Centos-shell script for simple CC attack handling

The first script is to find IP addresses that are frequently accessed in logs and shield them with iptables.

 #  ! /Bin/bash Cur = 'date + % H % m % S 'becur = 'Date-d "  1 minute ago  " + % H % m % S 'badip = 'Tail-N 10000/home/www. centos. BZ/log/access. log | egrep-V "  \. (GIF | JPG | JPEG | PNG | CSS | JS)  " | Awk-v a = "  $ Becur " -V B = "  $ Cur  "   -F ['':] '{T = $5 $6 $7 ; If (T> = A & T <= B) print $1 } '| Sort | uniq-c | awk '{ If ( $1 > = 20) print $2  }''  If [! -Z " $ Badip  "  ]; Then  For IP In   $ Badip  ;  Do  If Test-z "  '/Sbin/iptables-nl | grep $ ip' "; then/sbin/iptables-I input-S $ IP-J dropfidonefi 

Set thisCodeSave as ban. SH and add cronjob to execute it once every minute.
This script uses iptables to block more than 20 IP addresses accessing pages per minute. These pages have excluded static files such as images, CSS, and Js.

 

The second script is to block CC attack features in logs.

 #  ! /Bin/bash Keyword = "  CC-atack  "  Badip = 'Tail-N 5000/home/www. centos. BZ/log/access. log | grep "  $ Keyword  " | Awk '{print $1 } '| Sort | uniq-c | sort-Nr | awk' {print $2  }''  If [! -Z"  $ Badip  "  ]; Then  For IP In   $ Badip  ;  Do  If Test-z "  '/Sbin/iptables-nl | grep $ ip' "; then/sbin/iptables-I input-S $ IP-J dropfidonefi 

Keyword is the CC feature in the log, which can be replaced with valid.

《ArticleSource: http://www.centos.bz/2012/06/linux-cc-attack-shell-script/"