1、安裝DDoS deflate
[root@hjj ~]#wget http://www.inetbase.com/scripts/ddos/install.sh //確定能上網
[root@hjj ~]# chmod 700 install.sh //添加權限
[root@hjj ~]#./install.sh //安裝 第一次可能不成功，卸載後再裝一次就行了
Installing DOS-Deflate 0.6
Downloading source files…done
Creating cron to run script every minute…(Default setting)…done
Installation has completed.
Config file is at /usr/local/ddos/ddos.conf
Please send in your comments and/or suggestions to [email protected]
##############################################################################
##############################################################################
“Artistic License”
Preamble
The intent of this document is to state the conditions under which a
Package may be copied, such that the Copyright Holder maintains some
q 輸入q 退出。
DDoS deflate安裝路徑：
[root@hjj ~]# ls /usr/local/ddos/
配置文件：
[root@hjj ~]# ls /usr/local/ddos/ddos.conf
/usr/local/ddos/ddos.conf
[root@hjj ~]# cat /usr/local/ddos/ignore.ip.list #IP地址白名單
127.0.0.1
[root@hjj ~]# vim /usr/local/ddos/ddos.conf #查看
Paths of the script and other files
PROGDIR="/usr/local/ddos"
Paths of the script and other files
PROGDIR="/usr/local/ddos"
PROG="/usr/local/ddos/ddos.sh" #要執行的DDOS腳本
IGNORE_IP_LIST="/usr/local/ddos/ignore.ip.list" //IP地址白名單，注：在這個文件中IP不受控制。
CRON="/etc/cron.d/ddos.cron" //定時執行程序
實戰： 如果1分鐘內，一個IP地址對我們服務器訪問150次以上，就認爲發生DDOS，使用防火牆把這個IP地址自動屏蔽掉。
[root@hjj ~]# vim /usr/local/ddos/ddos.conf
配置文件中的註釋如下：
frequency in minutes for running the script
Caution: Every time this setting is changed, run the script with --cron
option so that the new frequency takes effect
FREQ=1 //檢查時間間隔，默認1分鐘
How many connections define a bad IP? Indicate that below.
NO_OF_CONNECTIONS=150 //最大連接數，超過這個數IP就會被屏蔽，一般默認即可
APF_BAN=1 (Make sure your APF version is atleast 0.96)
APF_BAN=0 (Uses iptables for banning ips instead of APF)
APF_BAN=1 //使用APF還是iptables。推薦使用iptables,將APF_BAN的值改爲0即可。
改：19 APF_BAN=1
爲：19 APF_BAN=0
KILL=0 (Bad IPs are’nt banned, good for interactive execution of script)
KILL=1 (Recommended setting)
KILL=1 //是否屏蔽IP，默認即可
An email is sent to the following address when an IP is banned.
Blank would suppress sending of mails
[email protected] //當IP被屏蔽時給指定郵箱發送郵件報警，換成自己的郵箱即可
Number of seconds the banned ip should remain in blacklist.
BAN_PERIOD=600 //禁用IP時間，默認600秒，可根據情況調整
用戶可根據給默認配置文件加上的註釋提示內容，修改配置文件。