DDoS-Deflate是一款非常小巧的防御和減輕DDoS攻擊的工具，它可以通過監測netstat來跟蹤來創建大量互聯網連接的IP地址信息，通過APF或IPTABLES禁止或阻檔這些非常IP地址。
我們可以使用netstat命令查看當前系統連接的狀態，是否有受到DDOS攻擊
[root@localhost ~]# netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
1 101.226.66.172
1 103.29.134.193
1 110.85.249.85
1 115.150.118.203
1 116.22.233.25
1 119.254.227.106
1 122.224.152.139
1 123.126.68.35
1 123.151.136.225
1 124.202.164.10
1 124.202.164.16
1 14.29.112.87
1 14.29.127.218
1 157.55.33.124
1 170.130.24.152
1 180.149.143.11
1 182.118.19.201
1 182.118.20.40
1 183.39.201.142
1 199.30.24.33
1 210.242.215.195
1 210.242.215.211
1 210.242.215.212
1 210.242.215.213
1 210.242.215.215
1 210.242.215.216
1 210.242.215.218
1 210.6.198.12
1 219.239.26.13
1 220.181.51.62
1 23.94.20.3
1 27.28.7.0
1 42.120.160.95
1 42.156.137.95
1 58.51.180.34
1 60.220.197.225
1 61.135.189.43
1 61.135.249.202
1 61.164.170.222
1 66.249.67.163
1 Address
1 servers)
2 124.202.164.11
2 218.109.165.44
2 220.181.125.20
2 223.104.20.49
2 42.156.136.95
2 61.51.249.58
2 72.52.94.226
3 210.242.215.210
3 222.76.109.133
4 120.39.165.97
4 123.113.42.119
5 110.244.82.238
5 118.72.107.112
5 222.141.238.211
6 110.153.48.75
6 111.206.125.33
6 124.117.235.163
6 60.215.180.43
7 101.226.89.117
9 111.20.119.234
9 119.126.238.114
9 183.32.67.179
10 121.35.228.194
10 122.141.235.146
11 183.63.97.42
12 106.125.11.78
13 114.228.158.82
13 118.228.151.171
14 222.129.186.143
15 113.231.87.141
17 113.137.204.201
20 119.251.38.134
20 61.164.36.34
30 58.215.136.89
44 58.215.136.105
101 127.0.0.1
查看iptables的狀態
[root@localhost ~]# service iptables status
表格：filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:21
5 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80
6 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:3306
7 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:58416
8 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
安裝DDoS-Deflate
[root@localhost ~]# wget http://www.inetbase.com/scripts/ddos/install.sh
[root@localhost ~]# chmod +x install.sh
[root@localhost ~]# ./install.sh
Installing DOS-Deflate 0.6
Downloading source files....
.....done
Creating cron to run script every minute.....(Default setting).....done
Installation has completed.
Config file is at /usr/local/ddos/ddos.conf
Please send in your comments and/or suggestions to zaf@vsnl.com
DOS-Deflate已經安裝好了。
DOS-Deflate卸載
wget http://www.inetbase.com/scripts/ddos/uninstall.ddos
chmod 0700 uninstall.ddos
./uninstall.ddos
DOS-Deflate文件的說明：
[root@localhost ~]# cd /usr/local/ddos/
[root@localhost ddos]# ll
總用量 4
-rw-r--r-- 1 root root 971 1月 10 2006 ddos.conf
-rwxr-xr-x 1 root root 3945 1月 10 2006 ddos.sh
-rw-r--r-- 1 root root 10 1月 10 2006 ignore.ip.list
-rw-r--r-- 1 root root 10113 1月 10 2006 LICENSE
DOS-Deflate安裝好之后，全部的文件是放在/usr/local/ddos文件夾中。
文件說明：
ddos.conf -- DDoS-Deflate 的配置文件，其中配置防止ddos時的各種行為
ddos.sh -- DDoS-Deflate 的主程序，使用shell編寫的，整個程序的功能模塊
ignore.ip.list -- 白名單，該文件中的ip超過設定的連接數時，也不被 DDoS-Deflate 阻止
LICENSE -- DDoS-Deflate 程序的發布協議
配置ddos.conf
[root@localhost ddos]# cat ddos.conf
##### Paths of the script and other files #配置文件也是個shell腳本
PROGDIR="/usr/local/ddos"
PROG="/usr/local/ddos/ddos.sh"
IGNORE_IP_LIST="/usr/local/ddos/ignore.ip.list" #存放白名單的文件
CRON="/etc/cron.d/ddos.cron" #計劃任務，默認是每分鐘執行一次ddos.sh
APF="/etc/apf/apf"
IPT="/sbin/iptables"
##### frequency in minutes for running the script
##### Caution: Every time this setting is changed, run the script with --cron
##### option so that the new frequency takes effect
FREQ=1 #DDoS-Deflate通過linux的計劃任務執行，默認為每分鐘一次
##### How many connections define a bad IP? Indicate that below.
NO_OF_CONNECTIONS=150 #定義單個IP達到多少連接時規定為這是一次ddos攻擊
##### APF_BAN=1 (Make sure your APF version is atleast 0.96)
##### APF_BAN=0 (Uses iptables for banning ips instead of APF)
APF_BAN=0 #這里為 “0”，表示使用iptables，而不是APF
##### KILL=0 (Bad IPs are'nt banned, good for interactive execution of script)
##### KILL=1 (Recommended setting)
KILL=1 #是否阻止被定義為ddos攻擊的ip，“1”為阻止
##### An email is sent to the following address when an IP is banned.
##### Blank would suppress sending of mails
EMAIL_TO="xxxxx@ithov.com" #事件通知人的郵件地址
##### Number of seconds the banned ip should remain in blacklist.
BAN_PERIOD=600 #阻止被定義為ddos攻擊者ip與本機通信時間，默認為600秒
ddos.sh文件內容：
[root@localhost ddos]# ./ddos.sh -h
DDoS-Deflate version 0.6
Copyright (C) 2005, Zaf <zaf@vsnl.com>
Usage: ddos.sh [OPTIONS] [N]
N : number of tcp/udp connections (default 150)
OPTIONS:
-h | --help: Show this help screen
-c | --cron: Create cron job to run this script regularly (default 1 mins)
-k | --kill: Block the offending ip making more than N connections
測試防ddos攻擊效果
NO_OF_CONNECTIONS=3
#這里為了方便測試，設置為3。生產環境下，幾十到幾百都可以理解為正常，上千肯定就是不正常了，除非是應用內部各個服務器之間的通信
通過一臺固定ip的機器ssh連接該服務器，當連接到超過3甚至更多時，不會立刻顯示連不上，因為ddos.sh默認一分鐘運行一次，當過不到一分鐘時，會發現連接掉了，查看部署了防ddos軟件的服務器上可以看到iptables的策略中多了：
DROP all -- 31.210.16.29.broad.cs.gd.dynamic.163data.com.cn anywhere
說明確實生效了，當10分鐘后，iptables上這條策略會被取消的
關于如何查看單個IP的連接數目可以通過如下命令查看，依次排列：
netstat -na|grep ESTABLISHED|awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -r -n
..............
40 127.0.0.1
1 121.9.252.28
1 173.117.140.69
ddos攻擊很常見，攻擊效果也很好，比如像前段時間由于維基創始人引發的那次大范圍的攻擊。
如果有專門防止ddos的硬件設備的話最好，沒有的話就利用DDoS-Deflate結合iptables在一定程度上防范ddos攻擊也是一種很好的策略。
發表評論