#!/bin/sh

#防刷脚本

#env

    ACCESS_PATH=/home/wwwlogs

    ACCESS_LOG=y.log

    IPTABLES_TOP_LOG=iptables_top.log

    DROP_LOG=droplist.log

    HISTORY_LOG=history.log

#ip白名单

    noip=`cat noip.list`

#防刷阈值

    limitnum=500

#统计请求日志

    while true

        do

        awk '{print$1}' ${ACCESS_PATH}/${ACCESS_LOG} \

        | egrep -vi  "${noip}" \

        | sort \

        | uniq -c \

        | sort -rn \

        | head -20 \

        >${ACCESS_PATH}/${IPTABLES_TOP_LOG}

#判断是否达到阈值

    exec<${ACCESS_PATH}/${IPTABLES_TOP_LOG}

    while read line

        do

        count=$(echo $line | awk '{print$1}')

        ip=$(echo $line |awk '{print$2}')

        [ "$count" -gt "$limitnum" ] && {

        iptables -I INPUT -s $ip -j DROP;

        echo -e " $line is dropped\c">>${ACCESS_PATH}/${DROP_LOG}

        }

        done

 #发送告警

    sendnum=`cat ${ACCESS_PATH}/${DROP_LOG}|wc -L`

    [ "$sendnum" -gt "0" ] && {

    content="报警:$(hostname) $(date +%X) $(cat ${ACCESS_PATH}/${DROP_LOG}) \

    以上IP访问次数频繁,单IP 1分钟超过阈值${limitnum}请注意查看"

    python /server/scripts/iptables/sms.py 15900009999 "${content}"

    cat ${ACCESS_PATH}/droplist.log >>${ACCESS_PATH}/${HISTORY_LOG}

    >${ACCESS_PATH}/${DROP_LOG}|

    }

#清除1分钟内数据，准备下一次新数据

    >${ACCESS_PATH}/${IPTABLES_TOP_LOG}

    sleep 60

    done

#!/bin/sh

#防刷脚本

#env

    ACCESS_PATH=/home/wwwlogs

    ACCESS_LOG=y.log

    IPTABLES_TOP_LOG=iptables_top.log

    DROP_LOG=droplist.log

#防刷阈值

    limitnum=500

#统计请求日志

    while true

        do

        awk '{print$1}' ${ACCESS_PATH}/${ACCESS_LOG} \

        | sort \

        | uniq -c \

        | sort -rn \

        | head -20 \

        >${ACCESS_PATH}/${IPTABLES_TOP_LOG}

#判断是否达到阈值

    exec<${ACCESS_PATH}/${IPTABLES_TOP_LOG}

    while read line

        do

        count=$(echo $line | awk '{print$1}')

        ip=$(echo $line |awk '{print$2}')

        [ "$count" -gt "$limitnum" ] && {

        iptables -I INPUT -s $ip -j DROP;

        echo -e " $line is dropped\c">>${ACCESS_PATH}/${DROP_LOG}

        }

        done

#清除1分钟内数据，准备下一次新数据

    >${ACCESS_PATH}/${IPTABLES_TOP_LOG}

    sleep 60

    done