受攻击！！！

flying-dance bi

原帖由 "黑鹰" 发表：
   

攻击者是多IP的。

tcp        0      0 61.175.152.144:80        80.8.54.218:1375        SYN_RECV   
tcp        0      0 61.175.152.144:80        61.150.61.89:5062       SYN_RECV   
tcp   ..........

   


写个脚本吧
通过netstat查看每个ip连接80端口的连接数，假如每个ip超过三次或五次连接就认为是非法ip，用iptables把它cut掉～我想也只能这样了～sigh

黑鹰

原帖由 "flying-dance big big pig" 发表：
   


写个脚本吧
通过netstat查看每个ip连接80端口的连接数，假如每个ip超过三次或五次连接就认为是非法ip，用iptables把它cut掉～我想也只能这样了～sigh

请教，前辈，怎么写…… ：（~~~~~

flying-dance bi

原帖由 "黑鹰" 发表：


请教，前辈，怎么写…… ：（~~~~~

  


FT～～～～～～～～
我手头上没有现成的～

黑鹰

小弟做了一个重简单的iptables，不知道有没有用：

vi firewall

#!/bin/sh
echo "Starting Iptables Rules... >;_<.. "
#Refresh all
/sbin/iptables -N synfoold
/sbin/iptables -A synfoold -p tcp --syn -m limit --limit 1/s -j RETURN
/sbin/iptables -A synfoold -p tcp -j REJECT --reject-with tcp-reset
/sbin/iptables -A INPUT -p tcp -m state --state NEW -j synfoold

这样就可以了吗？可以防多少攻击啊？谢谢…

anlover

你的网站关闭了吗？

http://61.175.152.144

黑鹰

关了……………

衍水狂客

谢谢指教！！！

haohaoo

原帖由 "flying-dance big big pig" 发表：
   


mod_limitipconn.c
效果不是很好的
试试这个吧～ :wink:
Apache DoS Evasive Maneuvers Module

http://www.networkdweebs.com/stuff/mod_dosevasive.tar.gz
Apache DoS Evasive Maneuvers Modu..........

   

我怎么安装不成功呢？
我的是apache2

# /usr/local/apache/bin/apxs -i -c mod_dosevasive.c
/usr/local/apache/build/libtool --silent --mode=compile gcc -prefer-pic  -DAP_HAVE_DESIGNATED_INITIALIZER -DLINUX=2 -D_REENTRANT -D_XOPEN_SOURCE=500 -D_BSD_SOURCE -D_SVID_SOURCE -D_GNU_SOURCE -g -O2 -pthread -I/usr/local/apache/include  -c -o mod_dosevasive.lo mod_dosevasive.c && touch mod_dosevasive.slo
mod_dosevasive.c:47: parse error before `dosevasive_module'
mod_dosevasive.c:47: warning: data definition has no type or storage class
mod_dosevasive.c:116: parse error before `pool'
mod_dosevasive.c: In function `check_access':
mod_dosevasive.c:130: request for member `sin_addr' in something not a structure or union
mod_dosevasive.c:142: `FORBIDDEN' undeclared (first use in this function)
mod_dosevasive.c:142: (Each undeclared identifier is reported only once
mod_dosevasive.c:142: for each function it appears in.)
mod_dosevasive.c:197: request for member `sin_addr' in something not a structure or union
mod_dosevasive.c:239: warning: passing arg 4 of `ap_log_rerror' makes integer from pointer without a cast
mod_dosevasive.c:239: warning: passing arg 5 of `ap_log_rerror' from incompatible pointer type
mod_dosevasive.c: At top level:
mod_dosevasive.c:245: parse error before `pool'
mod_dosevasive.c:588: warning: initialization from incompatible pointer type
mod_dosevasive.c:591: warning: initialization from incompatible pointer type
mod_dosevasive.c:594: warning: initialization from incompatible pointer type
mod_dosevasive.c:597: warning: initialization from incompatible pointer type
mod_dosevasive.c:600: warning: initialization from incompatible pointer type
mod_dosevasive.c:603: warning: initialization from incompatible pointer type
mod_dosevasive.c:606: warning: initialization from incompatible pointer type
mod_dosevasive.c:609: warning: initialization from incompatible pointer type
mod_dosevasive.c:615: parse error before `dosevasive_module'
mod_dosevasive.c:617: `this_module_needs_to_be_ported_to_apache_2_0' undeclared here (not in a function)
mod_dosevasive.c:617: initializer element is not constant
mod_dosevasive.c:617: (near initialization for `dosevasive_module')
mod_dosevasive.c:618: warning: excess elements in scalar initializer
mod_dosevasive.c:618: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:619: warning: excess elements in scalar initializer
mod_dosevasive.c:619: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:620: warning: excess elements in scalar initializer
mod_dosevasive.c:620: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:621: warning: excess elements in scalar initializer
mod_dosevasive.c:621: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:622: warning: excess elements in scalar initializer
mod_dosevasive.c:622: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:623: warning: excess elements in scalar initializer
mod_dosevasive.c:623: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:624: warning: excess elements in scalar initializer
mod_dosevasive.c:624: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:625: warning: excess elements in scalar initializer
mod_dosevasive.c:625: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:626: warning: excess elements in scalar initializer
mod_dosevasive.c:626: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:627: warning: excess elements in scalar initializer
mod_dosevasive.c:627: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:628: warning: excess elements in scalar initializer
mod_dosevasive.c:628: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:629: warning: excess elements in scalar initializer
mod_dosevasive.c:629: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:630: warning: excess elements in scalar initializer
mod_dosevasive.c:630: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:631: warning: excess elements in scalar initializer
mod_dosevasive.c:631: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:632: warning: excess elements in scalar initializer
mod_dosevasive.c:632: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:633: warning: excess elements in scalar initializer
mod_dosevasive.c:633: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:634: warning: excess elements in scalar initializer
mod_dosevasive.c:634: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:636: warning: excess elements in scalar initializer
mod_dosevasive.c:636: warning: (near initialization for `dosevasive_module')
mod_dosevasive.c:636: warning: data definition has no type or storage class
apxs:Error: Command failed with rc=65536