linux防ddos攻击工具 DoS Deflate

#安装 wget http://www.inetbase.com/scripts/ddos/install.sh chmod 0700 install.sh ./install.sh #卸载 wget http://www.inetbase.com/scripts/ddos/uninstall.ddos chmod 0700 uninstall.ddos ./uninstall.ddos #查看一下install.sh文件 [root@localhost src]#less install.sh #!/bin/sh if [ -d '/usr/local/ddos' ]; then echo; echo; echo "Please un-install the previous version first" exit 0 else mkdir /usr/local/ddos fi clear echo; echo 'Installing DOS-Deflate 0.6'; echo echo; echo -n 'Downloading source files...' wget -q -O /usr/local/ddos/ddos.conf http://www.inetbase.com/scripts/ddos/ddos.conf echo -n '.' wget -q -O /usr/local/ddos/LICENSE http://www.inetbase.com/scripts/ddos/LICENSE echo -n '.' wget -q -O /usr/local/ddos/ignore.ip.list http://www.inetbase.com/scripts/ddos/ignore.ip.list echo -n '.' wget -q -O /usr/local/ddos/ddos.sh http://www.inetbase.com/scripts/ddos/ddos.sh chmod 0755 /usr/local/ddos/ddos.sh cp -s /usr/local/ddos/ddos.sh /usr/local/sbin/ddos echo '...done' echo; echo -n 'Creating cron to run script every minute.....(Default setting)' /usr/local/ddos/ddos.sh --cron > /dev/null 2>&1 echo '.....done' echo; echo 'Installation has completed.' echo 'Config file is at /usr/local/ddos/ddos.conf' echo 'Please send in your comments and/or suggestions to ' echo cat /usr/local/ddos/LICENSE | less 

从install.sh可以看出DoS Deflate安装过程主要是下载四个文件

和执行/usr/local/ddos/ddos.sh –cron 这个脚本。

[root@localhost src]# cat /usr/local/ddos/ddos.sh #!/bin/sh # DDoS-Deflate version 0.6 Author: Zaf 
  
    # # This program is distributed under the "Artistic License" Agreement # # # # The LICENSE file is located in the same directory as this program. Please # # read the LICENSE file before you make copies or distribute this program # load_conf() { CONF="/usr/local/ddos/ddos.conf" if [ -f "$CONF" ] && [ ! "$CONF" == "" ]; then source $CONF else head echo "\$CONF not found." exit 1 fi } 加载配置文件/usr/local/ddos/ddos.conf head() { echo "DDoS-Deflate version 0.6" echo "Copyright (C) 2005, Zaf 
   
     " echo } 显示版本,作者信息 showhelp() { head echo 'Usage: ddos.sh [OPTIONS] [N]' echo 'N : number of tcp/udp connections (default 150)' echo 'OPTIONS:' echo '-h | --help: Show this help screen' echo '-c | --cron: Create cron job to run this script regularly (default 1 mins)' echo '-k | --kill: Block the offending ip making more than N connections' } 显示使用方式 unbanip() { UNBAN_SCRIPT=`mktemp /tmp/unban.XXXXXXXX` TMP_FILE=`mktemp /tmp/unban.XXXXXXXX` UNBAN_IP_LIST=`mktemp /tmp/unban.XXXXXXXX` echo '#!/bin/sh' > $UNBAN_SCRIPT echo "sleep $BAN_PERIOD" >> $UNBAN_SCRIPT if [ $APF_BAN -eq 1 ]; then while read line; do echo "$APF -u $line" >> $UNBAN_SCRIPT echo $line >> $UNBAN_IP_LIST done < $BANNED_IP_LIST else while read line; do echo "$IPT -D INPUT -s $line -j DROP" >> $UNBAN_SCRIPT echo $line >> $UNBAN_IP_LIST done < $BANNED_IP_LIST fi echo "grep -v --file=$UNBAN_IP_LIST $IGNORE_IP_LIST > $TMP_FILE" >> $UNBAN_SCRIPT echo "mv $TMP_FILE $IGNORE_IP_LIST" >> $UNBAN_SCRIPT echo "rm -f $UNBAN_SCRIPT" >> $UNBAN_SCRIPT echo "rm -f $UNBAN_IP_LIST" >> $UNBAN_SCRIPT echo "rm -f $TMP_FILE" >> $UNBAN_SCRIPT . $UNBAN_SCRIPT & } 用于取消已经被禁止访问的ip add_to_cron() { rm -f $CRON sleep 1 service crond restart sleep 1 echo "SHELL=/bin/sh" > $CRON if [ $FREQ -le 2 ]; then echo "0-59/$FREQ * * * * root /usr/local/ddos/ddos.sh >/dev/null 2>&1" >> $CRON else let "START_MINUTE = $RANDOM % ($FREQ - 1)" let "START_MINUTE = $START_MINUTE + 1" let "END_MINUTE = 60 - $FREQ + $START_MINUTE" echo "$START_MINUTE-$END_MINUTE/$FREQ * * * * root /usr/local/ddos/ddos.sh >/dev/null 2>&1" >> $CRON fi service crond restart } 执行主程序，生成crontab,在安装的时候执行一次 load_conf while [ $1 ]; do case $1 in '-h' | '--help' | '?' ) showhelp exit ;; '--cron' | '-c' ) add_to_cron exit ;; '--kill' | '-k' ) KILL=1 ;; *[0-9]* ) NO_OF_CONNECTIONS=$1 ;; * ) showhelp exit ;; esac shift done TMP_PREFIX='/tmp/ddos' TMP_FILE="mktemp $TMP_PREFIX.XXXXXXXX" BANNED_IP_MAIL=`$TMP_FILE` BANNED_IP_LIST=`$TMP_FILE` echo "Banned the following ip addresses on `date`" > $BANNED_IP_MAIL echo >> $BANNED_IP_MAIL BAD_IP_LIST=`$TMP_FILE` netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr > $BAD_IP_LIST cat $BAD_IP_LIST if [ $KILL -eq 1 ]; then IP_BAN_NOW=0 while read line; do CURR_LINE_CONN=$(echo $line | cut -d" " -f1) CURR_LINE_IP=$(echo $line | cut -d" " -f2) if [ $CURR_LINE_CONN -lt $NO_OF_CONNECTIONS ]; then break fi IGNORE_BAN=`grep -c $CURR_LINE_IP $IGNORE_IP_LIST` if [ $IGNORE_BAN -ge 1 ]; then continue fi IP_BAN_NOW=1 echo "$CURR_LINE_IP with $CURR_LINE_CONN connections" >> $BANNED_IP_MAIL echo $CURR_LINE_IP >> $BANNED_IP_LIST echo $CURR_LINE_IP >> $IGNORE_IP_LIST if [ $APF_BAN -eq 1 ]; then $APF -d $CURR_LINE_IP else $IPT -I INPUT -s $CURR_LINE_IP -j DROP fi done < $BAD_IP_LIST if [ $IP_BAN_NOW -eq 1 ]; then dt=`date` if [ $EMAIL_TO != "" ]; then cat $BANNED_IP_MAIL | mail -s "IP addresses banned on $dt" $EMAIL_TO fi unbanip fi fi rm -f $TMP_PREFIX.* 
    
  

整个脚本判断的根据通过单个ip连接数，然后根据/usr/local/ddos/ddos.conf里面定义的NO_OF_CONNECTIONS的值判断有没有达到drop条件，如果达到再根据里面定义（APF_BAN默认是APF，如需要iptables需要改）使用：iptables或者APF来drop掉这个ip地址，让它在规定的时间内（由BAN_PERIOD定义）无法访问该服务器。可以看出整个脚本如果使用iptables过滤的话是很简单的，完全自己可以写一个脚本来实现上面功能。

#!/bin/bash NO_OF_CONNECTIONS=100 BLACKLIST=/var/tmp/black WHITELIST=/var/tmp/white #cat ${ACCCESS_LOG} | awk '{print $1}' | sort | uniq -c | sort -r -n | head -n 200 >> my_check if [ ! -f ${BLACKLIST} ]; then touch ${BLACKLIST} fi if [ ! -f ${WHITELIST} ]; then touch ${WHITELIST} fi while read Num Ipaddr ;do if [ $(grep -c $Ipaddr ${WHITELIST}) -ne 0 ]; then echo 'Allow IP:' $Ipaddr continue fi if [ $(grep -c $Ipaddr ${BLACKLIST}) -eq 0 ] ; then if [ $Num -gt $NO_OF_CONNECTIONS ];then echo 'Deny IP:' $Ipaddr echo $Ipaddr >> ${BLACKLIST} iptables -I INPUT -p tcp --dport 80 -s $Ipaddr -j DROP fi fi done <<-'EOF' `netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr` EOF 

只是上面的脚本少了解封被禁止的ip过程，我个人认为解封没有太大意义.无论是DoS Deflate或者是上面我自己写的脚本，最重要的都是NO_OF_CONNECTIONS值设置。