Nginx 封锁恶意 IP，并且定时取消的两种脚本

#!/bin/bash
max=500    #我们设定的最大值，当访问量大于这个值得时候，封锁
confdir=/usr/local/data/nginx/conf/blockip.conf #nginx封锁配置文件路径
logdir=/usr/local/data/nginx/logs/access_huke88.log  #nginx访问日志文件路径
#检测文件
test -e ${confdir} || touch ${confdir}
drop_ip=""
#循环遍历日志文件取出访问量大于500的ip
for drop_ip  in $(cat $logdir | awk '{print $1}' | sort | uniq -c | sort -rn  | awk '{if ($1>500) print $2}')
do
  grep  -q  "${drop_Ip}" ${confdir} && eg=1 || eg=0;
  if (( ${eg}==0 ));then
     echo "deny ${drop_Ip};">>$confdir  #把“deny IP；”语句写入封锁配置文件中
     echo ">>>>> `date '+%Y-%m-%d %H%M%S'` - 发现攻击源地址 ->  ${drop_Ip} " >> /usr/local/data/nginx/logs/nginx_deny.log  #记录log
  fi
done
service nginx reload

#！/bin/bash
sed -i 's/^/#&/g' /usr/local/nginx/conf/
blockip.conf  #把nginx封锁配置文件中的内容注释掉
service nginx reload   #重置nginx服务，这样就做到了解锁IP

#!/bin/bash
max=500    #我们设定的最大值，当访问量大于这个值得时候，封锁
logdir=/usr/local/data/nginx/logs/access_huke88.log  #nginx访问日志文件路径
port=80
drop_ip=""
#循环遍历日志文件取出访问量大于500的ip
for drop_ip  in $(cat $logdir | awk '{print $1}' | sort | uniq -c | sort -rn  | awk '{if ($1>500) print $2}')
do
  grep  -q  "${drop_Ip}" ${confdir} && eg=1 || eg=0;
  if (( ${eg}==0 ));then
     iptables -I INPUT -p tcp --dport ${port} -s ${drop_Ip} -j DROP
     echo ">>>>> `date '+%Y-%m-%d %H%M%S'` - 发现攻击源地址 ->  ${drop_Ip} " >> /usr/local/data/nginx/logs/nginx_deny.log  #记录log
  fi
done

chmod +x /home/scripts/deny_ip.sh
#####nginx封ip######
*/5 * * * * /bin/sh /home/scripts/deny_ip.sh >/dev/null 2>&1