Essential tool for centos RedHat to defend against DDoS attacks: banip.txt

CopyCode The Code is as follows: ######################################## ######
# Version = "20100718"
# Author = "phpsir"
# Author_email = "phpsir@phpsir.com"
######################################## ######
Maxnum = 50
Runmin_max= 300
# Runmin_max is clear time
Ipfile = "/tmp/80link.txt"
Banip_data_file = "/root/banip_data.txt"
Ipopenfile = "/root/openip.txt"
Nsfile = "/tmp/netstat80.txt"

Myip = '/sbin/ifconfig eth0 | grep Inet | awk' {print $2} '| SED's/ADDR: //' | grep .'
If [! -F $ ipopenfile]
Then
Echo "init $ ipopenfile"
Touch $ ipopenfile
Fi
If [-F $ banip_data_file]
Then
Source $ banip_data_file
Echo "Last runtime = $ RunTime"
Else
Echo "init $ banip_data_file"
Echo 'runtime = ''date "+ % s" '> $ banip_data_file
Source $ banip_data_file
Runmin_max =-1
Fi

Echo "Start shell" 'date "+ % Y-% m-% d % H: % m: % s "'
Runmin = $ ('date "+ % s" '-$ runtime ))
If [$ runmin-GT $ runmin_max]
Then
Echo $ runmin "is bigger than" $ runmin_max
Echo "Clear IPS"
/Sbin/iptables-F
Echo 'runtime = ''date "+ % s" '> $ banip_data_file
Else
Echo $ runmin "is lowwer than" $ runmin_max
Fi

Netstat-an | grep "$ myip: 80"> $ nsfile

Echo "total links =" 'cat $ nsfile | WC-l'
Echo "total links established =" 'cat $ nsfile | grep established | WC-l'
Echo "total links sync =" 'cat $ nsfile | grep SYN | WC-l'

Cat $ nsfile | awk '{print $5}' | awk-F: '{print $1}' | sort | uniq-c | sort-Rn | head-N 10> $ ipfile

Cat $ ipfile | while read oneline
Do
IP = 'echo $ oneline | cut-d ""-F 2'
Num = 'echo $ oneline | cut-d ""-F 1'
STR = "$ IP has linked $ num"
Banme = "yes"

For allowip in 'cat $ ipopenfile'
Do
Echo $ IP | grep $ allowip>/dev/null
If [$? -EQ 0]
Then
Banme = "no"
Echo $ allowip "banme =" $ banme
/Sbin/iptables-D input-p tcp-S $ IP-d $ myip -- dport 80-J reject>/dev/null 2> & 1
Continue
Fi
Done

If [$ banme = "yes"]
Then
If [$ num-GT "$ maxnum"]
Then
/Sbin/iptables-l-N | grep "$ IP">/dev/null
Status = 'echo $? '
If [$ status-EQ 1]
Then
Echo "Deny $ IP, because $ Str"
/Sbin/iptables-A input-P TCP/IP $ IP-d $ myip -- dport 80-J reject
Echo "ban" $ IP "OK"
#/Sbin/iptables-l-N | grep "$ IP"
Else
Echo>/dev/null
# Echo "$ STR alread reject"
Fi
Else
Echo>/dev/null
# Echo "$ STR $ ip OK, less $ maxnum"
Fi
Fi

Done

Echo "Stop shell" 'date "+ % Y-% m-% d % H: % m: % s "'