shell 结合iptables防止小型CC攻击

#!/bin/sh

cd /usr/local/apache/logs

cat access_log|awk '{print $1}'|sort|uniq -c|sort -n -r|head -n 20 > a

cp /dev/null access_log

cp /dev/null error_log

cp /dev/null limit.sh

cp /dev/null c

#awk '{print $2}' a|awk -F. '{print $1"."$2"."$3}'|sort|uniq > b

cat a|while read num ip

do

if [ "$num" -gt "100" ]

then

echo $ip >> c 

fi

done 

cat c|awk -F. '{print $1"."$2"."$3"."$4}'|sort|uniq > b

#cat c|sort|uniq > b

for i in `cat b`

#cat b|sed 's/\./ /g'|while read i1 i2 i3 i4

if `cat ourip |grep $i > /dev/null 2>&1`

echo "`date` $i" >> test

else

echo "iptables -I INPUT -p tcp --dport 80 -s $i -j DROP" >> limit.sh

done

sh limit.sh 

本文转自 liang3391 51CTO博客，原文链接:http://blog.51cto.com/liang3391/456624