使用DDOS脚本缓解DDOS攻击

1、安装DDoS deflate

[root@hjj ~]#wget http://www.inetbase.com/scripts/ddos/install.sh   //确定能上网
[root@hjj ~]# chmod 700 install.sh    //添加权限
[root@hjj ~]#./install.sh             //安装   第一次可能不成功，卸载后再装一次就行了
Installing DOS-Deflate 0.6
 
Downloading source files.........done
 
Creating cron to run script every minute.....(Default setting).....done
 
Installation has completed.
Config file is at /usr/local/ddos/ddos.conf
Please send in your comments and/or suggestions to zaf@vsnl.com
 
##############################################################################
##############################################################################
#                       "Artistic License"                                   #
#                                                                            #
#                           Preamble                                         #
#                                                                            #
# The intent of this document is to state the conditions under which a       #
# Package may be copied, such that the Copyright Holder maintains some       #
q 输入q 退出。

DDoS deflate安装路径：

[root@hjj ~]# ls /usr/local/ddos/

配置文件：

[root@hjj ~]# ls /usr/local/ddos/ddos.conf
/usr/local/ddos/ddos.conf
 
[root@hjj ~]# cat /usr/local/ddos/ignore.ip.list    #IP地址白名单
127.0.0.1
[root@hjj ~]# vim /usr/local/ddos/ddos.conf   #查看
##### Paths of the script and other files
PROGDIR="/usr/local/ddos"
##### Paths of the script and other files
PROGDIR="/usr/local/ddos"
PROG="/usr/local/ddos/ddos.sh"  #要执行的DDOS脚本
IGNORE_IP_LIST="/usr/local/ddos/ignore.ip.list"  //IP地址白名单，注：在这个文件中IP不受控制。
CRON="/etc/cron.d/ddos.cron"    //定时执行程序

实战： 如果1分钟内，一个IP地址对我们服务器访问150次以上，就认为发生DDOS，使用防火墙把这个IP地址自动屏蔽掉。

[root@hjj ~]# vim /usr/local/ddos/ddos.conf

配置文件中的注释如下：

##### frequency in minutes for running the script
##### Caution: Every time this setting is changed, run the script with --cron
#####          option so that the new frequency takes effect
FREQ=1   //检查时间间隔，默认1分钟
 
##### How many connections define a bad IP? Indicate that below.
NO_OF_CONNECTIONS=150     //最大连接数，超过这个数IP就会被屏蔽，一般默认即可
 
##### APF_BAN=1 (Make sure your APF version is atleast 0.96)
##### APF_BAN=0 (Uses iptables for banning ips instead of APF)
APF_BAN=1        //使用APF还是iptables。推荐使用iptables,将APF_BAN的值改为0即可。
改：19 APF_BAN=1
为：19 APF_BAN=0
 
##### KILL=0 (Bad IPs are'nt banned, good for interactive execution of script)
##### KILL=1 (Recommended setting)
KILL=1   //是否屏蔽IP，默认即可
 
##### An email is sent to the following address when an IP is banned.
##### Blank would suppress sending of mails
EMAIL_TO=cd@xuegod.cn   //当IP被屏蔽时给指定邮箱发送邮件报警，换成自己的邮箱即可
 
##### Number of seconds the banned ip should remain in blacklist.
BAN_PERIOD=600    //禁用IP时间，默认600秒，可根据情况调整
用户可根据给默认配置文件加上的注释提示内容，修改配置文件。

一键卸载：

[root@hjj ~]#wget http://www.inetbase.com/scripts/ddos/uninstall.ddos
[root@hjj ~]# chmod  +x uninstall.ddos
[root@hjj ~]# ./uninstall.ddos
Uninstalling DOS-Deflate
Deleting script files.........done
 
Deleting cron job.......done
 
Uninstall Complete