131 lines
4.9 KiB
Markdown
131 lines
4.9 KiB
Markdown
# denyhosts
|
|
|
|
- 拒绝主机&杀毒
|
|
|
|
```text
|
|
适用系统:
|
|
Debian 11、12
|
|
Centos 7
|
|
支持系统病毒扫描
|
|
支持一次运行检测、后台运行检测
|
|
支持钉钉告警和邮件告
|
|
支持第三方QQ邮箱告警
|
|
```
|
|
|
|
```text
|
|
Debian
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
|
|
apt -y install libclamav-dev libip4tc-dev libcurl4-openssl-dev #(或者libcurl4-gnutls-dev)
|
|
apt -y install libsystemd-dev libjson-c-dev libpcre2-dev clamav-freshclam
|
|
apt -y install libltdl-dev libmspack-dev
|
|
freshclam # 更新病毒库(必要)
|
|
|
|
|
|
Debian系统使用libiptc库需要nftables切换到iptables (使用了libip4tc-dev库)
|
|
Switching to the legacy version:(切换到 iptables)
|
|
update-alternatives --set iptables /usr/sbin/iptables-legacy
|
|
update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
|
|
update-alternatives --set arptables /usr/sbin/arptables-legacy
|
|
update-alternatives --set ebtables /usr/sbin/ebtables-legacy
|
|
```
|
|
|
|
```text
|
|
Centos 7
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
|
|
yum install clamav clamav-update clamav-lib clamav-devel json-c-devel pcre2-devel
|
|
yum install iptables-devel libcurl-devel
|
|
yum install systemd-devel libtool-ltdl-devel libmspack-devel
|
|
yum install cmake3
|
|
|
|
yum -y install centos-release-scl
|
|
yum -y install devtoolset-11-gcc
|
|
source /opt/rh/devtoolset-11/enable #临时
|
|
echo "source /opt/rh/devtoolset-11/enable" >> /etc/profile #永久
|
|
|
|
mv /etc/cron.d/clamav-update /root
|
|
sed -i "s/DatabaseMirror .*/DatabaseMirror clamavdb.c3sl.ufpr.br/g" /etc/freshclam.conf
|
|
freshclam # 更新病毒库(必要)
|
|
```
|
|
|
|
```text
|
|
用法
|
|
cd /root
|
|
git clone https://git.aixiao.me/aixiao/denyhosts
|
|
cd denyhosts
|
|
make clean
|
|
make all
|
|
或
|
|
bash build.sh
|
|
|
|
启动:
|
|
./rhost -d -r / --exclude-dir="^/sys|^/dev|^/proc|^/opt/infected|^/root|^/home" --move=/opt/infected --max-filesize 1024M -l clamscan.log # 用户指定参数,后台运行并扫描病毒
|
|
|
|
./rhost -d # 后台运行读取配置文件参数
|
|
|
|
./rhost # 只处理非法攻击
|
|
|
|
|
|
关闭:
|
|
killall rhost
|
|
|
|
|
|
帮助:
|
|
./rhost -h
|
|
Rhost Reject host&scan for viruses (Rhost 拒绝主机并扫描病毒)
|
|
Author: AIXIAO@AIXIAO.ME
|
|
Version: 1.0
|
|
Usage: [-?h] [-d]
|
|
|
|
Options:
|
|
-d : Background running
|
|
-? -h --help : help information
|
|
The configuration file needs to be in the same directory as the executable file!
|
|
配置文件需要与可执行文件位于同一目录中！
|
|
|
|
|
|
May 22 2024 15:05:59 Compile、link.
|
|
```
|
|
|
|
```text
|
|
配置文件
|
|
global {
|
|
|
|
DAEMON = "off"; // on开启后台运行,off不开启(弃用)
|
|
TIME = "1"; // 睡眠时间(大于等于1,单位秒)
|
|
|
|
PUBLIC_IP = "http://inet-ip.aixiao.me"; // 获取公网IP
|
|
|
|
IS_DISK = 1; // 磁盘使用率(1开启,非1关闭)
|
|
DISK_USE = 50; // 任意某块磁盘使用率告警(大于等于1)
|
|
|
|
IS_BLOCKED = 1; // 是否封禁攻击IP(1开启,非1关闭)
|
|
|
|
IS_MAIL = 0; // 开启邮件告警(1开启,非1关闭)
|
|
|
|
CLAMAV = 1; // clamav 是否扫描病毒(1开启,非1关闭)
|
|
CLAMAV_ARG = "-r / --exclude-dir=^/sys|^/dev|^/proc|^/opt/infected|^/root|^/home|^/mnt|^/usr|^/var --move=/opt/infected --max-filesize 1024M -l clamscan.log";
|
|
CLAMAV_TIME = "* 45 11 * * *"; // clamav 扫描时间(Cron格式, 秒 分 时 天 月 周)
|
|
|
|
IPV4_RESTRICTION = 1; // 是否启用IP白名单(1开启,非1关闭)
|
|
IPV4_WHITE_LIST = "1.1.1.1 2.2.2.2 "; // IP白名单(空格隔开)
|
|
|
|
REGION = 1; // 是否启用地域白名单(1开启,非1关闭)
|
|
IP2REGION = 1; // 是否使用本地 ip2region 地址定位库(1使用,非1不使用)
|
|
REGION_LIST = "河南 郑州 上海"; // 地域列表(空格隔开)
|
|
|
|
NGINX = 1; // 是否启用Nginx白名单
|
|
#NGINX_LOG_FILE= "/var/log/nginx/access.log"; // Nginx 日志文件
|
|
NGINX_LOG_FILE= "/opt/nginx/logs/access.log"; // Nginx 日志文件
|
|
NGINX_REGION_LIST = "中国 河南 郑州 上海 内网"; // 地域列表(空格隔开)
|
|
|
|
IS_DING_WEBHOOK = 1; // 开启叮叮告警(1开启,非1关闭)
|
|
PHONE = "15565979082"; // @的人手机号
|
|
DING_WEBHOOK = "https://oapi.dingtalk.com/robot/send?access_token=396bce0384cded025087cff3c176ea5e9afb9bd8fcaa46d6fa8c51dd172ba513"; // 钉钉WEBHOOK
|
|
|
|
IS_QQMAIL = 1; // 开启QQ邮箱告警(默认使用gomail: https://git.aixiao.me/aixiao/gomail.git)(1开启,非1关闭)
|
|
RECV_MAIL = "1605227279@qq.com"; // 接收者邮箱
|
|
}
|
|
|
|
```
|
|
|