{"id":45616,"date":"2023-04-13T09:22:38","date_gmt":"2023-04-13T01:22:38","guid":{"rendered":"http:\/\/lrxjmw.cn\/?p=45616"},"modified":"2023-04-13T09:22:38","modified_gmt":"2023-04-13T01:22:38","slug":"nginx-deny-ip-access","status":"publish","type":"post","link":"https:\/\/lrxjmw.cn\/nginx-deny-ip-access.html","title":{"rendered":"\u63d0\u9632\u574f\u4eba\uff1aNginx \u62d2\u7edd\u6307\u5b9aIP\u8bbf\u95ee"},"content":{"rendered":"<table>\n<tbody>\n<tr>\n<td style=\"padding: 5px 12px; width: 25px; font-size: 22px; text-align: center; background: #E8E8E8; line-height: 30px; color: #999;\">\u5bfc\u8bfb<\/td>\n<td style=\"padding: 10px 10px 12px; line-height: 20px;\"><strong>\u95f2\u6765\u65e0\u4e8b\uff0c\u767b\u9646\u670d\u52a1\u5668\uff0c\u53d1\u73b0\u6709\u4e2aIP\u4e0d\u65ad\u7684\u731c\u6d4b\u8def\u5f84\u3001\u8bd5\u56fe\u5f80\u670d\u52a1\u5668\u4e0a\u4f20\u6587\u4ef6\uff08\u6728\u9a6c\uff09\u3002<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u4e8e\u662f\u67e5\u770b\u4e86\u4e4b\u524d\u7684\u65e5\u5fd7\uff0c\u65e0\u5948\u9119\u7ad9\u88ab\u653b\u51fb\u8005\u76ef\u4e0a\u4e86\uff0c\u4e0d\u65ad\u7684\u6709\u4e0d\u540c\u7684IP\u8bd5\u56fe\u4e0a\u4f20\u6728\u9a6c\u3002\u770b\u6765\u574f\u4eba\u8fd8\u662f\u6709\u7684\u3002\u7531\u4e8e\u4e0d\u60f3\u8ba9\u9119\u7ad9\u6ca6\u4e3a\u8089\u9e21\uff0c\u6240\u4ee5\u5c31\u60f3\u5199\u4e2a\u7b80\u5355\u7684\u811a\u672c\uff0c\u6765\u963b\u6b62\u653b\u51fb\u8005\u7684IP\u8bbf\u95ee\u3002<\/p>\n<p>\u653b\u51fb\u8005\uff1a<\/p>\n<pre>195.154.216.165 - - [28\/Nov\/2015:23:10:40 +0800] \"POST \/wp-content\/themes\/twentyten\/404.php HTTP\/1.1\" 404 27 \"http:\/\/www.z-dig.com\/11m.php\" \"Mozilla\/4.0 (compatible; MSIE 9.0; Windows NT 6.1)\" \"-\"\r\n195.154.216.165 - - [28\/Nov\/2015:23:10:40 +0800] \"POST \/wp-content\/themes\/twentythirteen\/404.php HTTP\/1.1\" 404 27 \"http:\/\/www.z-dig.com\/11m.php\" \"Mozilla\/4.0 (compatible; MSIE 9.0; Windows NT 6.1)\" \"-\"\r\n195.154.216.165 - - [28\/Nov\/2015:23:10:40 +0800] \"POST \/wp-content\/themes\/twentytwelve\/404.php HTTP\/1.1\" 404 27 \"http:\/\/www.z-dig.com\/11m.php\" \"Mozilla\/4.0 (compatible; MSIE 9.0; Windows NT 6.1)\" \"-\"\r\n195.154.216.165 - - [28\/Nov\/2015:23:10:40 +0800] \"POST \/wp-content\/uploads\/phptest.php HTTP\/1.1\" 404 27 \"http:\/\/www.z-dig.com\/11m.php\" \"Mozilla\/4.0 (compatible; MSIE 9.0; Windows NT 6.1)\" \"-\"\r\n195.154.216.165 - - [28\/Nov\/2015:23:10:41 +0800] \"POST \/xyr\/confings.asp HTTP\/1.1\" 404 1569 \"http:\/\/www.z-dig.com\/11m.php\" \"Mozilla\/4.0 (compatible; MSIE 9.0; Windows NT 6.1)\" \"-\"\r\n195.154.216.165 - - [28\/Nov\/2015:23:10:41 +0800] \"POST \/xz.asp;.jpg HTTP\/1.1\" 404 564 \"http:\/\/www.z-dig.com\/11m.php\" \"Mozilla\/4.0 (compatible; MSIE 9.0; Windows NT 6.1)\" \"-\"\r\n195.154.216.165 - - [28\/Nov\/2015:23:10:41 +0800] \"POST \/yanyu\/?q={${eval%28$_POST[u]%29}} HTTP\/1.1\" 404 1569 \"http:\/\/www.z-dig.com\/11m.php\" \"Mozilla\/4.0 (compatible; MSIE 9.0; Windows NT 6.1)\" \"-\"\r\n195.154.216.165 - - [28\/Nov\/2015:23:10:42 +0800] \"POST \/ztxxw\/Images\/images.asp HTTP\/1.1\" 404 1569 \"http:\/\/www.z-dig.com\/11m.php\" \"Mozilla\/4.0 (compatible; MSIE 9.0; Windows NT 6.1)\" \"-\"<\/pre>\n<pre>[root@z-dig www]# grep '195.154.216.165' 2015-11-28.access.log|wc -l\r\n\r\n[root@z-dig www]#<\/pre>\n<pre>[root@z-dig www]# curl ipinfo.io\/195.154.216.165;echo''\r\n{\r\n  \"ip\": \"195.154.216.165\",\r\n  \"hostname\": \"fr.07.gs\",\r\n  \"city\": \"\",\r\n  \"region\": \"\",\r\n  \"country\": \"FR\",\r\n  \"loc\": \"48.8600,2.3500\",\r\n  \"org\": \"AS12876 ONLINE S.A.S.\"\r\n}\r\n[root@z-dig www]#<\/pre>\n<p>\u6cd5\u56fd\u7684\u54e5\u4eec\u7adf\u7136\u8bd5\u4e86180\u591a\u6b21\uff01\u8f9b\u82e6\u4e86\u3002<\/p>\n<p>\u7528 shell \u548c\u5b9a\u65f6\u4efb\u52a1\u6765\u5b9e\u73b0\u5427\u3002&gt;_&lt;<\/p>\n<p>\u7f51\u7ad9\u8dd1\u5728 Nginx \u4e0a\uff0c\u6240\u4ee5\u53ef\u4ee5\u4f7f\u7528 Nginx \u7684 Deny \u6765\u62d2\u7edd\u653b\u51fb\u8005\u7684IP\u8bbf\u95ee\u3002<\/p>\n<p>\u90a3\u4e48\u601d\u8def\u5c31\u51fa\u6765\u4e86\uff0c\u5b9a\u671f(\u4e94\u5206\u949f\u6216\u5341\u5206\u949f)\u83b7\u53d6\u653b\u51fb\u8005\u7684IP\uff0c\u5c06IP\u653e\u5165\u5230\u9ed1\u540d\u5355(Nginx \u914d\u7f6e\u6587\u4ef6)\uff0c\u5e76 reload \u4f7f\u5176\u751f\u6548\u3002<\/p>\n<p>\u7531\u4e8e\u524d\u671f\u89c4\u5212\u7684\u6bd4\u8f83\u597d\uff0c\u7f51\u7ad9\u7684\u8bbf\u95ee\u65e5\u5fd7\u653e\u5728\u4e86\u4e00\u4e2a\u6307\u5b9a\u7684\u76ee\u5f55\uff0cNginx \u7684\u9519\u8bef\u65e5\u5fd7\u4e5f\u653e\u5728\u4e86\u4e00\u4e2a\u6307\u5b9a\u7684\u76ee\u5f55\u3002\u7f51\u7ad9\u7684\u8bbf\u95ee\u65e5\u5fd7\u6bcf\u65e5\u8fdb\u884c\u5207\u5272\u3002Nginx \u7684\u9519\u8bef\u65e5\u5fd7\u6ca1\u6709\u8fdb\u884c\u5207\u5272\u3002<\/p>\n<p>\u4e0b\u9762\u5c31\u662f\u6211\u7684\u601d\u8def\u548c\u64cd\u4f5c\u6b65\u9aa4\uff1a<\/p>\n<p>\u901a\u8fc7 Nginx \u7684\u9519\u8bef\u65e5\u5fd7(\u4e3a\u4ec0\u4e48\u4e0d\u4f7f\u7528\u8bbf\u95ee\u65e5\u5fd7)\u6765\u83b7\u53d6\u653b\u51fb\u8005\u7684IP\u3002\u4e4b\u524d\u6ca1\u6709\u5bf9 Nginx \u7684\u9519\u8bef\u65e5\u5fd7\u8fdb\u884c\u5b9a\u65f6\u5207\u5272\uff0c\u4e3a\u4e86\u65b9\u4fbf\u7edf\u8ba1\u653b\u51fb\u8005\u7684IP\u6240\u4ee5\uff0c\u7f16\u5199\u811a\u672c\u5e76\u52a0\u5165\u5b9a\u65f6\u4efb\u52a1\uff0c\u4f7f\u9519\u8bef\u65e5\u5fd7\u6bcf\u5c0f\u65f6\u5207\u5272\u4e00\u6b21\uff0c\u5e76\u4e14\u6bcf\u5c0f\u65f6\u5bf9\u9ed1\u540d\u5355\u6587\u4ef6\u8fdb\u884c\u6e05\u7a7a\u3002<\/p>\n<p>\u9519\u8bef\u65e5\u5fd7\u5207\u5272\u3001\u6e05\u7a7a\u9ed1\u540d\u5355\u811a\u672c:<\/p>\n<pre>[root@z-dig scripts]# cat rotate-nginx-error-logs.sh \r\n#!\/bin\/bash\r\n# Rotate nginx error logs and clean block ip 's configure file\r\n# Nginx pid file : \/application\/nginx\/logs\/nginx.pid\r\n# Nginx error logs directory : \/data\/logs\/nginx\r\n# Block Ip 's configure file : \/application\/nginx\/conf\/website\/blockip.conf \r\n# Default log name : error.log\r\n# Author : Mr.Zhou\r\n# E-mail : zhou@z-dig.com\r\n\r\nNGX_PID=\/application\/nginx\/logs\/nginx.pid\r\nNGINX_CMD=\/application\/nginx\/sbin\/nginx\r\nLOGS_DIR=\/data\/logs\/nginx\r\nLOG_NAME=error.log\r\nBLOCK_IP_FILE=\/application\/nginx\/conf\/website\/blockip.conf\r\n\r\ncd $LOGS_DIR &amp;&amp;\r\n\/usr\/bin\/rename $LOG_NAME $(\/bin\/date +%F-%H -d \"last hour\").$LOG_NAME $LOG_NAME &amp;&amp;\r\n\/bin\/kill -USR1 $(cat $NGX_PID)\r\n&gt;$BLOCK_IP_FILE &amp;&amp;\r\n$($NGINX_CMD -s reload)\r\n[root@z-dig scripts]#<\/pre>\n<p>\u83b7\u53d6\u653b\u51fb\u8005IP\u811a\u672c:<\/p>\n<p>\u8be5\u811a\u672c\u4ece Nginx \u7684\u9519\u8bef\u65e5\u5fd7\u4e2d\u7edf\u8ba1\u51fa\u8d85\u8fc720\u6b21\u8bd5\u56fe\u731c\u6d4b\u8def\u5f84\u6216\u4e0a\u4f20\u6587\u4ef6\u7684IP\uff0c\u5e76\u5c06\u8fd9\u4e9bIP\u52a0\u5165\u5230 Nginx \u7684\u914d\u7f6e\u6587\u4ef6\u3002\u82e5\u6709\u65b0\u589e\u52a0\u7684IP\u5219 reload Nginx \u4f7f\u914d\u7f6e\u6587\u4ef6\u751f\u6548\uff0c\u82e5\u6ca1\u6709\u65b0\u589eIP\u5219\u4e0d\u8fdb\u884creload\u3002<\/p>\n<pre>[root@z-dig scripts]# cat block-ip.sh \r\n#!\/bin\/bash\r\n# Author  : Mr.Zhou\r\n# Email   : zhou@z-dig.com\r\n# Website : http:\/\/www.z-dig.com\r\n# block ip\r\n\r\nERR_LOG=\/data\/logs\/nginx\/error.log\r\nBLOCK_IP_FILE=\/application\/nginx\/conf\/website\/blockip.conf\r\nBLOCKED_IP=\/dev\/shm\/blocked-ip.txt\r\nBLOCK_IP=\/dev\/shm\/block-ip.txt\r\nNGINX_CMD=\/application\/nginx\/sbin\/nginx\r\n\r\n\/bin\/cp $BLOCK_IP_FILE $BLOCKED_IP &amp;&amp;\r\n\/bin\/sed -nr 's#.*[^0-9](([0-9]+\\.){3}[0-9]+).*#\\1#p' $ERR_LOG |\/bin\/awk '{IP[$1]++}END{for (i in IP) print IP[i],i}'|\/bin\/awk '{if($1&gt;20)print \"deny \"$2\";\"}' &gt;$BLOCK_IP &amp;&amp;\r\n\/bin\/grep -v -f $BLOCK_IP_FILE $BLOCK_IP &gt;&gt;$BLOCK_IP_FILE &amp;&amp;\r\n$($NGINX_CMD -s reload)\r\n[root@z-dig scripts]#<\/pre>\n<p>\u5c06\u62d2\u7edd\u6307\u5b9aIP\u8bbf\u95ee\u7684\u914d\u7f6e\u6587\u4ef6(\u9ed1\u540d\u5355)\u5355\u72ec\u5b58\u653e\uff0c\u5e76\u5728 nginx \u4e3b\u914d\u7f6e\u6587\u4ef6\u4e2d include \u8fdb\u53bb\u3002<\/p>\n<pre>[root@z-dig conf]# grep blockip.conf nginx.conf\r\n  include website\/blockip.conf;\r\n[root@z-dig conf]#<\/pre>\n<p>blockip.conf \u6587\u4ef6\u683c\u5f0f\u5982\u4e0b:<\/p>\n<pre>[root@z-dig website]# cat blockip.conf \r\ndeny 195.154.211.220;\r\ndeny 195.154.188.28;\r\ndeny 195.154.188.186;\r\ndeny 180.97.106.161;\r\ndeny 180.97.106.162;\r\ndeny 180.97.106.36;\r\ndeny 195.154.180.69;\r\ndeny 195.154.211.26;\r\ndeny 221.229.166.247;\r\ndeny 180.97.106.37;\r\ndeny 195.154.216.164;\r\ndeny 195.154.216.165;\r\n[root@z-dig website]#<\/pre>\n<p>\u5c06\u811a\u672c\u653e\u5165\u5b9a\u65f6\u4efb\u52a1\u6267\u884c:<\/p>\n<p>\u6bcf\u5c0f\u65f6\u5bf9 Nginx \u7684\u9519\u8bef\u65e5\u5fd7\u8fdb\u884c\u5207\u5272\u5e76\u4e14\u6e05\u7a7a\u4e00\u6b21\u88ab\u62d2\u7edd\u8bbf\u95eeIP\u7684\u914d\u7f6e\u6587\u4ef6\uff0c\u82e5\u4e0d\u6e05\u7a7a\u7684\u8bdd\uff0c\u6b64IP\u5c06\u7ec8\u751f\u4e0d\u80fd\u8bbf\u95ee\uff0c\u82e5\u5b83\u518d\u6b21\u653b\u51fb\u5219\u4f1a\u518d\u6b21\u8fdb\u5165\u9ed1\u540d\u5355\uff0c&gt;_&lt;\u3002\u3000\u6e05\u7a7a\u547d\u4ee4\u653e\u5728\u4e86\u5207\u5272\u811a\u672c\u7684\u5c3e\u90e8\u3002<\/p>\n<p>\u53ef\u4ee5\u81ea\u5df1\u51b3\u5b9a\u7edf\u8ba1\u9891\u7387\uff0c\u6839\u636e\u6307\u5b9a\u7684\u9891\u7387\u6267\u884c\u811a\u672c\uff0c\u83b7\u53d6\u653b\u51fb\u8005\u7684IP\uff0c\u82e5\u6b64IP\u5df2\u7ecf\u5728\u9ed1\u540d\u5355\u4e2d\uff0c\u5219\u4f1a\u5ffd\u7565\u6389\uff08\u7531\u4e8e\u9519\u8bef\u65e5\u5fd7\u4e00\u5c0f\u65f6\u5207\u5272\u4e00\u6b21\uff0c\u6240\u4ee5\u5728\u4e00\u5c0f\u65f6\u5185\u4f1a\u51fa\u73b0\u91cd\u590d\u7684IP\uff09\u3002\u7136\u540e\u628a\u5269\u4e0b\u7684\u65b0\u653b\u51fb\u8005\u7684IP\u8ffd\u52a0\u5230\u9ed1\u540d\u5355\u3002\u5e76 reload Nginx \u3002\u82e5\u6ca1\u6709\u65b0\u589e\u7684\u653b\u51fb\u8005IP\u5219\u4ec0\u4e48\u90fd\u4e0d\u505a\u3002<\/p>\n<pre>[root@z-dig ~]# crontab -l\r\n# rotate nginx log everyday\r\n00 00 * * * \/bin\/bash \/application\/scripts\/rotate-nginx-logs.sh &amp;&gt;\/dev\/null\r\n# rotate nginx error log every hour and clean the block ip file\r\n00 *\/1 * * *  \/bin\/bash \/application\/scripts\/rotate-nginx-error-logs.sh &amp;&gt;\/dev\/null\r\n# check hacker's ip every ten minutes\r\n*\/10 * * * * \/bin\/bash \/application\/scripts\/block-ip.sh &amp;&gt;\/dev\/null\r\n[root@z-dig ~]#<\/pre>\n<p>\u4ee5\u4e0b\u662f\u811a\u672c\u8fd0\u884c\u4e00\u6bb5\u65f6\u95f4\u7684\u653b\u51fb\u8005IP<\/p>\n<pre>[root@z-dig ~]# cat \/application\/nginx\/conf\/website\/blockip.conf \r\ndeny 195.154.211.220;\r\ndeny 195.154.188.28;\r\ndeny 195.154.188.186;\r\ndeny 180.97.106.161;\r\ndeny 180.97.106.162;\r\ndeny 180.97.106.36;\r\ndeny 195.154.180.69;\r\ndeny 195.154.211.26;\r\ndeny 221.229.166.247;\r\ndeny 180.97.106.37;\r\ndeny 195.154.216.164;\r\ndeny 195.154.216.165;\r\n[root@z-dig ~]#<\/pre>\n<p>\u8fc7\u6bb5\u65f6\u95f4\uff0c\u518d\u5217\u51fa\u4e00\u4efd\u9ed1\u540d\u5355IP\uff0c\u770b\u662f\u5426\u6709\u53d8\u5316\u3002<\/p>\n<pre>[root@z-dig ~]# cat \/application\/nginx\/conf\/website\/blockip.conf \r\ndeny 195.154.188.224;\r\n[root@z-dig ~]# curl ipinfo.io\/195.154.188.224;echo ''\r\n{\r\n  \"ip\": \"195.154.188.224\",\r\n  \"hostname\": \"195-154-188-224.rev.poneytelecom.eu\",\r\n  \"city\": \"\",\r\n  \"region\": \"\",\r\n  \"country\": \"FR\",\r\n  \"loc\": \"48.8600,2.3500\",\r\n  \"org\": \"AS12876 ONLINE S.A.S.\"\r\n}\r\n[root@z-dig ~]# grep '195.154.188.224' \/data\/logs\/nginx\/error.log |wc -l\r\n\r\n[root@z-dig ~]# grep '195.154.188.224' \/data\/logs\/nginx\/error.log |grep -v 'access forbidden' |wc -l\r\n\r\n[root@z-dig ~]# \r\n[root@z-dig ~]# tail -n 1 \/data\/logs\/nginx\/error.log \r\n2015\/11\/30 10:47:53 [error] 30754#0: *37828 access forbidden by rule, client: 195.154.188.224, server: www.z-dig.com, request: \"GET \/ HTTP\/1.1\", host: \"www.z-dig.com\", referrer: \"http:\/\/www.z-dig.com\"\r\n[root@z-dig ~]#<\/pre>\n<p>\u770b\u6765\u591a\u5c11\u8fd8\u662f\u7ba1\u70b9\u7528\u7684\u3002\u4e00\u5171 access forbidden by rule \u4e86 102-24=78 \u6b21\u3002<\/p>\n<p>\u9002\u5f53\u7684\u6539\u6539\u811a\u672c\uff0c\u4fdd\u5b58\u9ed1\u540d\u5355\u7684\u5386\u53f2\u6570\u636e\uff0c\u5b9a\u671f\u5c06\u5927\u4e8e1000\u7684IP\u76f4\u63a5\u653e\u5165iptables\uff01<\/p>\n<blockquote>\n<p style=\"text-align: left; color: #88a6a4;\">\u539f\u6587\u6765\u81ea\uff1a<a href=\"http:\/\/www.ttlsa.com\/nginx\/nginx-deny-ip-access\/\" target=\"_blank\" rel=\"noopener\">http:\/\/www.ttlsa.com\/nginx\/nginx-deny-ip-access\/<\/a><\/p>\n<p style=\"text-align: left; color: #88a6a4;\">\u672c\u6587\u5730\u5740\uff1a<a href=\"http:\/\/lrxjmw.cn\/nginx-deny-ip-access.html\" target=\"_blank\" rel=\"noopener\">http:\/\/lrxjmw.cn\/nginx-deny-ip-access.html<\/a><span style=\"float: right;\">\u7f16\u8f91\uff1a\u6768\u9e4f\u98de\uff0c\u5ba1\u6838\u5458\uff1a\u5cb3\u56fd\u5e05<\/span><\/p>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":"<p>\u5bfc\u8bfb \u95f2\u6765\u65e0\u4e8b\uff0c\u767b\u9646\u670d\u52a1\u5668\uff0c\u53d1\u73b0\u6709\u4e2aIP\u4e0d\u65ad\u7684\u731c\u6d4b\u8def\u5f84\u3001\u8bd5\u56fe\u5f80\u670d\u52a1\u5668\u4e0a\u4f20\u6587\u4ef6\uff08\u6728\u9a6c\uff09\u3002 \u4e8e\u662f\u67e5\u770b\u4e86\u4e4b\u524d\u7684\u65e5\u5fd7\uff0c [&hellip;]<\/p>\n","protected":false},"author":63,"featured_media":43248,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[55],"tags":[],"class_list":["post-45616","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-thread"],"acf":[],"_links":{"self":[{"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/posts\/45616","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/users\/63"}],"replies":[{"embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/comments?post=45616"}],"version-history":[{"count":3,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/posts\/45616\/revisions"}],"predecessor-version":[{"id":269395,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/posts\/45616\/revisions\/269395"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/media\/43248"}],"wp:attachment":[{"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/media?parent=45616"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/categories?post=45616"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/tags?post=45616"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}