{"id":287,"date":"2017-07-03T10:24:57","date_gmt":"2017-07-03T02:24:57","guid":{"rendered":"http:\/\/www.cxybj.com\/?p=287"},"modified":"2020-10-24T21:12:54","modified_gmt":"2020-10-24T13:12:54","slug":"centos%e4%b8%8b%e9%98%b2%e6%ad%a2syn%e6%94%bb%e5%87%bb%ef%bc%8c%e7%ab%af%e5%8f%a3%e6%89%ab%e6%8f%8f%e5%92%8c%e6%ad%bb%e4%ba%a1%e4%b9%8bping","status":"publish","type":"post","link":"https:\/\/www.cxybj.com\/?p=287","title":{"rendered":"CentOS\u4e0b\u9632\u6b62syn\u653b\u51fb\uff0c\u7aef\u53e3\u626b\u63cf\u548c\u6b7b\u4ea1\u4e4bping shell\u811a\u672c"},"content":{"rendered":"
\u9632\u6b62syn\u653b\u51fb\uff08DDOOS\u653b\u51fb\u7684\u4e00\u79cd\uff09<\/div>\n
iptables -I INPUT -p tcp –syn -m limit –limit 1\/s -j ACCEPT<\/div>\n
iptables -I FORWARD -p tcp –syn -m limit –limit 1\/s -j ACCEPT<\/div>\n
\u9632\u6b62\u5404\u79cd\u7aef\u53e3\u626b\u63cf
iptables -A FORWARD -p tcp –tcp-flags SYN,ACK,FIN,RST RST -m limit –limit 1\/s -j ACCEPT
Ping\u6d2a\u6c34\u653b\u51fb\uff08Ping of Death\uff09
iptables -A FORWARD -p icmp –icmp-type echo-request -m limit –limit 1\/s -j ACCEPT<\/div>\n
\u00a0<\/div>\n
\u590d\u5236\u4ee3\u7801\u4e00\u6b21\u6027\u6267\u884ciptables\u8bbe\u7f6e\u811a\u672ciptables.sh\uff0c\u6267\u884c\u6b64\u811a\u672c:<\/strong><\/div>\n
CXYBJ=”\/sbin\/iptables”
$CXYBJ –delete-chain
$CXYBJ –flush
#Default Policy
$CXYBJ -P INPUT DROP
$CXYBJ -P FORWARD DROP 
$CXYBJ -P OUTPUT DROP
#INPUT Chain
$CXYBJ -A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT
$CXYBJ -A INPUT -p tcp -m tcp –dport 80 -j ACCEPT
$CXYBJ -A INPUT -p tcp -m tcp –dport 22 -j ACCEPT
$CXYBJ -A INPUT -i lo -j ACCEPT
$CXYBJ -A INPUT -p icmp -m icmp –icmp-type 8 -j ACCEPT
$CXYBJ -A INPUT -p icmp -m icmp –icmp-type 11 -j ACCEPT
$CXYBJ -A INPUT -p tcp –syn -m recent –name portscan –rcheck –seconds 60 –hitcount 10 -j LOG
$CXYBJ -A INPUT -p tcp –syn -m recent –name portscan –set -j DROP
#OUTPUT Chain
$CXYBJ -A OUTPUT -m state –state RELATED,ESTABLISHED -j ACCEPT
$CXYBJ -A OUTPUT -p udp -m udp –dport 53 -j ACCEPT
$CXYBJ -A OUTPUT -o lo -j ACCEPT
$CXYBJ -A OUTPUT -p icmp -m icmp –icmp-type 8 -j ACCEPT
$CXYBJ -A OUTPUT -p icmp -m icmp –icmp-type 11 -j ACCEPT
#iptables save
service iptables save
service iptables restart<\/div>\n\n\n

\u4e0b\u8f7d\u6b64\u811a\u672c\uff1aiptables.tar.gz<\/a> <\/p>\n\n\n\n

centos \u89e3\u538b\u547d\u4ee4<\/p>\n\n\n\n

tar -zxvf iptables.tar.gz<\/p>\n\n\n\n

<\/p>\n\n\n\n

2\u3001iptables\u65e5\u5fd7\u4f4d\u7f6e\u66f4\u6539\u7f16\u8f91\/etc\/syslog.conf\uff0c\u6dfb\u52a0\uff1a
kern.warning \/var\/log\/iptables.log<\/p>\n\n\n\n

\u91cd\u542fsyslog
\/etc\/init.d\/syslog restart<\/p>\n\n\n\n

3\u3001\u9632\u7aef\u53e3\u626b\u63cfshell\u811a\u672c\u9996\u5148\u5b89\u88c5inotify:
yum install inotify-tools<\/p>\n\n\n\n

\u4fdd\u5b58\u4ee5\u4e0b\u4ee3\u7801\u4e3aban-portscan.sh
btime=600 #\u5c01ip\u7684\u65f6\u95f4
while true;do
while inotifywait -q -q -e modify \/var\/log\/iptables.log;do
ip=tail -1 \/var\/log\/iptables.log | awk -F\"[ =]\" '{print $13}' | grep '\\([0-9]\\{1,3\\}\\.\\)\\{3\\}[0-9]\\{1,3\\}'<\/code>
if test -z “\/sbin\/iptables -nL | grep $ip<\/code>“;then
\/sbin\/iptables -I INPUT -s $ip -j DROP
{
sleep $btime && \/sbin\/iptables -D INPUT -s $ip -j DROP
} &
fi
done
done<\/p>\n\n\n\n

\u6267\u884c\u547d\u4ee4\u5f00\u59cb\u542f\u7528\u7aef\u53e3\u9632\u626b\u63cf
nohup .\/ban-portscan.sh &<\/p>\n","protected":false},"excerpt":{"rendered":"

\u9632\u6b62syn\u653b\u51fb\uff08DDOOS\u653b\u51fb\u7684\u4e00\u79cd\uff09 iptables – … Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[4,5],"tags":[],"_links":{"self":[{"href":"https:\/\/www.cxybj.com\/index.php?rest_route=\/wp\/v2\/posts\/287"}],"collection":[{"href":"https:\/\/www.cxybj.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cxybj.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cxybj.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cxybj.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=287"}],"version-history":[{"count":7,"href":"https:\/\/www.cxybj.com\/index.php?rest_route=\/wp\/v2\/posts\/287\/revisions"}],"predecessor-version":[{"id":706,"href":"https:\/\/www.cxybj.com\/index.php?rest_route=\/wp\/v2\/posts\/287\/revisions\/706"}],"wp:attachment":[{"href":"https:\/\/www.cxybj.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=287"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cxybj.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=287"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cxybj.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=287"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}