niko

知行合一

致良知
x
email
HomeArchives关于

DDoS Attack Prevention (Automatically Block Attack IP)

7
AI Translation
This post is translated from Japanese into English through AI.View Original
AI-generated summary
The script monitors a log file for IP addresses that exceed 10 requests on the current date. It identifies these abnormal IPs and, if they are not already blocked by iptables, adds them to the block list and logs the action in a separate file.
#!/bin/bash
DATE=$(date +%d/%b/%Y:%H:%M)
LOG_FILE=/usr/local/nginx/logs/demo2.access.log
ABNORMAL_IP=$(tail -n5000 $LOG_FILE |grep $DATE |awk '{a[$1]++}END{for(i in
a)if(a[i]>10)print i}')
for IP in $ABNORMAL_IP; do
	if [ $(iptables -vnL |grep -c "$IP") -eq 0 ]; then
		iptables -I INPUT -s $IP -j DROP
		echo "$(date +'%F_%T') $IP" >> /tmp/drop_ip.log
	fi
done
Loading...
Ownership of this post data is guaranteed by blockchain and smart contracts to the creator alone.