记录一次解决cc攻击 - 云原生基站

录一次 cc 攻击]

虽然没完全解决,但是屏蔽大量攻击,减轻服务器负担.此文档只是简单介绍下 web 防火墙原理

1 泳道图#

2 配置 Nginx#

cat conf.d/wxh.super.co.conf

1
limit_req_zone $remote_addr zone=allips:10m rate=30r/s; # 每个ip一秒30次
2
# limit_req zone=allips; #全局限制
3
server {
4
server_name wxh.super.com;
5
......
6
if  ($request_uri  ~* "kto0a81u") {
7
return 503;
8
}  #只要访问以kto0a81u为结尾的连接自动跳到503
9
location /
10
{
11
    allow 122.14.1.21;     #白名单
12
    limit_req zone=allips #限制访问/user/login链接每个ip一秒10次
13
    try_files $uri $uri/ @router;
14
    index index.html;
15
}
16

17
location @router
18
{
19
   rewrite ^.*$ /index.html last;
20
}
21
}

nginx.config: 这个很关键,主要 fail2ban 用来提取关键字,上面的配置文件访问过道会报出 503 的错误

1
http {
2
    .....
3
 log_format main
4
  '{"timestamp":"$time_iso8601_ms",'
5
  '"server_ip":"$server_addr",'
6
  '"remote_ip":"$remote_addr",'
7
  '"xff":"$http_x_forwarded_for",'
8
  '"remote_user":"$remote_user",'
9
  '"domain":"$host",'
10
  '"url":"$request_uri",'
11
  '"referer":"$http_referer",'
12
  '"upstreamtime":"$upstream_response_time",'
13
  '"responsetime":"$request_time",'
14
  '"request_method":"$request_method",'
15
  '"status":"$status",'
16
  '"response_length":"$bytes_sent",'
17
  '"request_length":"$request_length",'
18
  '"protocol":"$server_protocol",'
19
  '"upstreamhost":"$upstream_addr",'
20
  '"http_user_agent":"$http_user_agent"'
21
  '}';
22
    .....
23
}

3 fail2ban#

3.1 安装#

yum -y install epel-release yum -y install fail2ban

3.2 准备 fail2ban,注意,里面任何文件都不要删,否则会报错#

目录结构:

/etc/fail2ban ## fail2ban 服务配置目录 /etc/fail2ban/action.d ## firewalld 、mail 等动作文件目录 /etc/fail2ban/filter.d ## 条件匹配文件目录，过滤日志关键内容 /etc/fail2ban/jail.d ## 规则文件目录，按具体防护项目分成文件 /etc/fail2ban/jail.local ## 默认规则文件 /etc/fail2ban/jail.conf ## fail2ban 防护配置文件 /etc/fail2ban/fail2ban.conf ## fail2ban 配置文件，定义日志级别、日志、sock 文件位置等

1
# This file is part of the fail2ban-firewalld package to configure the use of
2
# the firewalld actions as the default actions.  You can remove this package
3
# (along with the empty fail2ban meta-package) if you do not use firewalld
4
[DEFAULT]
5
banaction = firewallcmd-ipset   #使用firewallcmd
6
action = %(action_mwl)s         #触发后动作

添加 jail.local

1
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
2
vim /etc/fail2ban/jail.local
3
# banaction行内容替换如下
4
banaction = firewalld

配置 firewalld

1
vim /etc/fail2ban/action.d/firewalld.conf
2
[INCLUDES]
3
before  =
4

5
[Definition]
6
actionstart =
7
actionstop =
8
actioncheck =
9

10
actionflush = sed -i '/<source address=/d' /etc/firewalld/zones/drop.xml
11
actionban = firewall-cmd --change-source=<ip> --zone=drop && firewall-cmd --change-source=<ip> --zone=drop --permanent
12
actionunban = firewall-cmd --remove-source=<ip> --zone=drop && firewall-cmd --remove-source=<ip> --zone=drop --permanent || echo 0
13

14
[Init]

3.3 防止 Ssh 暴力破解#

cat /etc/fail2ban/jail.d/sshd.local

1
[sshd]                                  #名字,查看封禁ip的时候用到
2
enabled     = true                      #开启状态
3
filter      = sshd                      #规则名称，必须填写位于filter.d目录里面的规则，sshd是fail2ban内置规则
4
action      = %(action_mwl)s
5
logpath     = /var/log/secure           #日志路径

3.4 防止 Cc 登录#

cat /etc/fail2ban/filter.d/nginx.conf

1
[Definition]
2
failregex = ^{.*"remote_ip":"<HOST>",.*"status":"503".*}
3
ignoreregex = # 这里不要配,会损失一半性能

cat /etc/fail2ban/jail.d/nginx.local

1
[nginx]
2
enabled = true
3
port = http,https              #端口
4
filter = nginx
5
action = %(action_mwl)s
6
bantime  = 86400
7
findtime = 1
8
maxretry = 8
9
logpath = /var/log/nginx/access.log

重启服务 systemctl restart fail2ban fail2ban-client status nginx

1
Status for the jail: nginx
2
|- Filter
3
|  |- Currently failed: 0
4
|  |- Total failed: 0
5
|  `- File list: /opt/nginx-1.13.7-prod/logs/openapi.juxinda360.cn_access.log
6
`- Actions
7
   |- Currently banned: 79
8
   |- Total banned: 79
9
   `- Banned IP list: 1.193.69.212 1.56.17.17 1.56.21.168 1.56.22.168 1.56.23.197 1.56.23.20 1.56.23.27 1.58.169.134 1.62.145.3 106.91.160.102 112.49.224.157 113.127.205.129 113.232.162.157 113.232.165.90 113.232.176.51 113.239.196.205 113.4.124.189 113.4.176.241 113.4.251.111 114.101.211.22 117.136.30.21 117.136.75.203 117.136.81.63 117.28.80.103 119.115.240.68 119.118.115.196 119.118.126.237 119.52.40.18 119.52.40.218 119.52.58.142 119.52.59.80 119.55.114.184 119.55.119.191 119.55.75.28 123.147.248.213 139.214.144.40 175.168.15.107 175.172.176.235 175.174.95.244 182.149.201.235 202.110.40.130 218.24.58.240 218.7.116.157 218.7.116.2 220.195.66.70 220.197.208.38 220.201.199.241 221.200.177.210 221.200.184.244 221.203.85.168 221.206.200.181 221.206.200.209 221.206.200.222 221.206.200.233 221.206.200.236 221.206.200.64 221.206.201.114 221.206.201.124 221.206.201.173 221.206.201.95 221.210.130.139 221.210.130.150 223.104.178.83 223.104.251.59 223.104.3.184 223.104.65.233 223.104.96.86 42.176.11.18 42.176.9.149 42.178.136.167 42.185.16.167 42.185.18.225 42.185.20.30 42.185.20.44 42.185.21.115 42.185.23.104 42.55.16.57 42.59.233.96 42.86.58.84

1 泳道图#

2 配置 Nginx#

3 fail2ban#

3.1 安装#

3.2 准备 fail2ban,注意,里面任何文件都不要删,否则会报错#

3.3 防止 Ssh 暴力破解#

3.4 防止 Cc 登录#

文章分享

评论区

音乐

文章目录