(D)DoS Deflate is a lightweight bash shell script designed to assist in the process of blocking a denial of service attack. It utilizes the command below to create a list of IP addresses connected to the server, along with their total number of connections. It is one of the simplest and easiest to install solutions at the software level.
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
IP addresses with over a pre-configured number of connections are automatically blocked in the server’s firewall, which can be direct iptables or Advanced Policy Firewall (APF). (We highly recommend that you use APF on your server in general, but deflate will work without it.)
Notable Features
- It is possible to whitelist IP addresses, via /usr/local/ddos/ignore.ip.list.
- Simple configuration file: /usr/local/ddos/ddos.conf
- IP addresses are automatically unblocked after a preconfigured time limit (default: 600 seconds)
- The script can run at a chosen frequency via the configuration file (default: 1 minute)
- You can receive email alerts when IP addresses are blocked.
安装DDoS deflate：
wget http://www.inetbase.com/scripts/ddos/install.sh chmod 0700 install.sh ./install.sh
卸载DDoS deflate：
wget http://www.inetbase.com/scripts/ddos/uninstall.ddos chmod 0700 uninstall.ddos ./uninstall.ddos
配置DDoS deflate：
安装成功后会提示Config file is at /usr/local/ddos/ddos.conf,所以你可以在ddos.conf里进行简要配置.
[code]vim /usr/local/ddos/ddos.conf[/code]
[code]##### Paths of the script and other files
PROGDIR="/usr/local/ddos"//文件存放目录
PROG="/usr/local/ddos/ddos.sh" //主要功能脚本
IGNORE_IP_LIST="/usr/local/ddos/ignore.ip.list" //白名单地址列表
CRON="/etc/cron.d/ddos.cron"//crond定时任务脚本
APF="/etc/apf/apf"
IPT="/sbin/iptables"
##### frequency in minutes for running the script
##### Caution: Every time this setting is changed, run the script with –cron
##### option so that the new frequency takes effect
FREQ=1 //间隔多久检查一次，默认1分钟
##### How many connections define a bad IP? Indicate that below.
NO_OF_CONNECTIONS=150 //最大连接数设置，超过这个数字的IP就会被屏蔽，默认即可
##### APF_BAN=1 (Make sure your APF version is atleast 0.96)
##### APF_BAN=0 (Uses iptables for banning ips instead of APF)
APF_BAN=0 //1：使用APF，0：使用iptables，推荐使用iptables
##### KILL=0 (Bad IPs are‘nt banned,good for interactive execution of script)
##### KILL=1 (Recommended setting)
KILL=1 //是否屏蔽IP，默认即可
##### An email is sent to the following address when an IP is banned.
##### Blank would suppress sending of mails
EMAIL_TO=“root” //发送电子邮件报警的邮箱地址，换成自己使用的邮箱即可
##### Number of seconds the banned ip should remain in blacklist.
BAN_PERIOD=600 //屏蔽IP的时间，根据情况调整
[/code]
另外如果总是会收到以下类似的邮件提示的话 Banned the following ip addresses on Tue Aug 5 01:32:01 BST 2008
1120 with 1120 connections
请查看/usr/local/ddos/ddos.sh文件的第117行
netstat -ntu | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -nr > $BAD_IP_LIST
修改为以下代码即可！
