Chu*_*eto 11
@vastlysuperiorman称之为正确,csf/lfd是最好的.不幸的是,它们只能在linux上运行.
此免费实用程序 promises to provide the same functionality:动态监视访问尝试和自动阻止IP地址.如果出现误报,您可以使用命令取消阻止.当然值得一试.
另一种方法是创建一个VM(如果您的平台支持虚拟化)部署一个非常小的规范linux盒子,并将其用作代理.这应该很容易实现.顺便说一句,为什么不只是使用linux？.. :-)
(这应该是对@ vastlysuperiorman的帖子的评论,但我没有足够的SO代表评论其他人的帖子)
Edited to suggest a possible apache 2.4 based solution:
在apache中转换2.2和2.4之间的ACL指令
2.2语法
order Deny,Allow
include conf/IPList.conf
Allow from all
2.4语法
DocumentRoot /some/local/dir
<Directory /some/local/dir/>
<RequireAll>
Require all granted
Include conf/IPList.conf
</RequireAll>
</Directory>
#this will also work
<Location />
<RequireAll>
Require all granted
Include conf/IPList.conf
</RequireAll>
</Directory>
# conf/IPLIst.com is actually in /etc/apache2/conf/IPList.conf
# (ie, paths are relative to where apache is installed.
# I guess you can also use the full path to the list.
在conf/IPList.conf中,您将拥有包含以下条目的各个行
Require not ip 10.10.1.23 Require not ip 192.168.22.199 Require not ip 10.20.70.100
使用mod-rewrite和IP列表进行禁止
#Required set of rewrite rules
RewriteEngine on
RewriteMap hosts-deny txt:/etc/apache/banned-hosts
RewriteCond ${hosts-deny:%{REMOTE_ADDR}|NOT-FOUND} !=NOT-FOUND [OR]
RewriteCond ${hosts-deny:%{REMOTE_HOST}|NOT-FOUND} !=NOT-FOUND
RewriteRule ^ /why-am-i-banned.html
## inside our banned hosts file, we have:
## /etc/apache2/banned-hosts (maintain the format .. its not just a plain text file)
##
193.102.180.41 -
192.168.111.45 -
www.example.com -
www.sumwia.net -
# inside our status page, could be html as below or a plain text file with '.txt' extension
#/var/www/html/why-am-i-banned.html
#
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Why is my IP banned?</title>
</head>
<body>
<h2>Why is my IP address banned?</h2>
<p>
To manage spammers and for other security needs, our server automatically blocks
suspicious IP address. If however you reckon your IP address has been blocked
wrongfully, please contact us.
</p>
</body>
</html>
当然,您可以解析日志文件并根据需要填充conf/IPList.conf或/ etc/apache2/banned-hosts.
作为短期解决方案
允许您使用2.2语法的替代方法是安装mod_access_compat模块并继续使用已弃用的2.2样式'Deny,Allow'指令.但这只是一个短期解决方案,因为该模块只是为了帮助过渡,并且可能会在未来版本的apache 2.4中消失
我也没有看到从Apache本身动态阻止访问的好方法.有"hacky"方式:您可以设置一个环境变量来包含IP列表,然后使用带有$ {REMOTE_ADDR}的模块和env函数,但这是一个延伸.有关Expression Parser的详细信息
但是,我使用了几个有助于保护Apache服务器的轻量级模块.
ConfigServer Firewall(CSF/LFD)是一个很好的Linux系统解决方案.它提供了一种管理iptables的简单方法,可以设置为执行强力检测和阻塞.信息在这里
编辑:将以下行添加到/etc/csf/csf.deny以包括您的自定义IP阻止列表:
Include /var/www/example.deny
或者,更新您的脚本以直接将IP地址附加到csf.deny:
echo $badIP >> /etc/csf/csf.deny
或使用CSF命令行选项(首选):
csf -d 10.20.30.40
CSF自述在这里
mod_security是我最喜欢的Apache/nginx模块之一.它检测危险的GET和POST请求并相应地阻止访问.正确设置后,它将触发CSF阻止经常违反规则的IP地址.细节在这里