8fc7\u8bbe\u7f6e\u7684\u6bcf\u79d2\u949f\u5141\u8bb8\u6570\u91cf\u540e\u88ab\u7981\u6b62\u8bbf\u95ee\uff0c\u540c\u65f6\u5c06\u5728 NGINX error.log(\u9ed8\u8ba4\u5728 \/www\/wwwroot\/nginx_error.log) \u4e2d\u770b\u5230\u7c7b\u4f3c\u8bb0\u5f55:<\/p>\n\n\n\n

2018\/04\/27 14:25:27 [error] 6307#0: *1472746 limiting connections by zone “perip”, client: 182.161.35.139, server: 104.153.102.68, request: “GET \/index.php?10=8 HTTP\/1.1”<\/p>\n\n\n\n

\u6b64\u65f6\u8bf7\u6c42\u5df2\u7ecf\u88ab NGINX \u9650\u6d41,\u4f46\u662f\u5ba2\u6237\u7aef\u4ecd\u7136\u80fd\u591f\u7ee7\u7eed\u53d1\u9001\u8bf7\u6c42\u5230NGINX,\u8fd8\u662f\u4f1a\u5360\u7528\u4e00\u5b9a\u7684\u670d\u52a1\u5668\u8d44\u6e90\u3002<\/p>\n\n\n\n

\u56e0\u6b64\u63a5\u4e0b\u6765\u8fdb\u884cshell\u811a\u672c\u8bbe\u7f6e\uff0c\u5c06\u8fd9\u4e2aclient\u7684IP\u76f4\u63a5\u901a\u8fc7\u9632\u706b\u5899\u5c01\u6740<\/p>\n\n\n\n

\u9996\u5148\u5347\u7ea7\u7cfb\u7edf\u8f6f\u4ef6\u5e76\u5b89\u88c5iptables<\/strong><\/p>\n\n\n\n

\u8fde\u63a5SSH\u6267\u884c<\/p>\n\n\n\n

yum -y update<\/pre>\n\n\n\n
\u5bf9\u7cfb\u7edf\u8f6f\u4ef6\u8fdb\u884c\u5fc5\u8981\u5347\u7ea7\u3002<\/p>\n\n\n\n
\u63a5\u4e0b\u6765\u786e\u8ba4\u4f60\u7684\u7cfb\u7edf\u7248\u672c\uff0c\u811a\u672c\u5728CENTOS6,CENTOS7\u4e0b\u5747\u6d4b\u8bd5\u53ef\u7528,\u4f46\u662fCENTOS7\u9ed8\u8ba4\u9632\u706b\u5899\u662ffirewalle\uff0c\u8fd9\u4e2a\u6682\u65f6\u6ca1\u7814\u7a76\u600e\u4e48\u8bbe\u7f6e\uff0c\u6240\u4ee5\u8fd8\u662f\u5efa\u8bae\u5927\u5bb6\u5b89\u88c5\u4e00\u4e0biptables,\u5982\u679c\u662fCENTOS6\u9ed8\u8ba4\u7684\u9632\u706b\u5899\u662fiptables\u90a3\u5c31\u65e0\u987b\u8fd9\u4e00\u6b65\u64cd\u4f5c<\/p>\n\n\n\n
#\u5148\u68c0\u67e5\u662f\u5426\u5b89\u88c5\u4e86iptables<\/p>\n\n\n\n
service iptables status
#\u5b89\u88c5iptables
yum install -y iptables
#\u5347\u7ea7iptables
yum update iptables 
#\u5b89\u88c5iptables-services
yum install iptables-services<\/p>\n\n\n\n
\u7981\u7528\/\u505c\u6b62\u81ea\u5e26\u7684firewalld\u670d\u52a1<\/p>\n\n\n\n
#\u505c\u6b62firewalld\u670d\u52a1
systemctl stop firewalld
#\u7981\u7528firewalld\u670d\u52a1
systemctl mask firewalld<\/p>\n\n\n\n
\u4e8c\u3001\u8fdb\u884c\u811a\u672c\u8bbe\u7f6e<\/strong><\/p>\n\n\n\n
\u8fdbCENTOS<\/p>\n\n\n\n
vi \/www\/wwwroot\/iptables.sh<\/pre>\n\n\n\n
shell\u811a\u672c\u5982\u4e0b<\/p>\n\n\n\n
#!\/bin\/bash\ntail \/www\/wwwlogs\/nginx_error.log -n 200 | grep \"perip\"| awk -F'[ ,]' '{print $13}' | sort | uniq | sort -n > \/www\/wwwroot\/drop_ip.txt \nfor i in $(cat \/www\/wwwroot\/drop_ip.txt)\ndo \nFLAG=0  \n  for j in $(cat \/www\/wwwroot\/drop_ip_all.txt)\ndo\n      if [ $i = $j ]; then  \n        FLAG=1  \n        break  \n      fi  \n  done  \n  if [ $FLAG -eq 0 ]; then  \n    echo --new drop ip:$i \n    #add to iptables  \n    \/sbin\/iptables -C INPUT -s $i -j DROP  \n  fi  \ndone  \n  \n#select drop_ip.txt append to drop_ip_all.txt  \ncat \/www\/wwwroot\/drop_ip.txt >> \/www\/wwwroot\/drop_ip_all.txt  \n  \n#drop_ip_all remove repeat ip  \n#cat \/www\/wwwroot\/drop_ip_all.txt | sort | uniq > \/www\/wwwroot\/drop_ip_all.txt<\/pre>\n\n\n\n
\u5bf9\u4e8e\u90e8\u5206\u8f83\u4f4e\u7248\u672c\u7684IPTABLES\u9632\u706b\u5899\u53ef\u80fd\u4e0d\u652f\u6301-C\u53c2\u6570\uff0c\u53ef\u4ee5\u6539\u6210-I\uff0c<\/p>\n\n\n\n
iptables -C INPUT -s $i -j DROP<\/pre>\n\n\n\n
\u6539\u6210<\/p>\n\n\n\n
iptables -I INPUT -s $i -j DROP<\/pre>\n\n\n\n
\u53e6\u5916\u9488\u5bf9\u90e8\u5206\u73af\u5883\uff0c\u5b9d\u5854\u5b58\u5728BUG\uff0c\u65e0\u6cd5\u8bb0\u5f55\u5230\u6d41\u91cf\u63a7\u5236\u4fe1\u606f\uff0c\u6bd4\u5982\u90e8\u5206\u7cfb\u7edf\u53cd\u4ee3\u7684\u60c5\u51b5\u4e0b\u5c31\u6709\u51fa\u73b0\u65e0\u6cd5\u8bb0\u5f55\u6d41\u63a7\u9519\u8bef\u4fe1\u606f\u7684\u60c5\u51b5\uff0c\u9020\u6210\u65e0\u6cd5\u9632\u5fa1\u7684\u60c5\u51b5\uff0c\u53ef\u4ee5\u5c06\u7b2c\u4e00\u53e5\u6539\u6210\u4ece\u7f51\u7ad9\u65e5\u5fd7\u53d6\u503c<\/p>\n\n\n\n
tail \/www\/wwwlogs\/nginx_error.log -n 200 | grep \"perip\"| awk -F'[ ,]' '{print $13}' | sort | uniq | sort -n > \/www\/wwwroot\/drop_ip.txt<\/pre>\n\n\n\n
\u66ff\u6362\u6210<\/p>\n\n\n\n
tail -1000 \/www\/wwwlogs\/bnxb.com.log |cut -d ' ' -f 1 | sort |uniq -c | awk '{if ($1 > 100) print $0}' > \/www\/wwwroot\/drop_ip.txt<\/pre>\n\n\n\n
\u610f\u601d\u662f\u8bfb\u53d6\u7f51\u7ad9\u65e5\u5fd7\u7684\u524d\u4e00\u5343\u6761\u8bb0\u5f55\uff08\u9632\u6b62\u65e5\u5fd7\u8fc7\u5927\u8bfb\u53d6\u538b\u529b\u5927\uff09\uff0c\u7136\u540e\u53d6\u8fd9\u4e00\u5343\u6761\u4e2d\u8bbf\u95ee\u8d85\u8fc7100\u7684\u8bb0\u5f55\uff0c\u8fdb\u884c\u5c4f\u853d\uff0c\u4f46\u662f\u4e0d\u5efa\u8bae\u7528\u8fd9\u79cd\u65b9\u5f0f\uff0c\u8fd9\u79cd\u65b9\u5f0f\u5bf9\u4e8e\u5e73\u65f6\u6ca1\u4ec0\u4e48\u8bbf\u95ee\u91cf\u7684\u7f51\u7ad9\u4f1a\u9020\u6210\uff0c\u524d\u4e00\u5343\u6761\u53ef\u80fd\u90fd\u662f\u8718\u86db\u7684\u722c\u884c\u8bb0\u5f55\uff0c\u8fd9\u91cc\u7684IP\u90fd\u662f\u641c\u7d22\u5f15\u64ce\u7684\u8718\u86dbIP\uff0c\u53ef\u80fd\u4f1a\u8bef\u6740<\/p>\n\n\n\n
\u4e09\u3001\u5bf9\u811a\u672c\u8fdb\u884c\u6743\u9650\u63d0\u5347\u548c\u5199\u5165\u81ea\u52a8\u4efb\u52a1<\/strong><\/p>\n\n\n\n
chmod +x \/www\/wwwroot\/iptables.sh\necho \"* * * * * root \/www\/wwwroot\/iptables.sh\" >> \/etc\/crontab\nservice crond restart<\/pre>\n\n\n\n
\u8fd9\u91cc\u8bbe\u7f6e\u4e3a\u6bcf\u5206\u949f\u6267\u884c\u4e00\u6b21\u3002<\/p>\n\n\n\n
\u7136\u540e\u8fd8\u53ef\u4ee5\u8bbe\u7f6e\u6bcf\u5929\u51cc\u6668\u91cd\u542f\u9632\u706b\u5899<\/p>\n\n\n\n
echo \"01 1 * * * root \/etc\/init.d\/iptables restart\" >> \/etc\/crontab\nservice crond restart<\/pre>\n\n\n\n
\u56db\u3001\u786e\u5b9a\u8ba1\u5212\u4efb\u52a1\u5df2\u7ecf\u6267\u884c<\/strong><\/p>\n\n\n\n
\u6267\u884c<\/p>\n\n\n\n
crontab -l<\/pre>\n\n\n\n
\u770b\u770b\u6709\u6ca1\u6709\u4e00\u6761<\/p>\n\n\n\n
* * * * * root \/www\/wwwroot\/iptables.sh<\/pre>\n\n\n\n
\u5982\u679c\u6ca1\u6709\u53ef\u80fd\u662f\u670d\u52a1\u5668\u7528\u7684\u7cfb\u7edf\uff0c\u8ba1\u5212\u4efb\u52a1\u914d\u7f6e\u6587\u4ef6\u5df2\u7ecf\u88ab\u6539\u52a8\u8fc7\u4e0d\u662f\/etc\/crontab\u4e86<\/p>\n\n\n\n
\u53ef\u4ee5\u6267\u884c<\/p>\n\n\n\n
crontab -e<\/pre>\n\n\n\n
\u6309i\u8fdb\u5165\u63d2\u5165\u6a21\u5f0f\uff0c\u624b\u52a8\u5c06\u4e0b\u9762\u4ee3\u7801\u9ecf\u8d34\u8fdb\u53bb<\/p>\n\n\n\n
* * * * * root \/www\/wwwroot\/iptables.sh<\/pre>\n\n\n\n
\u7136\u540e\u6309ESC\uff0c\u6309shift+; \u8f93\u5165wq\u56de\u8f66\u4fdd\u5b58<\/p>\n\n\n\n
service crond restart\ncrontab -l<\/pre>\n\n\n\n
\u5f53\u7136\u5982\u679c\u4f60\u662f\u5957\u4e86CDN\uff0c\u90a3\u4e5f\u662f\u6709\u89e3\u51b3\u529e\u6cd5\u7684\uff0c\u4f46\u662f\u9700\u8981\u4f60\u7684CDN\u63d0\u4f9b\u5546\u652f\u6301IP\u9632\u706b\u5899\uff0c\u4e5f\u5c31\u662fIP\u9ed1\u540d\u5355\u529f\u80fd\uff0c\u6bd4\u5982\u6211\u4eec\u5408\u4f5c\u7684Cloudflare\u5c31\u652f\u6301\u8fd9\u4e2a\u529f\u80fd(https:\/\/cdn.bnxb.com<\/a>)\uff0c\u8fd9\u91cc\u4f1a\u751f\u4ea7\u4e00\u4efd\u5c01\u7981\u7684IP\u9ed1\u540d\u5355\uff0c\u6240\u4ee5\u53ef\u4ee5\u76f4\u63a5\u628a\u8fd9\u4e9bIP\u63d0\u4ea4\u5230CDN\uff0c\u6211\u4eec\u7684API\u53ef\u4ee5\u5b9e\u73b0\u8fd9\u4e2a\u6548\u679c\uff0c\u8be6\u89c1(https:\/\/cdn.bnxb.com<\/a>)<\/p>\n\n\n\n
\u53e6\u5916\u5982\u679c\u60a8\u53ea\u662f\u9700\u8981\u8bb0\u5f55\u4e0bIP\uff0c\u5e76\u7528\u6765\u628a\u8fd9\u4e9bIP\u901a\u8fc7\u6211\u4eec\u7684CDN.BNXB.COM\u7684\u6279\u91cf\u9632\u706b\u5899\u5bfc\u5165\u529f\u80fd\u6765\u5bfc\u5165\uff0c\u90a3\u5efa\u8bae\u7528\u8fd9\u4e2a\u811a\u672c\u6765\u751f\u6210\u5de5\u5177IP\u7684TXT\u6587\u4ef6\uff0c\u7528\u4e8e\u6279\u91cf\u63d0\u4ea4<\/p>\n\n\n\n
#!\/bin\/bash\ntail -1000 \/www\/wwwlogs\/tool.bnxb.com.log |cut -d ' ' -f 1 | sort |uniq -c | awk '{if ($1 > 100) print $2}' > \/www\/wwwroot\/drop_ip.txt\nfor i in $(cat \/www\/wwwroot\/drop_ip.txt)\ndo \nFLAG=0  \n  for j in $(cat \/www\/wwwroot\/drop_ip_all.txt)\ndo\n      if [ $i = $j ]; then  \n        FLAG=1  \n        break  \n      fi  \n  done  \n  if [ $FLAG -eq 0 ]; then  \n    echo $i >> \/www\/wwwroot\/drop_ip_all.txt  \n  fi  \ndone<\/pre>\n\n\n\n
\u53ea\u9700\u8981\u63d0\u4ea4drop_ip_all.txt\u5230\u6211\u4eec\u7684https:\/\/cdn.bnxb.com\/ipfirewall.php\u5c31\u884c\u4e86<\/p>\n\n\n\n
<\/p>\n\n\n\n
\u6587\u7ae0\u8f6c\u8f7d\uff1ahttps:\/\/www.bnxb.com\/shell\/27520.html<\/p>\n","protected":false},"excerpt":{"rendered":"
\u5b9d\u5854\u9762\u677f\u73b0\u5728\u5f88\u591a\u5c0f\u767d\u7528\u6237\u4f7f\u7528\u7684\u975e\u5e38\u591a\uff0c\u529f\u80fd\u6bd4\u8f83\u7b80\u5355\u6613\u7528\uff0c\u4f46\u662f\u5176\u4e2d\u9632\u5fa1\u529f\u80fd\u8f83\u5f31\uff0c\u5185\u7f6e\u7684WAF\u5e76\u4e0d\u80fd\u5b9e\u73b0\u670d\u52a1\u5668\u7ea7\u522b […]<\/p>\n","protected":false},"author":1,"featured_media":1942,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[143],"tags":[225,224],"class_list":["post-1939","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-143","tag-nginx","tag-224"],"_links":{"self":[{"href":"https:\/\/www.menshours.com\/index.php\/wp-json\/wp\/v2\/posts\/1939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.menshours.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.menshours.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.menshours.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.menshours.com\/index.php\/wp-json\/wp\/v2\/comments?post=1939"}],"version-history":[{"count":2,"href":"https:\/\/www.menshours.com\/index.php\/wp-json\/wp\/v2\/posts\/1939\/revisions"}],"predecessor-version":[{"id":1951,"href":"https:\/\/www.menshours.com\/index.php\/wp-json\/wp\/v2\/posts\/1939\/revisions\/1951"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.menshours.com\/index.php\/wp-json\/wp\/v2\/media\/1942"}],"wp:attachment":[{"href":"https:\/\/www.menshours.com\/index.php\/wp-json\/wp\/v2\/media?parent=1939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.menshours.com\/index.php\/wp-json\/wp\/v2\/categories?post=1939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.menshours.com\/index.php\/wp-json\/wp\/v2\/tags?post=1939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}