以下防止CC攻击主要是过滤访问日志的方法将IP封入防火墙内,将脚本放入cron中十分钟执行一次即可,也可跟据自己的需求进行修改,因为我使用的lighttp做web服务器,所以是读取lighttp访问日志,此脚本同样适用apache服务器:

#!/bin/bash
/www/MTCC/solution_ip.sh
/usr/bin/tail -1000 /var/log/lighttpd/access.log | grep -v 127.0.0.1 | awk '{print $1}' | awk '$1 {++S[$1]} END {for(a in S) print a, S[a]}' | sort -k 2 -n -r | awk '$2>10 {print $1}' > /www/MTCC/block_ip.txt
/www/MTCC/block_ip.sh
#!/bin/bash
for blockIp in `cat /www/MTCC/block_ip.txt`
do
echo "Blocking...$blockIp"
/sbin/iptables -I IPTABLES 4 -s $blockIp -j REJECT
done
#iptables -A INPUT -s $1 -j REJECT
#!/bin/bash
/usr/bin/tail -1000 /var/log/lighttpd/access.log | grep -v 127.0.0.1 | awk '{print $1}' | awk '$1 {++S[$1]} END {for(a in S) print a, S[a]}' | sort -k 2 -n -r | awk '$2>10 {print $1,$2}'

文章地址:http://blog.nodll.com/2011/04/25/shell-cc/Pray.html

标签：,,,,,

阅读更多: Pray