CC攻击简单报警

先分享一个简单的报警脚本：

#!/bin/bash
#Writer:lin_credible@163.com
#---------------10分钟内访问超过600次的访问IP---------------------------
#+ 10分钟 可以调整
#-----------------------------------------------------------------------

if [ $# -ne 1 ]
then
        echo "Wrong Enter!"
        echo "Usage: `basename $0` logs_file's_path"
        exit 1
fi

if [ ! -e $1 ]
then
        echo "The log_file is not exists!"
        exit 1
fi

#-----------------------------------------------------------------------

date_now=`date +%d/%b/%Y:%H:%M`
date=`date -d "10 minute ago" +%d/%b/%Y:%H:%M`
date1=${date%[0-9]}

cat $1|grep "$date1"|awk '{print $3}'|sort|uniq -c|sort -nr|awk '{if($1 > 30) print $2}'
> ip_list_10minute.txt

while read a
do
                arr[x++]="${a}";
done < ip_list_10minute.txt

j="${#arr[@]}"

if [ $j -gt 0 ]
        then
                echo  "10分钟内访问数超过600次的ip列表如下" >> bad_ip_list.txt
        else
                exit 0
fi

for (( i=$(( $j - 1 ));i>=0;i-- ))
do
        echo  "${date_now} ----> IP: ${arr[$i]}" >> bad_ip_list.txt
        cat $1|grep -E "\s${arr[$i]}\s"|sort -nr|awk 'NR==1{print $0}' >>bad_ip_list.txt
        echo  " " >>bad_ip_list.txt
done

send_mail()
{
        while (( $# > 0 ))
        do
                mail -s "web访问报警" $1@163.com < bad_ip_list.txt
                shift
        done
}

#send_mail lin_credible xxx yyy zzz

send_mail lin_credible

rm -rf bad_ip_list.txt &> /dev/null 
rm -rf ip_list_10minute.txt &> /dev/null

Linux下 自动屏蔽DDOS攻击者IP DDoS deflate

链接限制的iptables规则：

#iptables -I INPUT -p tcp –dport 80 -m connlimit –connlimit-above 10 -j REJECT

Notice：如果相关站点做了CDN加速的，别错杀了连接！
PS: 转了一篇好文章！Nginx简单防御CC攻击的两种方法