linux中防ddos攻击软件下载|linux中防DDOS攻击软件DDoS-Deflate详解

【www.bbyears.com--linux】

DDoS-Deflate安装及配置

1、安装

 代码如下 wget http://www.inetbase.com/scripts/ddos/install.sh
chmod 0700 install.sh
./install.sh

2、配置

配置文件是 /usr/local/ddos/ddos.conf ，默认有如下配置

 代码如下 FREQ=1
NO_OF_CONNECTIONS=150
APF_BAN=0
KILL=1
EMAIL_TO="test@qq.com"
BAN_PERIOD=600

配置参数的解释：

FREQ=1 ；检测时间间隔，默认是一分钟，如果修改这个要重新设置Cron Job
NO_OF_CONNECTIONS=150 ；最大连接数，超过这个就会禁止IP
APF_BAN=1 ；使用APF设置为1，使用iptables设置为0
KILL=1 ；是否禁止IP
EMAIL_TO=”root” ；邮件通知，写上接收邮件的邮箱
BAN_PERIOD=600 ；禁止IP时长，默认是600秒

IP地址白名单：/usr/local/ddos/ignore.ip.list
卸载

 代码如下 wget http://www.inetbase.com/scripts/ddos/uninstall.ddos
chmod 0700 uninstall.ddos
./uninstall.ddos

查看IP

 代码如下

netstat -ntu | awk "{print $5}" | cut -d: -f1 | sort | uniq -c | sort -n

来做测试,看能否封掉IP.

 代码如下 iptables -L -n

如下图,192.168.1.200就被封掉了:

补充：防范DDOS攻击脚本

 代码如下

#防止SYN攻击 轻量级预防
iptables -N syn-flood
iptables -A INPUT -p tcp --syn -j syn-flood
iptables -I syn-flood -p tcp -m limit --limit 3/s --limit-burst 6 -j RETURN
iptables -A syn-flood -j REJECT
#防止DOS太多连接进来,可以允许外网网卡每个IP最多15个初始连接,超过的丢弃
iptables -A INPUT -i eth0 -p tcp --syn -m connlimit --connlimit-above 15 -j DROP
iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

#用Iptables抵御DDOS (参数与上相同)
iptables -A INPUT  -p tcp --syn -m limit --limit 12/s --limit-burst 24 -j ACCEPT
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
##########################################################

iptables防DDOS攻击脚本

 代码如下

#!/bin/sh
## define some vars
MAX_TOTAL_SYN_RECV="1000"
MAX_PER_IP_SYN_RECV="20"
MARK="SYN_RECV"
PORT="80"

LOGFILE="/var/log/netstat_$MARK-$PORT"
LOGFILE_IP="/var/log/netstat_connect_ip.log"
DROP_IP_LOG="/var/log/netstat_syn_drop_ip.log"
## iptables default rules: accept normailly packages and drop baleful SYN* packages
iptables -F -t filter
iptables -A INPUT -p TCP ! --syn -m state --state NEW -j DROP
iptables -A INPUT -p ALL -m state --state INVALID -j DROP
iptables -A INPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
## initialize
if [ -z $MARK ];then
MARK="LISTEN"
fi
if [ -z $PORT ];then
SPORT="tcp"
else
SPORT=":$PORT"
fi
######################## end
## save the results of command netstat to specifal file
netstat -atun|grep $MARK|grep $SPORT 2>/dev/null >$LOGFILE

REPEAT_CONNECT_IP=`less $LOGFILE|awk "{print $5}"|cut -f1 -d ":"|sort|uniq -d |tee > $LOGFILE_IP`

if [ -f $DROP_IP_LOG ];then
for i in `less $DROP_IP_LOG`;do
iptables -A INPUT -p ALL -s $i -j DROP
done
fi

for i in `less $LOGFILE_IP`;do
REPEAT_CONNECT_NUM=`grep $i $LOGFILE|wc -l`
## count repeat connections ,if the accout is large than default number,then drop packages
if [ $REPEAT_CONNECT_NUM -gt $MAX_PER_IP_SYN_RECV ];then
echo "$i####$REPEAT_CONNECT_NUM" >> $DROP_IP_LOG
iptables -A INPUT -p ALL -s $i -j DROP
fi
done

ALL_CONNECT=`uniq -u $LOGFILE|wc -l`
#echo $ALL_CONNECT
## count repeat connections ,if the accout is large than default number,then drop packages
if [ $ALL_CONNECT -gt $MAX_TOTAL_SYN_RECV ];then
#echo $ALL_CONNECT
exit
fi

本文来源：http://www.bbyears.com/caozuoxitong/54456.html