- 论坛徽章:
- 0
|
本帖最后由 ulovko 于 2012-08-28 21:08 编辑
一旦把你的主机挂到网上,那你想免除扫描是不可能的,但有人在窥探你的“私家”空间总是一件让人感觉不怎么好的事。前阵子刚学Python,正好拿来练手。经过一段时间的摸索现已基本完备,于是决定拿出来晒,以集思广益。
目标:
切断扫描的手;统计看是谁最恶最毒。
思路:
扫描auth.log并入库;根据库中的数据情况,按照一定的策略提取出某些恶毒的IP,生成ipfw规则加以封堵。统计……
实现:
1.入库
没什么可说的,每分钟扫一次log文件,如果某记录的时间比库中最后记录的时间还要“新”,则把该记录入库。
尽管没什么可说的,但还是要注意:记录量非常大,在设计时得考虑效率问题。我在操作时为了找出“近来重复访问”的IP,查询时花了20+分钟,更巧的是正好那时有个脑残的人帮我在数据库中增加了1.5W条记录——真TNND晕。后来采取以下措施解决:功能分散,一个脚本别做太多的工作;给数据库减肥,只保留“足够长”时间段内的记录,其他的移进历史表;“近来重复访问”的IP改用新表来记录,入库时就检查这IP是不是“经常造访”,如果是则顺便记录到新的表中。
目前我是用一个脚本实现,功能为:入库;核对“经常造访”IP并记录;根据策略提取IP并加入ipfw规则;脚本运行情况记录到单独的log里面;备份和清除足够久远的记录。
策略定义:[(minute,times,limit),...],如[(2,5,10),(5,10,15),(60,20,20)]分别定义了三个规则“2分钟内有5条记录”、“5分钟内有10条记录”、“20分钟内有20条记录”,只要符合这些规则的IP将被提取出来并进入防火墙禁止访问规则。后面的limit是本类规则总IP数,在2分钟规则中limit=10意思是“两分钟内不管有多少个不同的IP扫描记录,最多只取前10个IP”。为什么这样做大家想想就会明白。
执行ipfw命令用以下的代码:- ...
- import commands
- ...
- t="/sbin/ipfw -q add %d deny ip from %s to 10.0.0.251 22" % (GROUP*1000+NO,IP)
- (t,tmp)=commands.getstatusoutput(t)
复制代码 2.统计
有了原始数据后,想做统计就方便得多了。可以用php+apache动态实现,当然也可以用python生成表态的。我是用python+rrdtool+apache。
rrdtool看似复杂,其实不难。如我要生成下面的表(5分钟时长)
- last max min avg
- 2m * * * *
- 5m * * * *
- 10m * * * *
- 30m * * * *
- 1h * * * *
- 2h * * * *
- 12h * * * *
- 1d * * * *
- 2d * * * *
- 6d * * * *
- 15d * * * *
- 30d * * * *
- 60d * * * *
复制代码 其对应的命令为:- rrdtool create fbsshd.rrd \
- --start 0 \
- --step 300 \
- DS:2m:GAUGE:600:0:U \
- DS:5m:GAUGE:600:0:U \
- DS:10m:GAUGE:600:0:U \
- DS:30m:GAUGE:600:0:U \
- DS:1h:GAUGE:600:0:U \
- DS:2h:GAUGE:600:0:U \
- DS:12h:GAUGE:600:0:U \
- DS:1d:GAUGE:600:0:U \
- DS:2d:GAUGE:600:0:U \
- DS:6d:GAUGE:600:0:U \
- DS:15d:GAUGE:600:0:U \
- DS:30d:GAUGE:600:0:U \
- DS:60d:GAUGE:600:0:U \
- RRA:AVERAGE:0.5:1:600 \
- RRA:AVERAGE:0.5:4:600 \
- RRA:AVERAGE:0.5:24:600 \
- RRA:AVERAGE:0.5:288:730 \
- RRA:MAX:0.5:1:600 \
- RRA:MAX:0.5:4:600 \
- RRA:MAX:0.5:24:600 \
- RRA:MAX:0.5:288:730 \
- RRA:MIN:0.5:1:600 \
- RRA:MIN:0.5:4:600 \
- RRA:MIN:0.5:24:600 \
- RRA:MIN:0.5:288:730 \
- RRA:LAST:0.5:1:600 \
- RRA:LAST:0.5:4:600 \
- RRA:LAST:0.5:24:600 \
- RRA:LAST:0.5:288:730
复制代码 至于上面的各参数具体区别,我也还没有参得透,碰到问题就google吧。
更新数据更加容易,如这一刻13类的记录数分别为(0:0:1:0:0:0:2:0:1:9:11:7:9),则对应的rrdtool命令为:- rrdtool update fbsshd.rrd N:0:0:1:0:0:0:2:0:1:9:11:7:9
复制代码 画图也不太难,在这里就不深入谈论。嘿嘿,我是菜鸟一个,也深入不了。
rrdtool命令与python中的rrdtool的区别不大,下面的py代码与上面的命令对比一下你就能明白:- ...
- import rrdtool
- ...
- sql='N'
- for tmp in range(1,14):
- sql+=':'+str(coun[tmp])
- #sql串类似于N:0:0:1:0:0:0:2:0:1:9:11:7:9
- tmp=rrdtool.update('/usr/local/www/rrdtool/rrd/fbsshd.rrd',sql)
- if tmp:
- print rrdtool.error()
- ...
- t="-t 2 Day of login (%s)" % NOW
- ret = rrdtool.graph( "/usr/local/www/apache22/data/rrd/fbsshd_daily.png", "--start", "-2d",
- "-w 670","-h 200",
- t,
- "--vertical-label=FB sshd login count",
- "DEF:2m=/usr/local/www/rrdtool/rrd/fbsshd.rrd:2m:LAST",
- "DEF:2ma=/usr/local/www/rrdtool/rrd/fbsshd.rrd:2m:MAX",
- "DEF:2mi=/usr/local/www/rrdtool/rrd/fbsshd.rrd:2m:MIN",
- "DEF:2mv=/usr/local/www/rrdtool/rrd/fbsshd.rrd:2m:AVERAGE",
- "DEF:5m=/usr/local/www/rrdtool/rrd/fbsshd.rrd:5m:LAST",
- "DEF:5ma=/usr/local/www/rrdtool/rrd/fbsshd.rrd:5m:MAX",
- "DEF:5mi=/usr/local/www/rrdtool/rrd/fbsshd.rrd:5m:MIN",
- "DEF:5mv=/usr/local/www/rrdtool/rrd/fbsshd.rrd:5m:AVERAGE",
- "DEF:10m=/usr/local/www/rrdtool/rrd/fbsshd.rrd:10m:LAST",
- "DEF:10ma=/usr/local/www/rrdtool/rrd/fbsshd.rrd:10m:MAX",
- "DEF:10mi=/usr/local/www/rrdtool/rrd/fbsshd.rrd:10m:MIN",
- "DEF:10mv=/usr/local/www/rrdtool/rrd/fbsshd.rrd:10m:AVERAGE",
- "DEF:30m=/usr/local/www/rrdtool/rrd/fbsshd.rrd:30m:LAST",
- "DEF:30ma=/usr/local/www/rrdtool/rrd/fbsshd.rrd:30m:MAX",
- "DEF:30mi=/usr/local/www/rrdtool/rrd/fbsshd.rrd:30m:MIN",
- "DEF:30mv=/usr/local/www/rrdtool/rrd/fbsshd.rrd:30m:AVERAGE",
- "DEF:1h=/usr/local/www/rrdtool/rrd/fbsshd.rrd:1h:LAST",
- "DEF:1ha=/usr/local/www/rrdtool/rrd/fbsshd.rrd:1h:MAX",
- "DEF:1hi=/usr/local/www/rrdtool/rrd/fbsshd.rrd:1h:MIN",
- "DEF:1hv=/usr/local/www/rrdtool/rrd/fbsshd.rrd:1h:AVERAGE",
- "DEF:2h=/usr/local/www/rrdtool/rrd/fbsshd.rrd:2h:LAST",
- "DEF:2ha=/usr/local/www/rrdtool/rrd/fbsshd.rrd:2h:MAX",
- "DEF:2hi=/usr/local/www/rrdtool/rrd/fbsshd.rrd:2h:MIN",
- "DEF:2hv=/usr/local/www/rrdtool/rrd/fbsshd.rrd:2h:AVERAGE",
- "DEF:12h=/usr/local/www/rrdtool/rrd/fbsshd.rrd:12h:LAST",
- "DEF:12ha=/usr/local/www/rrdtool/rrd/fbsshd.rrd:12h:MAX",
- "DEF:12hi=/usr/local/www/rrdtool/rrd/fbsshd.rrd:12h:MIN",
- "DEF:12hv=/usr/local/www/rrdtool/rrd/fbsshd.rrd:12h:AVERAGE",
- "DEF:1d=/usr/local/www/rrdtool/rrd/fbsshd.rrd:1d:LAST",
- "DEF:1da=/usr/local/www/rrdtool/rrd/fbsshd.rrd:1d:MAX",
- "DEF:1di=/usr/local/www/rrdtool/rrd/fbsshd.rrd:1d:MIN",
- "DEF:1dv=/usr/local/www/rrdtool/rrd/fbsshd.rrd:1d:AVERAGE",
- "DEF:2d=/usr/local/www/rrdtool/rrd/fbsshd.rrd:2d:LAST",
- "DEF:2da=/usr/local/www/rrdtool/rrd/fbsshd.rrd:2d:MAX",
- "DEF:2di=/usr/local/www/rrdtool/rrd/fbsshd.rrd:2d:MIN",
- "DEF:2dv=/usr/local/www/rrdtool/rrd/fbsshd.rrd:2d:AVERAGE",
- "DEF:6d=/usr/local/www/rrdtool/rrd/fbsshd.rrd:6d:LAST",
- "DEF:6da=/usr/local/www/rrdtool/rrd/fbsshd.rrd:6d:MAX",
- "DEF:6di=/usr/local/www/rrdtool/rrd/fbsshd.rrd:6d:MIN",
- "DEF:6dv=/usr/local/www/rrdtool/rrd/fbsshd.rrd:6d:AVERAGE",
- "DEF:15d=/usr/local/www/rrdtool/rrd/fbsshd.rrd:15d:LAST",
- "DEF:15da=/usr/local/www/rrdtool/rrd/fbsshd.rrd:15d:MAX",
- "DEF:15di=/usr/local/www/rrdtool/rrd/fbsshd.rrd:15d:MIN",
- "DEF:15dv=/usr/local/www/rrdtool/rrd/fbsshd.rrd:15d:AVERAGE",
- "DEF:30d=/usr/local/www/rrdtool/rrd/fbsshd.rrd:30d:LAST",
- "DEF:30da=/usr/local/www/rrdtool/rrd/fbsshd.rrd:30d:MAX",
- "DEF:30di=/usr/local/www/rrdtool/rrd/fbsshd.rrd:30d:MIN",
- "DEF:30dv=/usr/local/www/rrdtool/rrd/fbsshd.rrd:30d:AVERAGE",
- "DEF:60d=/usr/local/www/rrdtool/rrd/fbsshd.rrd:60d:LAST",
- "DEF:60da=/usr/local/www/rrdtool/rrd/fbsshd.rrd:60d:MAX",
- "DEF:60di=/usr/local/www/rrdtool/rrd/fbsshd.rrd:60d:MIN",
- "DEF:60dv=/usr/local/www/rrdtool/rrd/fbsshd.rrd:60d:AVERAGE",
- "AREA:2m#FF0000:#1 ",
- "STACK:5m#FF00FF:#2 ",
- "STACK:10m#FF897C:#3 ",
- "STACK:30m#00FF00:#4 ",
- "STACK:1h#F5F800:#5 ",
- "STACK:2h#00BED9:#6 ",
- "STACK:12h#00234B:#7 ",
- "STACK:1d#8D85F3:#8 ",
- "STACK:2d#AFECED:#9 ",
- "STACK:6d#8F9286:#10 ",
- "STACK:15d#AAABA1:#11 ",
- "STACK:30d#CDCFC4:#12 ",
- "STACK:60d#D2D8F9:#13 ",
- "COMMENT:\\r",
- "COMMENT:\\n",
- "COMMENT:\\n",
- "COMMENT: 2m",
- "COMMENT: 5m",
- "COMMENT: 10m",
- "COMMENT: 30m",
- "COMMENT: 1h",
- "COMMENT: 2h",
- "COMMENT: 12h",
- "COMMENT: 1d",
- "COMMENT: 2d",
- "COMMENT: 6d",
- "COMMENT: 15d",
- "COMMENT: 30d",
- "COMMENT: 60d",
- "COMMENT:\\n",
- "GPRINT:2m:LAST:Last\:%5.0lf",
- "GPRINT:5m:LAST:%5.0lf",
- "GPRINT:10m:LAST:%5.0lf",
- "GPRINT:30m:LAST:%5.0lf",
- "GPRINT:1h:LAST:%5.0lf",
- "GPRINT:2h:LAST:%5.0lf",
- "GPRINT:12h:LAST:%5.0lf",
- "GPRINT:1d:LAST:%5.0lf",
- "GPRINT:2d:LAST:%5.0lf",
- "GPRINT:6d:LAST:%5.0lf",
- "GPRINT:15d:LAST:%6.0lf",
- "GPRINT:30d:LAST:%6.0lf",
- "GPRINT:60d:LAST:%6.0lf",
- "COMMENT:\\n",
- "GPRINT:2ma:MAX: Max\:%5.0lf",
- "GPRINT:5ma:MAX:%5.0lf",
- "GPRINT:10ma:MAX:%5.0lf",
- "GPRINT:30ma:MAX:%5.0lf",
- "GPRINT:1ha:MAX:%5.0lf",
- "GPRINT:2ha:MAX:%5.0lf",
- "GPRINT:12ha:MAX:%5.0lf",
- "GPRINT:1da:MAX:%5.0lf",
- "GPRINT:2da:MAX:%5.0lf",
- "GPRINT:6da:MAX:%5.0lf",
- "GPRINT:15da:MAX:%6.0lf",
- "GPRINT:30da:MAX:%6.0lf",
- "GPRINT:60da:MAX:%6.0lf",
- "COMMENT:\\n",
- "GPRINT:2mi:MIN: Min\:%5.0lf",
- "GPRINT:5mi:MIN:%5.0lf",
- "GPRINT:10mi:MIN:%5.0lf",
- "GPRINT:30mi:MIN:%5.0lf",
- "GPRINT:1hi:MIN:%5.0lf",
- "GPRINT:2hi:MIN:%5.0lf",
- "GPRINT:12hi:MIN:%5.0lf",
- "GPRINT:1di:MIN:%5.0lf",
- "GPRINT:2di:MIN:%5.0lf",
- "GPRINT:6di:MIN:%5.0lf",
- "GPRINT:15di:MIN:%6.0lf",
- "GPRINT:30di:MIN:%6.0lf",
- "GPRINT:60di:MIN:%6.0lf",
- "COMMENT:\\n",
- "GPRINT:2mv:AVERAGE: Avg\:%5.1lf",
- "GPRINT:5mv:AVERAGE:%5.1lf",
- "GPRINT:10mv:AVERAGE:%5.1lf",
- "GPRINT:30mv:AVERAGE:%5.1lf",
- "GPRINT:1hv:AVERAGE:%5.1lf",
- "GPRINT:2hv:AVERAGE:%5.1lf",
- "GPRINT:12hv:AVERAGE:%5.1lf",
- "GPRINT:1dv:AVERAGE:%5.1lf",
- "GPRINT:2dv:AVERAGE:%5.1lf",
- "GPRINT:6dv:AVERAGE:%5.1lf",
- "GPRINT:15dv:AVERAGE:%6.1lf",
- "GPRINT:30dv:AVERAGE:%6.1lf",
- "GPRINT:60dv:AVERAGE:%6.1lf",
- "COMMENT:\\n")
- if ret:
- print rrdtool.error()
复制代码 这是画图的效果:
夜深了,睡觉去了。欢迎坛友先辈们拍砖。 |
评分
-
查看全部评分
|