网上一段经典的perl代码

Learning
这是我的学习资料库！
« proftpd学习笔记(from张微波) | 回到主页面 | Adv-Routing-HOWTO »
2005年09月26日
封禁解禁ftp客户代码(from newsmth)
发信人: windtear (努力!奋斗!努力！奋斗！), 信区: Linux
标 题: proftpd log 文件实时分析，动态封禁/解封
发信站: BBS 水木清华站 (Thu Mar 27 22:53:10 2003), 转信

by

-- 注意 copy 后 有些应该在 1 行的编辑一下

#!/usr/bin/perl -w
#
# proftpd log 文件实时分析，动态封禁/解封
# 用法：
# tail -f /var/log/proftpd | /usr/bin/proftpdeny.pl
#
# Zhuohuan Li 《》
# Beijing 2003-02-23
#

use Time::HiRes qw(gettimeofday);

# 封禁时间，以秒为单位
$DENY_PERIOD=600;

# 对最近多久的日志进行统计
$EVAL_PERIOD=60;

# 在 EVAL_PERIOD 中的最多连接次数
$DENY_TIMES=5;

# 数组，记录 IP/最后登陆时间/重试次数
%BADLIST = ();
%DENIED_IP = ();

init_iptables();

while (《STDIN》){
chomp $_;
$line = $_;

$badip = get_bad_ip($line) ;

if (! $badip ) {
next;
}

#print STDERR "badip: $badip\n";

# 删除 BADLIST 中的过期 IP
refresh_bad_ip();

# 添加multi login的ip到BADLIST
add_bad_ip( $badip );

# 把平均每秒连接次数 》 $DENY_RETRY_TIMES_PER_SEC 的 IP 封掉
check_bad_ip();

# 将封禁时间 》 $DENY_PERIOD 的ip解封
undeny_bad_ip();
}

exit(0);

##############################
sub get_bad_ip
{
local( $line );
$line = $_[0];
return undef if ( ! $line );

if ( $line =~ /ftp\.zixia\.net \((\d+\.\d+\.\d+\.\d+)\[[^\]]+\]\) -
Connection refused \(max clients per host \d+\)\./ ) {
return $1;
} else {
return undef;
}
}

sub add_bad_ip
{
local ( $badip );
$badip = $_[0];
die "add_bad_ip() take no param err" unless $badip;

($seconds, $microseconds) = gettimeofday;

$BADLIST{$badip}{$seconds . '.' . $microseconds} = 1;

#print STDERR "add_bad_ip: $badip, $seconds\n";
}

sub refresh_bad_ip
{
foreach $ip ( keys %BADLIST ){
foreach $secmic ( keys %{$BADLIST{$ip}} ){
if ( $secmic =~ /^(\d+)\.(\d+)$/ ){
$seconds = $1;

if ( time - $seconds 》 $EVAL_PERIOD ){
delete $BADLIST{$ip}{$secmic} ;
#print STDERR "refresh_bad_ip: delete badlist $ip $secmic\n";
}
}
}
$num = keys %{$BADLIST{$ip}};
if ( 0==$num ) {
delete $BADLIST{$ip};
}
}
}

sub check_bad_ip
{
foreach $ip ( keys %BADLIST ){
$login_num = keys ( %{$BADLIST{$ip}} );

#print STDERR "check_bad_ip: ip $ip has $login_num times login attampts..\n";

if ( $login_num 》 $DENY_TIMES ) {
deny_bad_ip ( $ip ) ;
delete $BADLIST{$ip};
}
}
}

sub deny_bad_ip
{
local $ip;
$ip = $_[0];

die "deny_bad_ip no ip err" unless $ip;

foreach ( keys %DENIED_IP ){
return if ( /^$ip$/ )
}

$cmd = "iptables -A ftpDeny -p tcp -s $ip -j REJECT --reject-with
tcp-reset";
#print STDERR "sys cmd: $cmd\n";
system ( $cmd );
$DENIED_IP{$ip} = time;

$date = `date`;
chomp $date;
system ( "printf \"%s %-16s denied.\n\" \"$date\" $ip 》》/var/log/proft
pd.deny" )
}

sub undeny_bad_ip
{
foreach $ip ( keys %DENIED_IP ){
if ( time - $DENIED_IP{$ip} 》 $DENY_PERIOD ) {
$line_number = `iptables -nL ftpDeny --line-number |
grep $ip | awk {'print \$1'}`;
chomp $line_number;
$cmd = "iptables -D ftpDeny $line_number";

system ( $cmd );
delete $DENIED_IP{$ip};

$date = `date`;
chomp $date;
system ( "printf \"%s %-16s undenied.\n\" \"$date\"
$ip 》》/var/log/proftpd.deny" )

}
}
}

sub init_iptables
{
$cmd1 = "iptables -F ftpDeny 》 /dev/null 2》&1";
$cmd2 = "iptables -X ftpDeny 》 /dev/null 2》&1";
$cmd3 = "iptables -N ftpDeny 》 /dev/null 2》&1";

$cmd4 = "iptables -I INPUT -p tcp --dport 59000:60000 -j ftpDeny";
$cmd5 = "iptables -I INPUT -p tcp --dport 20:21 -j ftpDeny";

$exist = `iptables -nL INPUT | grep ftpDeny | wc -l | awk {'print
\$1'}`;

system( $cmd1 );
system( $cmd2 );
system( $cmd3 );

if ( 0==$exist ) {
system( $cmd4 ) ;
system( $cmd5 ) ;
}
}

--
夹着尾巴做人
行胜于言
自强不息 厚德载物
严谨 勤奋 求实 创新
戒骄戒躁 谦虚谨慎
助人为乐 知足常乐 自得其乐

※ 来源:·BBS 水木清华站 smth.org·[FROM: 166.111.154.100]
发信人: windtear (1-》2-》1 ... 没日没夜 zip -9/bzip2 time), 信区: Linux
标 题: [脚本] Perl/ProFTPD 自动封禁
发信站: BBS 水木清华站 (Wed Sep 4 21:13:50 2002), 站内信件

zixia 写的
自己改着用吧

#!/usr/bin/perl -w
# @Author:
# @Date: 2000-11-?
$MAX_DENY_NETC = 10000;
$MAX_DENY_HOST = 1000;

my( $cnt, $ip ) = 0;
my %refuse = ();
my $dieNum = $ARGV[0];
$dieNum = $MAX_DENY_HOST unless $dieNum;

my @FreeIP = ('166.111.168.8','zixia.net',
'166.111.60.103','gree\'s lab',
'202.120.224.18','复旦大学',
'210.32.156.234','浙江大学',
'166.111.168.8','zixia.net',
'127.0.0.1','localhost',
'211.101.132.21','Nathan',
'210.52.2.5','网通的淄博分公司',
'166.111.136.206','VJ',
'202.119.32.6','南京大学',
'211.69.197.1','华中理工');
while( $line=《STDIN》 ){
chop $line;
#Jul 26 11:58:33 zixia proftpd[5622]: zixia.net (61.141.206.145[61.141.

206.145]) - Connection refused (max clients per host 5
).
if( $line=~m/\[(\d+\.\d+\.\d+\.\d+)\]/ ){
#if( $line=~m/\[(\d+\.\d+\.\d+\.\d+)\] - Connection refused
\(max clients per host/ ){
$ip = $1;
$refuse{"$ip"}++;
}
}
$cnt = 0;
$line1 = 1;
DENY:
foreach $ip ( sort { $refuse{$b} 《=》 $refuse{$a} } keys %refuse ){
last if( $refuse{$ip} 《 $dieNum );
if( 1==$line1 ){
print STDERR `date`;
$line1 = 0;
}
foreach $FreeIP ( keys %FreeIP ){
next DENY if( $FreeIP eq $ip );
}
if( $refuse{$ip} 》 $MAX_DENY_NETC ){
print STDERR "\t$ip\t$refuse{$ip} times, 封 C 类！\n";
print "/sbin/iptables -A ftp -s $ip/24 -j DROP\n";
}else{
print STDERR "\t$ip\t$refuse{$ip} times\n";
print "/sbin/iptables -A ftp -s $ip/32 -j DROP\n";
}
}

--

※ 来源:·BBS 水木清华站 smth.edu.cn·[FROM: 166.111.154.100]

由 kkzhou 发表于 2005年09月26日 16:31

回复