宝塔面板Nginx的Lua-Waf防火墙终极改进 动态封禁IP
【性价之王】 | 【线路之王】 | 【价格之王】 | 【配置之王】 |
【免费之王】 | 【香港首推】 | 【梯子之王】 | 【独服之王】 |
宝塔面板自带的Nginx防火墙有些鸡肋,对于大量的恶意攻击只能临时拦截,而不能封禁IP。
延伸阅读:Oneinstack一键开启安装ngx_lua_waf防火墙功能
下面的修改可以帮你做到,频繁CC攻击,频繁的漏洞扫描,同一个IP段轮流攻击,使用了CDN进行攻击,都可以全部封禁。
宝塔面板的nginx修改/www/server/nginx/waf/目录下的三个文件即可,如果没有宝塔面板,nginx必须安装Lua,然后对下面的代码稍加修改,并且自己加上正则黑名单(或者下载个宝塔面板把规则文件拷出来)也可以正常使用。
代码:config.lua
RulePath = "/www/server/panel/vhost/wafconf/" --规则文件夹attacklog="on"logdir = "/www/wwwlogs/waf/" --日志文件夹UrlDeny="on"Redirect="on"CookieMatch="on"postMatch="on"whiteModule="on" black_fileExt={"php"}ipWhitelist={}ipBlocklist={}CCDeny="on"CCrate="500/100" --这个是CC攻击的几秒钟允许请求几次代码:init.lua
require 'config'local match = string.matchlocal ngxmatch=ngx.re.findlocal unescape=ngx.unescape_urilocal get_headers = ngx.req.get_headerslocal optionIsOn = function (options) return options == "on" and true or false endlogpath = logdir rulepath = RulePathUrlDeny = optionIsOn(UrlDeny)PostCheck = optionIsOn(postMatch)CookieCheck = optionIsOn(cookieMatch)WhiteCheck = optionIsOn(whiteModule)PathInfoFix = optionIsOn(PathInfoFix)attacklog = optionIsOn(attacklog)CCDeny = optionIsOn(CCDeny)Redirect=optionIsOn(Redirect)function subString(str, k) --截取字符串 ts = string.reverse(str) _, i = string.find(ts, k) m = string.len(ts) - i + 1 return string.sub(str, 1, m)endfunction getClientIp() IP = ngx.var.remote_addr if ngx.var.HTTP_X_FORWARDED_FOR then IP = ngx.var.HTTP_X_FORWARDED_FOR end if IP == nil then IP = "unknown" end IP = subString(IP, "[.]") .. "*" return IPendfunction getRealIp() IP = ngx.var.remote_addr if ngx.var.HTTP_X_FORWARDED_FOR then --如果用了CDN,判断真实IP IP = ngx.var.HTTP_X_FORWARDED_FOR end if IP == nil then IP = "unknown" end return IPendfunction write(logfile,msg) local fd = io.open(logfile,"ab") if fd == nil then return end fd:write(msg) fd:flush() fd:close()endfunction log(method,url,data,ruletag) if attacklog then local realIp = getRealIp() local ua = ngx.var.http_user_agent local servername=ngx.var.server_name local time=ngx.localtime() if ua then line = realIp.." ["..time.."] \""..method.." "..servername..url.."\" \""..data.."\" \""..ua.."\" \""..ruletag.."\"\n" else line = realIp.." ["..time.."] \""..method.." "..servername..url.."\" \""..data.."\" - \""..ruletag.."\"\n" end local filename = logpath..'/'..servername.."_"..ngx.today().."_sec.log" write(filename,line) endend------------------------------------规则读取函数-------------------------------------------------------------------function read_rule(var) file = io.open(rulepath..'/'..var,"r") if file==nil then return end t = {} for line in file:lines() do table.insert(t,line) end file:close() return(t)end-----------------------------------频繁扫描封禁ip-------------------------------------------------------------------function ban_ip(point) local token = getClientIp() .. "_WAF" local limit = ngx.shared.limit local req,_=limit:get(token) if req then limit:set(token,req+point,3600) --发现一次,增加积分,1小时内有效 else limit:set(token,point,3600) endendfunction get_ban_times() local token = getClientIp() .. "_WAF" local limit = ngx.shared.limit local req,_=limit:get(token) if req then return req else return 0 endendfunction is_ban() local ban_times = get_ban_times() if ban_times >= 100 then --超过100积分,ban ngx.header.content_type = "text/html;charset=UTF-8" ngx.status = ngx.HTTP_FORBIDDEN ngx.exit(ngx.status) return true else return false end return falseendurlrules=read_rule('url')argsrules=read_rule('args')uarules=read_rule('user-agent')wturlrules=read_rule('whiteurl')postrules=read_rule('post')ckrules=read_rule('cookie')html=read_rule('returnhtml')function say_html() ban_ip(15) --恶意攻击,罚15分 if Redirect then ngx.header.content_type = "text/html;charset=UTF-8" ngx.status = ngx.HTTP_FORBIDDEN ngx.say(html) ngx.exit(ngx.status) endendfunction whiteurl() if WhiteCheck then if wturlrules ~=nil then for _,rule in pairs(wturlrules) do if ngxmatch(ngx.var.uri,rule,"isjo") then return true end end end end return falseendfunction fileExtCheck(ext) local items = Set(black_fileExt) ext=string.lower(ext) if ext then for rule in pairs(items) do if ngx.re.match(ext,rule,"isjo") then log('POST',ngx.var.request_uri,"-","file attack with ext "..ext) say_html() end end end return falseendfunction Set (list) local set = {} for _, l in ipairs(list) do set[l] = true end return setendfunction args() for _,rule in pairs(argsrules) do local args = ngx.req.get_uri_args() for key, val in pairs(args) do if type(val)=='table' then local t={} for k,v in pairs(val) do if v == true then v="" end table.insert(t,v) end data=table.concat(t, " ") else data=val end if data and type(data) ~= "boolean" and rule ~="" and ngxmatch(unescape(data),rule,"isjo") then log('GET',ngx.var.request_uri,"-",rule) say_html() return true end end end return falseendfunction url() if UrlDeny then for _,rule in pairs(urlrules) do if rule ~="" and ngxmatch(ngx.var.request_uri,rule,"isjo") then log('GET',ngx.var.request_uri,"-",rule) say_html() return true end end end return falseendfunction ua() local ua = ngx.var.http_user_agent if ua ~= nil then for _,rule in pairs(uarules) do if rule ~="" and ngxmatch(ua,rule,"isjo") then log('UA',ngx.var.request_uri,"-",rule) say_html() return true end end end return falseendfunction body(data) for _,rule in pairs(postrules) do if rule ~="" and data~="" and ngxmatch(unescape(data),rule,"isjo") then log('POST',ngx.var.request_uri,data,rule) say_html() return true end end return falseendfunction cookie() local ck = ngx.var.http_cookie if CookieCheck and ck then for _,rule in pairs(ckrules) do if rule ~="" and ngxmatch(ck,rule,"isjo") then log('Cookie',ngx.var.request_uri,"-",rule) say_html() return true end end end return falseendfunction denycc() if CCDeny then CCcount=tonumber(string.match(CCrate,'(.*)/')) CCseconds=tonumber(string.match(CCrate,'/(.*)')) local token = getRealIp() local limit = ngx.shared.limit local req,_=limit:get(token) if req then if req > CCcount then limit:incr(token,1) ban_ip(req - CCcount) --CC攻击,罚分 ngx.header.content_type = "text/html" ngx.status = ngx.HTTP_FORBIDDEN ngx.say("老哥你手速也忒快了吧,要不休息"..CCcount.."秒?") ngx.exit(ngx.status) return true else limit:incr(token,1) end else limit:set(token,1,CCseconds) end end return falseendfunction get_boundary() local header = get_headers()["content-type"] if not header then return nil end if type(header) == "table" then header = header[1] end local m = match(header, ";%s*boundary=\"([^\"]+)\"") if m then return m end return match(header, ";%s*boundary=([^\",;]+)")endfunction whiteip() if next(ipWhitelist) ~= nil then for _,ip in pairs(ipWhitelist) do if getClientIp()==ip then return true end end end return falseendfunction blockip() if next(ipBlocklist) ~= nil then for _,ip in pairs(ipBlocklist) do if getClientIp()==ip then ngx.exit(444) return true end end end return falseend代码:waf.lua
local content_length=tonumber(ngx.req.get_headers()['content-length'])local method=ngx.req.get_method()local ngxmatch=ngx.re.matchif whiteip() thenelseif blockip() thenelseif whiteurl() thenelseif is_ban() thenelseif denycc() thenelseif ngx.var.http_Acunetix_Aspect then ngx.exit(444)elseif ngx.var.http_X_Scan_Memo then ngx.exit(444)elseif ua() thenelseif url() thenelseif args() thenelseif cookie() thenelseif PostCheck then if method=="POST" then local boundary = get_boundary() if boundary then local len = string.len local sock, err = ngx.req.socket() if not sock then return end ngx.req.init_body(128 * 1024) sock:settimeout(0) local content_length = nil content_length=tonumber(ngx.req.get_headers()['content-length']) local chunk_size = 4096 if content_length < chunk_size then chunk_size = content_length end local size = 0 while size < content_length do local data, err, partial = sock:receive(chunk_size) data = data or partial if not data then return end ngx.req.append_body(data) if body(data) then return true end size = size + len(data) local m = ngxmatch(data,[[Content-Disposition: form-data;(.+)filename="(.+)\\.(.*)"]],'ijo') if m then fileExtCheck(m[3]) filetranslate = true else if ngxmatch(data,"Content-Disposition:",'isjo') then filetranslate = false end if filetranslate==false then if body(data) then return true end end end local less = content_length - size if less < chunk_size then chunk_size = less end end ngx.req.finish_body() else ngx.req.read_body() local args = ngx.req.get_post_args() if not args then return end for key, val in pairs(args) do if type(val) == "table" then if type(val[1]) == "boolean" then return end data=table.concat(val, ", ") else data=val end if data and type(data) ~= "boolean" and body(data) then body(key) end end end endelse returnend[Lua-Waf防火墙]历史优惠活动内容
猜你可能想看的VPS
- Vultr 云服务器最新优惠活动:2020 年新用户注册赠送 53 美元全球[VPS测评]
- Kuai Che Dao→$168 季 1GB 内存 10GB SSD 虚拟空间(主机)
- 疯狂猜成语 图猜成语一只木盆往外泼水是什么成语?全球[VPS测评]
- MoeCloud→900 元 月 2 核 4GB 内存 20GB SSD香港VPS[主机]
- PacificRack→$6.52 年 KVM-512MB 10GB 5全球[VPS测评]
- 便宜的免备案虚拟主机-Hostens 虚拟主机月付低至 0.99 美元全球[VPS测评]
- iWFHosting→KVM2G 每月 8.99 美元起 洛杉矶可选 1全球[VPS测评]
- RAKsmart→美国站群买一送一 I3 低至$46 抢购 VPS 年付站群服务器[IP]
- 如何在begin主题实现评论自动排第一全球[VPS测评]
- 购买VPS需要注意的30个问题全球[VPS测评]
- WordPress前端优化设置教程全球[VPS测评]
- BuyVM推出China Special - STREAM RYZEN 全球[VPS测评]
- Suble → 2$月付 圣诞优惠 丹麦 1C1G15G硬盘 1Gbps全球[VPS测评]
- HKSS 2G 内存 20G SSD 2T流量 100M带宽 香港 Ce香港VPS[主机]
- 什么是IconFont ?iconfont 的使用和解析全球[VPS测评]
- 吸血鬼崛起服务器怎么快速搭建?全球[VPS测评]
- 向日葵-漏洞科普:海外云服务器三种漏洞修复方法快收藏起来!全球[VPS测评]
- UCloud云服务器2020年度大促:北京/上海云服务器/香港免备案云服香港VPS[主机]
- 六一云:国内BGP高防vps套餐,1核/1G/2Mbps/香港CN2,月香港VPS[主机]
- jquery css3实现的进度条动画特效,带加载进度条百分比动态效果。全球[VPS测评]
- 什么是云计算?全球[VPS测评]
- 拼多多正筹建跨境电商平台:密集挖角SHEIN员工,零佣金招商入驻全球[VPS测评]
- 青果云:香港云主机2核1G3M30G,香港vps仅售59元/月香港VPS[主机]
- 硅云:香港免备案云服务器仅232元/年;香港2核2G2M仅482元/年香港VPS[主机]
- 磐逸云:全场8折优惠,1核1G香港套餐月付24元,日本NNT线路套餐,月日本VPS[主机]
- 2022年亚马逊Prime会员日将于7月12日和13日举行,覆盖24个站全球[VPS测评]
- 青云互联:香港弹性云CN2直连线路,全场8折,免费windows系统,月WINDOWS
- locvps:香港cn2vps(葵湾机房),2核2G40g硬盘,8折优惠WINDOWS
- YYYHost年终钜惠来袭:香港建站云/美国Cera云月付8折,季付7折美国VPS[主机]
- 品光网络:香港美国免备案云服务器超低价,2核2G2M年付仅750元/年美国VPS[主机]
转载请注明原文地址:http://www.motoll.com/read-228045.html