动态获取bind dns日志IP脚本

最新推荐文章于 2024-11-06 08:59:29 发布

weixin_30701575

最新推荐文章于 2024-11-06 08:59:29 发布

阅读量117

点赞数

文章标签：运维 python awk

原文链接：http://www.cnblogs.com/dribs/p/7068675.html

版权

#!/usr/bin/env python
#_*_coding:utf-8_*_
'''
python deny_dns_allip.py your_filelog_name
动态获取dns日志的IP地址，把不满足条件的都drop掉
此脚本修改后可以动态拒绝任何日志内的IP
相当于 tail -f filename | awk -F "你的条件" ，然后 把结果输送到iptables -I INPUT -s %s -j DROP
'''
from sys import argv 
import collections 
import time,os,re
o = open(argv[1], 'r') 
print(''.join(collections.deque(o, 5)).strip('\n')) # last 5 lines 
o.seek(0,2) # jump to last line 

ip_list = []
while 1: 
    line = o.readline() 
    if not line: 
        time.sleep(0.1) 
        continue 
    ret = line.strip('\n')
    try:
        #正则的条件，根据该字段获取该字段的IP
        ip = str(ret.split("query: hoffmeister.be IN ANY +E")[0])
        ipstr = re.search('\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}',ip).group()
        #排除部分IP，排除172网段124网段211网段，根据需要自己定义
        exclude_ips = str(ipstr.split(".")[0])
        allow_ips = ['172','124','211']
        #
        #print("ip_list:",ip_list)
        if ipstr not in ip_list and exclude_ips not in allow_ips:
            ip_list.append(ipstr)
            #取最新的IP，然后drop掉
            print("======>>i:",ip_list[-1])
            os.system("iptables -I INPUT -s %s -j DROP"%(ip_list[-1]))
            print("iptables -I INPUT -s %s -j DROP"%(ip_list[-1]))
        else:
            pass
    except:
        b=None

加强版

动态获取日志，然后调用淘宝ip查询的API 智能判断来源IP属于什么地方，当是国外的IP时，直接干掉。

解决了部分用户使用手机4G测试时的被意外干掉的情况。

# -*- coding: utf-8 -*-
import requests,os
 
def checkip(ip):
 
  URL = 'http://ip.taobao.com/service/getIpInfo.php'
  try:
    r = requests.get(URL, params=ip, timeout=2)
  except requests.RequestException as e:
     #pass
    print(e)
  else:
    json_data = r.json()
    if json_data[u'code'] == 0:
      #print "ipvalues",type(ip.values())
      ret = json_data[u'data'][u'country'].encode('utf-8') + str(ip.values())
      #print ret
      country = json_data[u'data'][u'country'].encode('utf-8')
      if country != '中国':
        ret_ip = ip.values()[0]
        print "---------------country and ip",country, ret_ip
        os.system("iptables -I INPUT -s %s -j DROP"%(ret_ip))
        print("iptables -I INPUT -s %s -j DROP"%(ret_ip))
      else:
        print"----china",ip.values()[0]
      #return json_data[u'data'][u'country'].encode('utf-8') + str(ip.values())
      #print '所在地区： ' + json_data[u'data'][u'area'].encode('utf-8')
      #print '所在省份： ' + json_data[u'data'][u'region'].encode('utf-8')
      #print '所在城市： ' + json_data[u'data'][u'city'].encode('utf-8')
      #print '所属运营商：' + json_data[u'data'][u'isp'].encode('utf-8')
    else:
       #pass
      print '查询失败,请稍后再试！'

#ip= {'ip':'67.177.203.45'}
#checkip(ip)

#!/usr/bin/env python
#_*_coding:utf-8_*_

from sys import argv 
import collections 
import time,os,re
import ip_check


o = open(argv[1], 'r') 
print(''.join(collections.deque(o, 5)).strip('\n')) # last 5 lines 
o.seek(0,2) # jump to last line 

ip_list = []
while 1: 
    line = o.readline() 
    if not line: 
        time.sleep(2) 
        continue 
    ret = line.strip('\n')
    try:
        ip = str(ret.split("query: hoffmeister.be IN ANY +E")[0])
        ipstr = re.search('\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}',ip).group()
        #
        exclude_ips = str(ipstr.split(".")[0])
        allow_ips = ['172','124','211']
        #
        #print("ip_list:",ip_list)
        if ipstr not in ip_list and exclude_ips not in allow_ips:
            ip_list.append(ipstr)
            print("======>>i:",ip_list[-1])
            #f = open('ip.txt','a+')
            #f.write(ip_list[-1]+'\n')
            #f.close()
            check_ips = {'ip':ip_list[-1]}
            ip_check.checkip(check_ips)
        else:
            pass
    except:
        b=None

bind dns日志配置添加如下行。有点诡异日志的路径并非根下的var 而是运行bind的根下的var

[root@localhost var]# ls
log  named  run  tmp
[root@localhost var]# cd log/
[root@localhost log]# ls
den_txt_ip.py          deny_dns_ip.py  ip-check.txt  query.log    query_log.10  query_log.13  query_log.16  query_log.2  query_log.5  query_log.8  test.log
deny_dns_allip.py      ip_check.py     ip.txt        query_log.0  query_log.11  query_log.14  query_log.17  query_log.3  query_log.6  query_log.9  test.py
deny_dns_allip.py.bak  ip_check.pyc    query_log     query_log.1  query_log.12  query_log.15  query_log.18  query_log.4  query_log.7  read_ip.py
[root@localhost log]# pwd
/var/named/chroot/var/log
[root@localhost log]# ps -ef |grep "named"
root       518     1  0 Jun22 ?        00:00:04 named -d 1
named     4400     1  2 11:20 ?        00:06:47 /usr/sbin/named -u named -t /var/named/chroot
root     29940 26031  0 15:47 pts/8    00:00:00 grep named
root     32069     1  0 Jun22 ?        00:00:01 named -d 1

logging {  
    /*指定服务器日志记录的内容和日志信息来源*/  
    channel "default_syslog" {  
        syslog daemon; /* 发送给syslog 的daemon facility */  
        severity info; /* 只发送此优先级和更高优先级的信息 */  
    };  
    channel default_debug {  
        file "data/named.run"; /* 写入工作目录下的named.run 文件。注意：如果服务器用-f 参数启动，则"named.run"会被stderr 所替换。*/  
        severity dynamic; /*  按照服务器当前的debug 级别记录日志 */  
        };  
    channel xfer_in_log {  
        file "/var/log/named/xfer_in_log" versions 100 size 10m;  
        severity info;  
        print-category yes;  
        print-severity yes;  
        print-time yes;  
    };  
  
    channel xfer_out_log {  
        file "/var/log/named/xfer_out_log" versions 100 size 10m;  
        severity info;  
        print-category yes;  
        print-severity yes;  
        print-time yes;  
    };  
  
    channel notify_log {  
        file "/var/log/named/notify_log" versions 100 size 10m;  
        severity info;  
        print-category yes;  
        print-severity yes;  
        print-time yes;  
    };  
  
    channel general_log {  
        file "/var/log/named/general_log" versions 400 size 100m;  
        severity info;  
        print-category yes;  
        print-severity yes;  
        print-time yes;  
    };  
  
    channel default_log {  
        file "/var/log/named/default_log" versions 400 size 100m;  
        severity info;  
        print-category yes;  
        print-severity yes;  
        print-time yes;  
    };  
  
    channel update_log {  
        file "/var/log/named/update_log" versions 100 size 10m;  
        severity info;  
        print-category yes;  
        print-severity yes;  
        print-time yes;  
    };  
  
    channel query_log {  
        file "/var/log/query_log" versions 1024 size 100m;  
        severity info;  
        print-category no;  
        print-severity no;  
        print-time yes;  
    };  
  
    category queries { query_log; };  
    category default { default_log; };  
    category general { general_log; };  
    category xfer-in { xfer_in_log; };  
    category xfer-out { xfer_out_log; };  
    category notify { notify_log; };  
    category update { update_log; };  
};