Filtering WEB attack source IP through cron timing task in Linux

  
 

Recently found that the server traffic is abnormal. I have seen some IP access to the server through the log, so I found this script to filter such IP. The specific rule is that if there are 1000 requests from 1000 requests, An IP, then this IP can be determined as an attack IP.

Create a new script file on the server:
vi block_ips.sh

put the following:
#!/bin/bashlogfiles=(/tmp/logs/rainbow_access.log/Tmp/logs/eric_access.log)whitelist=$(last

Copyright © Windows knowledge All Rights Reserved