{"id":960,"date":"2017-10-27T00:37:27","date_gmt":"2017-10-26T15:37:27","guid":{"rendered":"http:\/\/wp.ultimai.org\/wp\/?p=960"},"modified":"2019-02-23T17:02:34","modified_gmt":"2019-02-23T08:02:34","slug":"dos-attack-by-bot-consecutive-access-to-specific-file-blocked-by-ip-block","status":"publish","type":"post","link":"http:\/\/wp.ultimai.org\/?p=960","title":{"rendered":"bot\u306b\u3088\u308bDOS\u653b\u6483\u3001\u7279\u5b9a\u30d5\u30a1\u30a4\u30eb\u3078\u306e\u9023\u7d9a\u30a2\u30af\u30bb\u30b9\u3092ip\u30d6\u30ed\u30c3\u30af\u306b\u3066\u906e\u65ad"},"content":{"rendered":"

access.log \u306b\u3088\u308a moodle\/calendar\/set.php \u3078\u306e\u4e0d\u6b63\u898f\u30a2\u30af\u30bb\u30b9\u3092\u78ba\u8a8d \u30e6\u30fc\u30b6\u30fc\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u306f “MJ12bot”<\/p>\n

\nipset\u3092\u5229\u7528\u3059\u308b\u3053\u3068\u3067\u3001IP\u30a2\u30c9\u30ec\u30b9\u306e\u96c6\u5408\u3092\u7c21\u5358\u306b\u7ba1\u7406\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u308b\u3002
\niptables \u3092\u5b9f\u884c\u3057\u306a\u304f\u3066\u6e08\u3080\u306e\u3067\u65e9\u901f\u5165\u308c\u305f\u3002<\/p>\n

# yum install ipset <\/pre>\n
\u30bb\u30c3\u30c8\u306e\u4f5c\u6210<\/h3>\n
\u63a5\u7d9a\u62d2\u5426IP\u306e\u96c6\u5408”BLACKLIST”\u3092\u4f5c\u6210<\/p>\n
# ipset create BLACKLIST hash:net<\/pre>\n
\u30d7\u30ed\u30b0\u30e9\u30e0\u30d5\u30ed\u30fc<\/h3>\n
moodle\/calendar\/set.php  \u5148\u982d\u3078\u8ffd\u8a18<\/p>\n
[highlight_php]
\n    $uaip = $_SERVER[‘REMOTE_ADDR’];\/\/ip\u3092\u53d6\u5f97
\n\t$ua = $_SERVER[‘HTTP_USER_AGENT’];\/\/ \u30e6\u30fc\u30b6\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u3092\u53d6\u5f97
\n\tif(\tstrpos($ua, ‘MJ12bot’) !== false ){
\n\t\thttp_response_code( 301 ) ;
\n\t\theader( “Location: ..\/..\/abcdef\/iptables.php?uaip=$uaip” ) ;
\n\t\texit;
\n\t}
\n[\/highlight_php]<\/p>\n
..\/..\/abcdef\/iptables.php  \u65b0\u898f\u4f5c\u6210 (\u5834\u6240\u306f\u3069\u3053\u3067\u3082\u3044\u3044)<\/p>\n
[highlight_php]
\n<?php
\n\t$file=’\/var\/www\/deny_ip’;
\n\t$getparam=htmlspecialchars($_GET[‘uaip’]);<\/p>\n
\tfile_put_contents($file,$getparam,FILE_APPEND | LOCK_EX);
\n?><\/p>\n
[\/highlight_php]<\/p>\n
\/var\/www\/deny_ip  \u306b\u306f MJ12bot\u304c\u30a2\u30af\u30bb\u30b9\u3057\u3066\u304d\u305fip\u30a2\u30c9\u30ec\u30b9\u304c\u66f8\u304d\u8fbc\u307e\u308c\u3066\u3044\u304f<\/h3>\n
  \/root\/iptables.sh  \u30b7\u30a7\u30eb\u30b9\u30af\u30ea\u30d7\u30c8\u4f5c\u6210 <\/p>\n
[highlight_php]
\n\t#!\/bin\/bash<\/p>\n
# \u62d2\u5426IP\u30ea\u30b9\u30c8\u306b\u8a18\u8f09\u3055\u308c\u305fIP\u304b\u3089\u306e\u30a2\u30af\u30bb\u30b9\u3092\u62d2\u5426\u3059\u308b
\nif [ -s \/var\/www\/deny_ip ]; then
\n    for ip in `cat \/var\/www\/deny_ip`
\n    do
\n        ipset add BLACKLIST $ip
\n    done
\nfi
\n: > \/var\/www\/deny_ip<\/p>\n
[\/highlight_php]<\/p>\n
cron \u30675\u5206\u304a\u304d\u306b\u5b9f\u884c  vi \/etc\/crontab<\/p>\n
[highlight_php]
\n\t *\/5  *  *  *  * root sh \/root\/iptables.sh
\n[\/highlight_php]<\/p>\n
cron log\u78ba\u8a8d   tail -f \/var\/log\/cron<\/p>\n
ipset list BLACKLIST<\/p>\n
[highlight_php]
\n\tName: BLACKLIST
\n\tType: hash:net
\n\tHeader: family inet hashsize 1024 maxelem 65536
\n\tSize in memory: 17008
\n\tReferences: 1
\n\tMembers:
\n\t158.69.254.103    \u2190\u3053\u308c\u304c\u62d2\u5426IP
\n[\/highlight_php]<\/p>\n","protected":false},"excerpt":{"rendered":"
access.log \u306b\u3088\u308a moodle\/cal […]<\/p>\n","protected":false},"author":2,"featured_media":961,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[],"class_list":["post-960","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security"],"_links":{"self":[{"href":"http:\/\/wp.ultimai.org\/index.php?rest_route=\/wp\/v2\/posts\/960","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/wp.ultimai.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/wp.ultimai.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/wp.ultimai.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/wp.ultimai.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=960"}],"version-history":[{"count":2,"href":"http:\/\/wp.ultimai.org\/index.php?rest_route=\/wp\/v2\/posts\/960\/revisions"}],"predecessor-version":[{"id":1181,"href":"http:\/\/wp.ultimai.org\/index.php?rest_route=\/wp\/v2\/posts\/960\/revisions\/1181"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/wp.ultimai.org\/index.php?rest_route=\/wp\/v2\/media\/961"}],"wp:attachment":[{"href":"http:\/\/wp.ultimai.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=960"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/wp.ultimai.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=960"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/wp.ultimai.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=960"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}