(D)DoS Deflate - это бесплатный скрипт с помощью которого можно избавится от школьных DDoS. Скрипт использует команду «netstat» что бы обнаружить ddos и флуд, после обнаружения блокирует IP адреса атакующего, делает это с помощью iptables или apf. Сам скрипт написан на shell.
cd /usr/src wget http://www.inetbase.com/scripts/ddos/install.sh chmod +x install.sh ./install.sh
##### Paths of the script and other files PROGDIR="/usr/local/ddos" PROG="/usr/local/ddos/ddos.sh" IGNORE_IP_LIST="/usr/local/ddos/ignore.ip.list" WHITE_IP_LIST="/usr/local/ddos/white.ip.list" CRON="/etc/cron.d/ddos.cron" APF="/etc/apf/apf" IPT="/sbin/iptables" ##### frequency in minutes for running the script ##### Caution: Every time this setting is changed, run the script with --cron ##### option so that the new frequency takes effect FREQ=1 ##### How many connections define a bad IP? Indicate that below. NO_OF_CONNECTIONS=100 ##### APF_BAN=1 (Make sure your APF version is atleast 0.96) ##### APF_BAN=0 (Uses iptables for banning ips instead of APF) APF_BAN=0 ##### KILL=0 (Bad IPs are'nt banned, good for interactive execution of script) ##### KILL=1 (Recommended setting) KILL=1 ##### An email is sent to the following address when an IP is banned. ##### Blank would suppress sending of mails EMAIL_TO="root" ##### Number of seconds the banned ip should remain in blacklist. BAN_PERIOD=600
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr > $BAD_IP_LIST
netstat -ntu | awk '{print $5}' |grep -oE '[0-9]{1,}\.[0-9]{1,}\.[0-9]{1,}\.[0-9]{1,}' | cut -d: -f1 | sort | uniq -c | sort -nr > $BAD_IP_LIST
cd /usr/src wget http://www.inetbase.com/scripts/ddos/uninstall.ddos chmod +x uninstall.ddos ./uninstall.ddos