# tree /usr/local/ddos//usr/local/ddos/├── ddos.conf

├── ddos.sh

├── ignore.ip.list

└── LICENSE0directories,4files

# ll /usr/local/sbin/ddos

lrwxrwxrwx 1root root23Sep1315:36/usr/local/sbin/ddos -> /usr/local/ddos/ddos.sh

# cat /etc/cron.d/ddos.cron

SHELL=/bin/sh*/1* * * * root /usr/local/ddos/ddos.sh >/dev/null2>&1

查看关键的几个脚本:

# cat ddos.conf

##### Paths of the script and other files

PROGDIR="/usr/local/ddos"PROG="/usr/local/ddos/ddos.sh"IGNORE_IP_LIST="/usr/local/ddos/ignore.ip.list"CRON="/etc/cron.d/ddos.cron"APF="/etc/apf/apf"IPT="/sbin/iptables"##### frequency inminutesfor running the script

##### Caution: Every time thissettingischanged, run the script with --cron

#####          option so that the new frequency takes effect

FREQ=1##### How many connections define a bad IP? Indicate that below.

NO_OF_CONNECTIONS=150##### APF_BAN=1(Make sure your APF versionisatleast0.96)

##### APF_BAN=0(Uses iptablesfor banning ips instead of APF)

#APF_BAN=1APF_BAN=0##### KILL=0(Bad IPs are'nt banned, good for interactive execution of script)##### KILL=1 (Recommended setting)

KILL=1##### An email issent to the following address when an IPis banned.

##### Blank would suppress sending of mails

EMAIL_TO="xxx@xxx.com"##### Number of seconds the banned ip should remain in blacklist.

BAN_PERIOD=600

# cat ddos.sh

#!/bin/sh

##############################################################################

# DDoS-Deflate version0.6Author: Zaf                         #

##############################################################################

# This program isdistributed under the"Artistic License" Agreement        #

#                                                                            #

# The LICENSE file islocatedinthe same directoryasthis program. Please  #

#  read the LICENSE file before you make copies or distribute this program  #

##############################################################################

load_conf()

{

    CONF="/usr/local/ddos/ddos.conf"if[ -f"$CONF"] && [ !"$CONF"=="" ]; then

        source $CONF

    else        head

        echo "\$CONF not found."        exit 1    fi

}

head()

{

    echo "DDoS-Deflate version 0.6"    echo "Copyright (C) 2005, Zaf <zaf@vsnl.com>"    echo

}

showhelp()

{

    head

    echo 'Usage: ddos.sh [OPTIONS] [N]'    echo 'N : number of tcp/udp    connections (default 150)'    echo 'OPTIONS:'    echo '-h | --help: Show    this help screen'    echo '-c | --cron: Create cron job to run this script regularly (default 1 mins)'    echo '-k | --kill: Block the offending ip making more than N connections'}

unbanip()

{

    UNBAN_SCRIPT=`mktemp /tmp/unban.XXXXXXXX`

    TMP_FILE=`mktemp /tmp/unban.XXXXXXXX`

    UNBAN_IP_LIST=`mktemp /tmp/unban.XXXXXXXX`

    echo '#!/bin/sh'> $UNBAN_SCRIPT

    echo "sleep $BAN_PERIOD">> $UNBAN_SCRIPT

    if[ $APF_BAN -eq1 ]; then

        whileread line;do            echo "$APF -u $line">> $UNBAN_SCRIPT

            echo $line >> $UNBAN_IP_LIST

        done < $BANNED_IP_LIST

    elsewhileread line;do            echo "$IPT -D INPUT -s $line -j DROP">> $UNBAN_SCRIPT

            echo $line >> $UNBAN_IP_LIST

        done < $BANNED_IP_LIST

    fi

    echo "grep -v --file=$UNBAN_IP_LIST $IGNORE_IP_LIST > $TMP_FILE">> $UNBAN_SCRIPT

    echo "mv $TMP_FILE $IGNORE_IP_LIST">> $UNBAN_SCRIPT

    echo "rm -f $UNBAN_SCRIPT">> $UNBAN_SCRIPT

    echo "rm -f $UNBAN_IP_LIST">> $UNBAN_SCRIPT

    echo "rm -f $TMP_FILE">> $UNBAN_SCRIPT

    . $UNBAN_SCRIPT &}

add_to_cron()

{

    rm -f $CRON

    sleep 1    service crond restart

    sleep 1    echo "SHELL=/bin/sh"> $CRON

    if[ $FREQ -le2 ]; then

        echo "0-59/$FREQ * * * * root /usr/local/ddos/ddos.sh >/dev/null 2>&1">> $CRON

    else        let "START_MINUTE = $RANDOM % ($FREQ - 1)"        let "START_MINUTE = $START_MINUTE + 1"        let "END_MINUTE = 60 - $FREQ + $START_MINUTE"        echo "$START_MINUTE-$END_MINUTE/$FREQ * * * * root /usr/local/ddos/ddos.sh >/dev/null 2>&1">> $CRON

    fi

    service crond restart

}

load_confwhile[ $1];docase$1in'-h'|'--help'|'?' )

            showhelp

            exit

            ;;

        '--cron'|'-c' )

            add_to_cron

            exit

            ;;

        '--kill'|'-k' )

            KILL=1            ;;

        *[0-9]* )

            NO_OF_CONNECTIONS=$1            ;;

        * )

            showhelp

            exit

            ;;

    esac

    shift

done

TMP_PREFIX='/tmp/ddos'TMP_FILE="mktemp $TMP_PREFIX.XXXXXXXX"BANNED_IP_MAIL=`$TMP_FILE`

BANNED_IP_LIST=`$TMP_FILE`

echo "Banned the following ip addresses on `date`"> $BANNED_IP_MAIL

echo >>    $BANNED_IP_MAIL

BAD_IP_LIST=`$TMP_FILE`

netstat -ntu | awk'{print $5}'| cut -d: -f1 | sort | uniq -c | sort -nr > $BAD_IP_LIST

cat $BAD_IP_LISTif[ $KILL -eq1 ]; then

    IP_BAN_NOW=0whileread line;do        CURR_LINE_CONN=$(echo $line | cut -d""-f1)

        CURR_LINE_IP=$(echo $line | cut -d""-f2)

        if[ $CURR_LINE_CONN -lt $NO_OF_CONNECTIONS ]; then

            break        fi

        IGNORE_BAN=`grep -c $CURR_LINE_IP $IGNORE_IP_LIST`

        if[ $IGNORE_BAN -ge1 ]; then

            continue        fi

        IP_BAN_NOW=1        echo "$CURR_LINE_IP with $CURR_LINE_CONN connections">> $BANNED_IP_MAIL

        echo $CURR_LINE_IP >> $BANNED_IP_LIST

        echo $CURR_LINE_IP >> $IGNORE_IP_LIST

        if[ $APF_BAN -eq1 ]; then

            $APF -d $CURR_LINE_IP

        else            $IPT -I INPUT -s $CURR_LINE_IP -j DROP

        fi

    done < $BAD_IP_LIST

    if[ $IP_BAN_NOW -eq1 ]; then

        dt=`date`

        if[ $EMAIL_TO !="" ]; then

            cat $BANNED_IP_MAIL | mail -s"IP addresses banned on $dt" $EMAIL_TO

        fi

        unbanip

    fi

fi

rm -f $TMP_PREFIX.*

# cat ignore.ip.list 127.0.0.110.100.0.5#不防御的ip

 注意权限:

# ll /etc/cron.d/ddos.cron -rw-r--r--1root root71Sep1417:13/etc/cron.d/ddos.cron

注意软连接:

# ll /usr/local/sbin/ddos

lrwxrwxrwx 1root root23Sep1315:36/usr/local/sbin/ddos -> /usr/local/ddos/ddos.sh

转载于:https://www.cnblogs.com/bass6/p/7522089.htm

    有服务器需求请加QQ1911624872咨询