Форум системных администраторов

Код: Выделить всё

#!/bin/sh
# Needed variables and 
IPT="/sbin/iptables"	# Iptables
NO_OF_CONNECTIONS=2	# How many connections define a bad IP? Indicate that here.
BAN_PERIOD=300		# Number of seconds the banned ip should remain in blacklist.

# Function for unbanning blacklisted ip.

unbanip()
{
	UNBAN_SCRIPT=`mktemp /tmp/unban.XXXXXXXX`
	TMP_FILE=`mktemp /tmp/unban.XXXXXXXX`
	UNBAN_IP_LIST=`mktemp /tmp/unban.XXXXXXXX`
	echo '#!/bin/sh' > $UNBAN_SCRIPT
	echo "sleep $BAN_PERIOD" >> $UNBAN_SCRIPT
	while read line; do
		echo "$IPT -D INPUT -s $line -j DROP" >> $UNBAN_SCRIPT
		echo $line >> $UNBAN_IP_LIST
	done < $BANNED_IP_LIST
	echo "rm -f $UNBAN_SCRIPT" >> $UNBAN_SCRIPT
	echo "rm -f $UNBAN_IP_LIST" >> $UNBAN_SCRIPT
	echo "rm -f $TMP_FILE" >> $UNBAN_SCRIPT
	. $UNBAN_SCRIPT &
}

TMP_PREFIX='/tmp/ddos'
TMP_FILE="mktemp $TMP_PREFIX.XXXXXXXX"
BANNED_IP_LIST=`$TMP_FILE`
BAD_IP_LIST=`$TMP_FILE`
netstat -ntu | grep '^[AP]' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr > $BAD_IP_LIST
cat $BAD_IP_LIST
IP_BAN_NOW=0
while read line; do
	CURR_LINE_CONN=$(echo $line | cut -d" " -f1)
	CURR_LINE_IP=$(echo $line | cut -d" " -f2)
	if [ $CURR_LINE_CONN -lt $NO_OF_CONNECTIONS ]; then
		break
	fi
	IP_BAN_NOW=1
	echo $CURR_LINE_IP >> $BANNED_IP_LIST
	$IPT -I INPUT -s $CURR_LINE_IP -j DROP
done < $BAD_IP_LIST
if [ $IP_BAN_NOW -eq 1 ]; then
	unbanip
fi
rm -f $TMP_PREFIX.*