


Case study on how to block malicious IP addresses in batches to prevent attacks under Linux
In many cases, you may need to block IP addresses under Linux. For example, as an end user, you may want to be protected from spyware or IP tracking. If you are a system administrator, you may want to ban spam IP addresses from accessing your corporate mail server. Or you want to ban certain countries from accessing your web service for some reason. In many cases, however, your IP address blocking list can quickly grow to tens of thousands of IPs. How to deal with this?
Solution: ipset + iblocklist2ipset
Installation:
The simplest method is to install yum, but the version of this method is relatively low and lacks some used module parameters, so it is not recommended;
yum install ipset -y
Compile and install:
1. Dependency environment:
yum install libmnl libmnl-devel kernel-devel libtool-devel -y
(Installation method of new version: git pull git://git.netfilter.org/libmnl.git run ./autogen.sh)
(Note: If only libmnl is installed, the following error will appear:
checking for libmnl... configure: error: Package requirements (libmnl >= 1) were not met: No package 'libmnl' found Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. Alternatively, you may set the environment variables libmnl_CFLAGS and libmnl_LIBS to avoid the need to call pkg-config. See the pkg-config man page for more details. )
may prompt that /lib/modules/2.6.32- cannot be found during compilation) 431.el6.x86_64/source
After investigation, it was found that this soft link/lib/modules/2.6.32-431.el6.x86_64/build -->/usr/src/kernels/2.6.32- 431.el6.x86_64 does not exist
Solution: Re-establish the soft connection
ln -sb /usr/src/kernels/2.6.32-573.3.1.el6.x86_64 /lib/modules/2.6.32-431.el6.x86_64/build
Error when running ./autogen.sh:
Cannot find /usr/share /libtool/
Solution: Install the libtool-devel tool package yum install libtool-devel
2. Compile and install ipset (linux kernel source code (version >= 2.6.32) )
wget -P /usr/local/src http://ipset.netfilter.org/ipset-6.26.tar.bz2 cd /usr/local/src && tar xjf ipset-6.26.tar.bz2 && cd ipset-6.26 ./autogen.sh ./configure make make modules make install make modules_install
Note: Different linux kernels use different versions of source code packages
Note: linux kernel source code (version >= 2.6.16 or >= 2.4.36)
Compile and install:
wget -P /usr/local/src http://ipset.netfilter.org/ipset-4.5.tar.bz2 cd /usr/local/src && tar xf ipset-4.5.tar.bz2 && cd ipset-4.5 make KERNEL_DIR=http://img.xue163.com/lib/modules/$(shell uname -r)/build #$(shell uname -r)使用shell命令获取 make KERNEL_DIR=http://img.xue163.com/lib/modules/$(shell uname -r)/build install
Commonly used commands:
ipset list 查看ip集列表信息 ipset create pythontab hash:ip maxelem 1000000 创建一个IP集pythontab,指定类型为hash:ip,设置ip集最多存储IP数为1000000 ipset add pythontab X.X.X.X 增加一个ip地址到IP集pythontab中去 ipset add pythontab X.X.X.X/24 增加一个网段到IP集pythontab中去 ipset dell pythontab X.X.X.X 删除IP集中指定的IP地址 ipset list 查看当前所有list ipset save pythontab -f pythontab.txt 将IP集pythontab中的信息保存到当前文件目录下面的文件pythontab.txt中 ipset destroy pythontab 删除指定的IP集pythontab ipset restore -f pythontab.txt 将保存的pythontab.txt文件中的IP集信息重新导入到ipset中 其他命令参考 ipset --help iptable命令参考: iptables -I INPUT -m set --match-set pythontab src -p tcp --destination-port 80 -j DROP #拒绝ipset IP集pythontab中的地址访问服务器的80端口 service iptables save service iptables restart
Automatic IP address disabling
Now you should see the power of maintaining IP blacklists. A tedious and time-consuming task. In fact, there are many free or paid services that can do this for you. As an added bonus, let's look at how to automatically add IP blacklists to the IP set. ##First let’s get a free blacklist from iblocklist.com
Next I’m going to use an open source Python tool called iblocklist2ipset to convert the blacklist into an IP set.
First, you need to install pip
Use the following command to install iblocklist2ipset.
$ pip install iblocklist2ipset
On some distributions such as Fedora, you may need to run:
$ python-pip install iblocklist2ipset
Now go to iblocklist.com and grab the URL of any P2P list (such as the "level1" list).
Download and unzip it, then save it as a txt file, for example, called pythontab.txt. Because iblocklist2ipset only supports url to obtain the list, put pythontab.txt in any directory of your website. For example: ipset directory
$ iblocklist2ipset generate --ipset pythontab "http://www.pythontab.com/ipset/pythontab.txt" > pythontab.txt
After running the above command, you will get a file named pythontab.txt. If you view its contents, you will see something like this:
create pythontab hash:net family inet hashsize 131072 maxelem 237302 add pythontab 1.2.4.0/24 add pythontab 1.2.8.0/24 add pythontab 1.9.75.8/32 add pythontab 1.9.96.105/32 add pythontab 1.9.102.251/32 add pythontab 1.9.189.65/32
You can load this file with the following ipset command:
$ ipset restore -f pythontab.txt
You can now view the automatically created IP set:
$ ipset list pythontab
This saves you the trouble of manual management.
Note that the version installed using yum under centos is not the latest version. It may not support the -f parameter and import the blacklist file, so it is recommended to use the source code package to install the latest versionThe above is the detailed content of Case study on how to block malicious IP addresses in batches to prevent attacks under Linux. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

AI Hentai Generator
Generate AI Hentai for free.

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics



Linux is suitable for servers, development environments, and embedded systems. 1. As a server operating system, Linux is stable and efficient, and is often used to deploy high-concurrency applications. 2. As a development environment, Linux provides efficient command line tools and package management systems to improve development efficiency. 3. In embedded systems, Linux is lightweight and customizable, suitable for environments with limited resources.

The steps to start Apache are as follows: Install Apache (command: sudo apt-get install apache2 or download it from the official website) Start Apache (Linux: sudo systemctl start apache2; Windows: Right-click the "Apache2.4" service and select "Start") Check whether it has been started (Linux: sudo systemctl status apache2; Windows: Check the status of the "Apache2.4" service in the service manager) Enable boot automatically (optional, Linux: sudo systemctl

When the Apache 80 port is occupied, the solution is as follows: find out the process that occupies the port and close it. Check the firewall settings to make sure Apache is not blocked. If the above method does not work, please reconfigure Apache to use a different port. Restart the Apache service.

This article describes how to effectively monitor the SSL performance of Nginx servers on Debian systems. We will use NginxExporter to export Nginx status data to Prometheus and then visually display it through Grafana. Step 1: Configuring Nginx First, we need to enable the stub_status module in the Nginx configuration file to obtain the status information of Nginx. Add the following snippet in your Nginx configuration file (usually located in /etc/nginx/nginx.conf or its include file): location/nginx_status{stub_status

The steps to start an Oracle listener are as follows: Check the listener status (using the lsnrctl status command) For Windows, start the "TNS Listener" service in Oracle Services Manager For Linux and Unix, use the lsnrctl start command to start the listener run the lsnrctl status command to verify that the listener is started

This article introduces two methods of configuring a recycling bin in a Debian system: a graphical interface and a command line. Method 1: Use the Nautilus graphical interface to open the file manager: Find and start the Nautilus file manager (usually called "File") in the desktop or application menu. Find the Recycle Bin: Look for the Recycle Bin folder in the left navigation bar. If it is not found, try clicking "Other Location" or "Computer" to search. Configure Recycle Bin properties: Right-click "Recycle Bin" and select "Properties". In the Properties window, you can adjust the following settings: Maximum Size: Limit the disk space available in the Recycle Bin. Retention time: Set the preservation before the file is automatically deleted in the recycling bin

To restart the Apache server, follow these steps: Linux/macOS: Run sudo systemctl restart apache2. Windows: Run net stop Apache2.4 and then net start Apache2.4. Run netstat -a | findstr 80 to check the server status.

In Debian systems, readdir system calls are used to read directory contents. If its performance is not good, try the following optimization strategy: Simplify the number of directory files: Split large directories into multiple small directories as much as possible, reducing the number of items processed per readdir call. Enable directory content caching: build a cache mechanism, update the cache regularly or when directory content changes, and reduce frequent calls to readdir. Memory caches (such as Memcached or Redis) or local caches (such as files or databases) can be considered. Adopt efficient data structure: If you implement directory traversal by yourself, select more efficient data structures (such as hash tables instead of linear search) to store and access directory information
