Compare commits
6 Commits
4aa0d3eac7
...
dev
| Author | SHA1 | Date | |
|---|---|---|---|
| f2ac486d24 | |||
| ab10389228 | |||
| 99893d8c3d | |||
| 6f25fb3672 | |||
| 967922012c | |||
| d8f7c47faa |
19
README.md
19
README.md
@@ -90,22 +90,20 @@ May 22 2024 15:05:59 Compile、link.
|
||||
配置文件
|
||||
global {
|
||||
|
||||
DAEMON = "off"; // on开启后台运行,off不开启(弃用)
|
||||
DAEMON = "off"; // on开启后台运行,off不开启
|
||||
TIME = "1"; // 睡眠时间(大于等于1,单位秒)
|
||||
|
||||
PUBLIC_IP = "http://inet-ip.info"; // 获取公网IP
|
||||
PUBLIC_IP = "http://inet-ip.aixiao.me/"; // 获取公网IP
|
||||
|
||||
IS_DISK = 1; // 磁盘使用率(1开启,非1关闭)
|
||||
DISK_USE = 50; // 任意某块磁盘使用率告警(大于等于1)
|
||||
|
||||
IS_BLOCKED = 1; // 是否封禁攻击IP(1开启,非1关闭)
|
||||
|
||||
IS_MAIL = 0; // 开启邮件告警(1开启,非1关闭)
|
||||
|
||||
CLAMAV = 1; // clamav 是否扫描病毒(1开启,非1关闭)
|
||||
CLAMAV_ARG = "-r / --exclude-dir=^/sys|^/dev|^/proc|^/opt/infected|^/root|^/home|^/mnt|^/usr|^/var --move=/opt/infected --max-filesize 1024M -l clamscan.log";
|
||||
CLAMAV_ARG = "-r / --exclude-dir=^/sys|^/dev|^/proc|^/opt/infected|^/root|^/home --move=/opt/infected --max-filesize 1024M -l clamscan.log";
|
||||
CLAMAV_TIME = "* 45 11 * * *"; // clamav 扫描时间(Cron格式, 秒 分 时 天 月 周)
|
||||
|
||||
IS_BLOCKED = 1; // 是否封禁攻击IP(1开启,非1关闭)
|
||||
|
||||
IPV4_RESTRICTION = 1; // 是否启用IP白名单(1开启,非1关闭)
|
||||
IPV4_WHITE_LIST = "1.1.1.1 2.2.2.2 "; // IP白名单(空格隔开)
|
||||
|
||||
@@ -114,15 +112,14 @@ global {
|
||||
REGION_LIST = "河南 郑州 上海"; // 地域列表(空格隔开)
|
||||
|
||||
NGINX = 1; // 是否启用Nginx白名单
|
||||
#NGINX_LOG_FILE= "/var/log/nginx/access.log"; // Nginx 日志文件
|
||||
NGINX_LOG_FILE= "/opt/nginx/logs/access.log"; // Nginx 日志文件
|
||||
NGINX_LOG_FILE= "/usr/local/nginx/logs/access.log"; // Nginx 日志文件
|
||||
NGINX_REGION_LIST = "中国 河南 郑州 上海 内网"; // 地域列表(空格隔开)
|
||||
|
||||
IS_DING_WEBHOOK = 1; // 开启叮叮告警(1开启,非1关闭)
|
||||
IS_DING_WEBHOOK = 0; // 开启叮叮告警(1开启,非1关闭)
|
||||
PHONE = "15565979082"; // @的人手机号
|
||||
DING_WEBHOOK = "https://oapi.dingtalk.com/robot/send?access_token=396bce0384cded025087cff3c176ea5e9afb9bd8fcaa46d6fa8c51dd172ba513"; // 钉钉WEBHOOK
|
||||
|
||||
IS_QQMAIL = 1; // 开启QQ邮箱告警(默认使用gomail: https://git.aixiao.me/aixiao/gomail.git)(1开启,非1关闭)
|
||||
IS_MAIL = 0; // 开启QQ邮箱告警(默认使用gomail: https://git.aixiao.me/aixiao/gomail.git)(1开启,非1关闭)
|
||||
RECV_MAIL = "1605227279@qq.com"; // 接收者邮箱
|
||||
}
|
||||
|
||||
|
||||
@@ -1 +1 @@
|
||||
{"rustc_fingerprint":5376818386984183904,"outputs":{"14371922958718593042":{"success":true,"status":"","code":0,"stdout":"___\nlib___.rlib\nlib___.so\nlib___.so\nlib___.a\nlib___.so\n/usr\noff\npacked\nunpacked\n___\ndebug_assertions\npanic=\"unwind\"\nproc_macro\ntarget_arch=\"x86_64\"\ntarget_endian=\"little\"\ntarget_env=\"gnu\"\ntarget_family=\"unix\"\ntarget_feature=\"fxsr\"\ntarget_feature=\"sse\"\ntarget_feature=\"sse2\"\ntarget_has_atomic=\"16\"\ntarget_has_atomic=\"32\"\ntarget_has_atomic=\"64\"\ntarget_has_atomic=\"8\"\ntarget_has_atomic=\"ptr\"\ntarget_os=\"linux\"\ntarget_pointer_width=\"64\"\ntarget_vendor=\"unknown\"\nunix\n","stderr":""},"4614504638168534921":{"success":true,"status":"","code":0,"stdout":"rustc 1.71.1\nbinary: rustc\ncommit-hash: unknown\ncommit-date: unknown\nhost: x86_64-unknown-linux-gnu\nrelease: 1.71.1\nLLVM version: 16.0.6\n","stderr":""},"15729799797837862367":{"success":true,"status":"","code":0,"stdout":"___\nlib___.rlib\nlib___.so\nlib___.so\nlib___.a\nlib___.so\n/usr\noff\npacked\nunpacked\n___\ndebug_assertions\npanic=\"unwind\"\nproc_macro\ntarget_arch=\"x86_64\"\ntarget_endian=\"little\"\ntarget_env=\"gnu\"\ntarget_family=\"unix\"\ntarget_feature=\"fxsr\"\ntarget_feature=\"sse\"\ntarget_feature=\"sse2\"\ntarget_has_atomic=\"16\"\ntarget_has_atomic=\"32\"\ntarget_has_atomic=\"64\"\ntarget_has_atomic=\"8\"\ntarget_has_atomic=\"ptr\"\ntarget_os=\"linux\"\ntarget_pointer_width=\"64\"\ntarget_vendor=\"unknown\"\nunix\n","stderr":""}},"successes":{}}
|
||||
{"rustc_fingerprint":14922234637089372062,"outputs":{"14371922958718593042":{"success":true,"status":"","code":0,"stdout":"___\nlib___.rlib\nlib___.so\nlib___.so\nlib___.a\nlib___.so\n/usr\noff\npacked\nunpacked\n___\ndebug_assertions\npanic=\"unwind\"\nproc_macro\ntarget_abi=\"\"\ntarget_arch=\"x86_64\"\ntarget_endian=\"little\"\ntarget_env=\"gnu\"\ntarget_family=\"unix\"\ntarget_feature=\"fxsr\"\ntarget_feature=\"sse\"\ntarget_feature=\"sse2\"\ntarget_has_atomic=\"16\"\ntarget_has_atomic=\"32\"\ntarget_has_atomic=\"64\"\ntarget_has_atomic=\"8\"\ntarget_has_atomic=\"ptr\"\ntarget_os=\"linux\"\ntarget_pointer_width=\"64\"\ntarget_vendor=\"unknown\"\nunix\n","stderr":""},"15729799797837862367":{"success":true,"status":"","code":0,"stdout":"___\nlib___.rlib\nlib___.so\nlib___.so\nlib___.a\nlib___.so\n/usr\noff\npacked\nunpacked\n___\ndebug_assertions\npanic=\"unwind\"\nproc_macro\ntarget_abi=\"\"\ntarget_arch=\"x86_64\"\ntarget_endian=\"little\"\ntarget_env=\"gnu\"\ntarget_family=\"unix\"\ntarget_feature=\"fxsr\"\ntarget_feature=\"sse\"\ntarget_feature=\"sse2\"\ntarget_has_atomic=\"16\"\ntarget_has_atomic=\"32\"\ntarget_has_atomic=\"64\"\ntarget_has_atomic=\"8\"\ntarget_has_atomic=\"ptr\"\ntarget_os=\"linux\"\ntarget_pointer_width=\"64\"\ntarget_vendor=\"unknown\"\nunix\n","stderr":""},"4614504638168534921":{"success":true,"status":"","code":0,"stdout":"rustc 1.79.0\nbinary: rustc\ncommit-hash: unknown\ncommit-date: unknown\nhost: x86_64-unknown-linux-gnu\nrelease: 1.79.0\nLLVM version: 17.0.6\n","stderr":""}},"successes":{}}
|
||||
48
conf.c
48
conf.c
@@ -120,11 +120,6 @@ static void parse_global_module(char *content, conf * conf)
|
||||
return;
|
||||
}
|
||||
|
||||
if (strcasecmp(var, "IS_QQMAIL") == 0) {
|
||||
val_begin_len = val_end - val_begin;
|
||||
conf->IS_QQMAIL = atoi(val_begin);
|
||||
}
|
||||
|
||||
if (strcasecmp(var, "RECV_MAIL") == 0) {
|
||||
val_begin_len = val_end - val_begin;
|
||||
if (copy_new_mem(val_begin, val_begin_len, &conf->RECV_MAIL) != 0)
|
||||
@@ -277,31 +272,29 @@ void read_conf(char *filename, conf * configure)
|
||||
|
||||
void free_conf(conf * conf)
|
||||
{
|
||||
if (conf->DAEMON)
|
||||
free(conf->DAEMON);
|
||||
if (conf->PHONE)
|
||||
if (conf->PHONE != NULL)
|
||||
free(conf->PHONE);
|
||||
if (conf->DING_WEBHOOK)
|
||||
if (conf->DING_WEBHOOK != NULL)
|
||||
free(conf->DING_WEBHOOK);
|
||||
if (conf->RECV_MAIL)
|
||||
if (conf->RECV_MAIL != NULL)
|
||||
free(conf->RECV_MAIL);
|
||||
if (conf->PUBLIC_IP)
|
||||
if (conf->PUBLIC_IP != NULL)
|
||||
free(conf->PUBLIC_IP);
|
||||
if (conf->IPV4_WHITE_LIST)
|
||||
if (conf->IPV4_WHITE_LIST != NULL)
|
||||
free(conf->IPV4_WHITE_LIST);
|
||||
|
||||
if (conf->REGION_LIST)
|
||||
if (conf->REGION_LIST != NULL)
|
||||
free(conf->REGION_LIST);
|
||||
|
||||
if (conf->CLAMAV_TIME)
|
||||
if (conf->CLAMAV_TIME != NULL)
|
||||
free(conf->CLAMAV_TIME);
|
||||
if (conf->CLAMAV_ARG)
|
||||
if (conf->CLAMAV_ARG != NULL)
|
||||
free(conf->CLAMAV_ARG);
|
||||
|
||||
// NGINX
|
||||
if (conf->NGINX_LOG_FILE)
|
||||
if (conf->NGINX_LOG_FILE != NULL)
|
||||
free(conf->NGINX_LOG_FILE);
|
||||
if (conf->NGINX_REGION_LIST)
|
||||
if (conf->NGINX_REGION_LIST != NULL)
|
||||
free(conf->NGINX_REGION_LIST);
|
||||
|
||||
return;
|
||||
@@ -309,37 +302,36 @@ void free_conf(conf * conf)
|
||||
|
||||
void ptintf_conf(conf * conf)
|
||||
{
|
||||
if (conf->DAEMON)
|
||||
if (conf->DAEMON != NULL)
|
||||
printf("DAEMON %s\n", conf->DAEMON);
|
||||
printf("TIME %d\n", conf->TIME);
|
||||
|
||||
printf("IS_MAIL %d\n", conf->IS_MAIL);
|
||||
printf("IS_DING_WEBHOOK %d\n", conf->IS_DING_WEBHOOK);
|
||||
if (conf->PHONE)
|
||||
if (conf->PHONE != NULL)
|
||||
printf("PHONE %s\n", conf->PHONE);
|
||||
if (conf->DING_WEBHOOK)
|
||||
if (conf->DING_WEBHOOK != NULL)
|
||||
printf("DING_WEBHOOK %s\n", conf->DING_WEBHOOK);
|
||||
printf("IS_QQMAIL %d\n", conf->IS_QQMAIL);
|
||||
|
||||
if (conf->RECV_MAIL)
|
||||
if (conf->RECV_MAIL != NULL)
|
||||
printf("RECV_MAIL %s\n", conf->RECV_MAIL);
|
||||
if (conf->PUBLIC_IP)
|
||||
if (conf->PUBLIC_IP != NULL)
|
||||
printf("PUBLIC_IP %s\n", conf->PUBLIC_IP);
|
||||
|
||||
printf("IPV4_RESTRICTION %d\n", conf->IPV4_RESTRICTION);
|
||||
if (conf->IPV4_WHITE_LIST)
|
||||
if (conf->IPV4_WHITE_LIST != NULL)
|
||||
printf("IPV4_WHITE_LIST %s\n", conf->IPV4_WHITE_LIST);
|
||||
|
||||
printf("REGION %d\n", conf->REGION);
|
||||
if (conf->REGION_LIST)
|
||||
if (conf->REGION_LIST != NULL)
|
||||
printf("REGION_LIST %s\n", conf->REGION_LIST);
|
||||
|
||||
if (conf->CLAMAV_ARG)
|
||||
if (conf->CLAMAV_ARG != NULL)
|
||||
printf("CLAMAV_ARG %s %d\n", conf->CLAMAV_ARG, conf->CLAMAV_ARG_LEN);
|
||||
|
||||
// Nginx
|
||||
if (conf->NGINX_LOG_FILE)
|
||||
if (conf->NGINX_LOG_FILE != NULL)
|
||||
printf("CLAMAV_ARG %s %d\n", conf->NGINX_LOG_FILE, conf->NGINX_LOG_FILE_LEN);
|
||||
if (conf->NGINX_REGION_LIST)
|
||||
if (conf->NGINX_REGION_LIST != NULL)
|
||||
printf("CLAMAV_ARG %s %d\n", conf->NGINX_REGION_LIST, conf->NGINX_REGION_LIST_LEN);
|
||||
}
|
||||
|
||||
6
conf.h
6
conf.h
@@ -46,17 +46,13 @@ typedef struct CONF
|
||||
char *NGINX_REGION_LIST;
|
||||
int NGINX_REGION_LIST_LEN;
|
||||
|
||||
int IS_MAIL;
|
||||
|
||||
// 钉钉
|
||||
int IS_DING_WEBHOOK;
|
||||
char *PHONE;
|
||||
char *DING_WEBHOOK;
|
||||
|
||||
// 第三方邮箱
|
||||
int IS_QQMAIL;
|
||||
//char *SEND_QQ;
|
||||
//char *QQMAIL_KEY;
|
||||
int IS_MAIL;
|
||||
char *RECV_MAIL;
|
||||
} conf;
|
||||
|
||||
|
||||
4
nginx.c
4
nginx.c
@@ -58,10 +58,14 @@ static int Handle_IP(char *string, conf *config)
|
||||
//printf(RED "%s Nginx Ip Address: %s, 属于地域白名单: %s\n" COLOR_NONE, t, IP, area);
|
||||
} else {
|
||||
my_printf(RED "%s Nginx 封禁 Ip Address: %s, 地址: %s!!!\n" COLOR_NONE, t, IP, area);
|
||||
|
||||
nginx_iptc(IP);
|
||||
}
|
||||
}
|
||||
|
||||
if (t)
|
||||
free(t);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
2
rhost.c
2
rhost.c
@@ -496,7 +496,7 @@ DAEMON:
|
||||
virus_files = get_clamav_log("clamscan.log");
|
||||
|
||||
if (virus_files > 0) {
|
||||
if (conf->IS_QQMAIL == 1) {
|
||||
if (conf->IS_MAIL == 1) {
|
||||
QQ_mail_warning_Virus_files(public_ip, virus_files, conf);
|
||||
sleep(3);
|
||||
}
|
||||
|
||||
19
rhost.conf
19
rhost.conf
@@ -1,21 +1,19 @@
|
||||
global {
|
||||
|
||||
DAEMON = "off"; // on开启后台运行,off不开启(弃用)
|
||||
DAEMON = "off"; // on开启后台运行,off不开启
|
||||
TIME = "1"; // 睡眠时间(大于等于1,单位秒)
|
||||
|
||||
PUBLIC_IP = "http://inet-ip.info"; // 获取公网IP
|
||||
PUBLIC_IP = "http://inet-ip.aixiao.me/"; // 获取公网IP
|
||||
|
||||
IS_DISK = 1; // 磁盘使用率(1开启,非1关闭)
|
||||
DISK_USE = 50; // 任意某块磁盘使用率告警(大于等于1)
|
||||
|
||||
IS_BLOCKED = 1; // 是否封禁攻击IP(1开启,非1关闭)
|
||||
|
||||
IS_MAIL = 0; // 开启邮件告警(1开启,非1关闭)
|
||||
|
||||
CLAMAV = 1; // clamav 是否扫描病毒(1开启,非1关闭)
|
||||
CLAMAV_ARG = "-r / --exclude-dir=^/sys|^/dev|^/proc|^/opt/infected|^/root|^/home|^/mnt|^/usr|^/var --move=/opt/infected --max-filesize 1024M -l clamscan.log";
|
||||
CLAMAV_ARG = "-r / --exclude-dir=^/sys|^/dev|^/proc|^/opt/infected|^/root|^/home --move=/opt/infected --max-filesize 1024M -l clamscan.log";
|
||||
CLAMAV_TIME = "* 45 11 * * *"; // clamav 扫描时间(Cron格式, 秒 分 时 天 月 周)
|
||||
|
||||
IS_BLOCKED = 1; // 是否封禁攻击IP(1开启,非1关闭)
|
||||
|
||||
IPV4_RESTRICTION = 1; // 是否启用IP白名单(1开启,非1关闭)
|
||||
IPV4_WHITE_LIST = "1.1.1.1 2.2.2.2 "; // IP白名单(空格隔开)
|
||||
|
||||
@@ -24,14 +22,13 @@ global {
|
||||
REGION_LIST = "河南 郑州 上海"; // 地域列表(空格隔开)
|
||||
|
||||
NGINX = 1; // 是否启用Nginx白名单
|
||||
#NGINX_LOG_FILE= "/var/log/nginx/access.log"; // Nginx 日志文件
|
||||
NGINX_LOG_FILE= "/opt/nginx/logs/access.log"; // Nginx 日志文件
|
||||
NGINX_LOG_FILE= "/usr/local/nginx/logs/access.log"; // Nginx 日志文件
|
||||
NGINX_REGION_LIST = "中国 河南 郑州 上海 内网"; // 地域列表(空格隔开)
|
||||
|
||||
IS_DING_WEBHOOK = 1; // 开启叮叮告警(1开启,非1关闭)
|
||||
IS_DING_WEBHOOK = 0; // 开启叮叮告警(1开启,非1关闭)
|
||||
PHONE = "15565979082"; // @的人手机号
|
||||
DING_WEBHOOK = "https://oapi.dingtalk.com/robot/send?access_token=396bce0384cded025087cff3c176ea5e9afb9bd8fcaa46d6fa8c51dd172ba513"; // 钉钉WEBHOOK
|
||||
|
||||
IS_QQMAIL = 1; // 开启QQ邮箱告警(默认使用gomail: https://git.aixiao.me/aixiao/gomail.git)(1开启,非1关闭)
|
||||
IS_MAIL = 0; // 开启QQ邮箱告警(默认使用gomail: https://git.aixiao.me/aixiao/gomail.git)(1开启,非1关闭)
|
||||
RECV_MAIL = "1605227279@qq.com"; // 接收者邮箱
|
||||
}
|
||||
|
||||
9
rhost.h
9
rhost.h
@@ -54,14 +54,5 @@ typedef struct now_next_time
|
||||
#define WHITELIST_IP_NUM 1024
|
||||
#define BUILD(fmt...) do { fprintf(stderr,"%s %s ",__DATE__,__TIME__); fprintf(stderr, ##fmt); } while(0)
|
||||
|
||||
#define AWK " | awk -v num=%d '{a[$1]+=1;} END {for(i in a){if (a[i] >= num) {print i;}}}' "
|
||||
#define GE_10 "grep -E \"^$(LC_ALL=\"C\" date \"+%h\").$(LC_ALL=\"C\" date \"+%d\")\" /var/log/auth.log | grep failure | grep rhost"
|
||||
#define LE_10 "grep -E \"^$(LC_ALL=\"C\" date \"+%h\")..$(LC_ALL=\"C\" date | awk '{print $3}')\" /var/log/auth.log | grep failure | grep rhost"
|
||||
|
||||
#define CENTOS_GE_10 "grep -E \"^$(LC_ALL=\"C\" date \"+%h\").$(LC_ALL=\"C\" date \"+%d\")\" /var/log/secure | grep failure | grep rhost"
|
||||
#define CENTOS_LE_10 "grep -E \"^$(LC_ALL=\"C\" date \"+%h\")..$(LC_ALL=\"C\" date | awk '{print $3}')\" /var/log/secure | grep failure | grep rhost"
|
||||
|
||||
|
||||
|
||||
|
||||
#endif
|
||||
|
||||
4
rule.c
4
rule.c
@@ -33,7 +33,6 @@ static int Handle_IP(conf *conf, char *ip)
|
||||
|
||||
if (conf->REGION == 1) {
|
||||
if (conf->IP2REGION == 1) {
|
||||
//printf("%s Use ip2region !!!\n", t);
|
||||
|
||||
if (access(xdb_path, F_OK) == -1) {
|
||||
xdb_path = "ip2region/ip2region.xdb";
|
||||
@@ -67,6 +66,9 @@ BLOCKED:
|
||||
if (area != NULL) {
|
||||
free(area);
|
||||
}
|
||||
|
||||
if (t)
|
||||
free(t);
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
Reference in New Issue
Block a user