沧州网站制作

服务器linux运维 Nginx Lua Redis防止CC攻击实现原理：同一个外网IP、同一个网址(ngx.var.request_uri)、同一个客户端(http_user_agent)在某一段时间(CCseconds)内访问某个网址(ngx.var.request_uri)超过指定次数(CCcount)，则禁止这个外网IP+同一个客户端(md5(IP+ngx.var.http_user_agent)访问这个网址(ngx.var.request_uri)一段时间(blackseconds)。   该脚本使用lua编写(依赖nginx+lua)，将信息写到redis(依赖redis.lua)。   Nginx lua模块安装   重新编译nginx，安装lua模块   pushd /root/oneinstack/src wget -c http://nginx.org/download/nginx-1.10.3.tar.gz wget -c http://mirrors.linuxeye.com/oneinstack/src/openssl-1.0.2k.tar.gz wget -c http://mirrors.linuxeye.com/oneinstack/src/pcre-8.39.tar.gz wget -c http://luajit.org/download/LuaJIT-2.0.4.tar.gz git clone https://github.com/simpl/ngx_devel_kit.git git clone https://github.com/openresty/lua-nginx-module.git tar xzf nginx-1.10.3.tar.gz tar xzf openssl-1.0.2k.tar.gz tar xzf pcre-8.39.tar.gz tar xzf LuaJIT-2.0.4.tar.gz pushd LuaJIT-2.0.4 make && make install popd pushd nginx-1.10.3 ./configure --prefix=/usr/local/nginx --user=www --group=www --with-http_stub_status_module --with-http_v2_module --with-http_ssl_module --with-http_gzip_static_module --with-http_realip_module --with-http_flv_module --with-http_mp4_module --with-openssl=../openssl-1.0.2k --with-pcre=../pcre-8.39 --with-pcre-jit --with-ld-opt=-ljemalloc --add-module=../lua-nginx-module --add-module=../ngx_devel_kit make mv /usr/local/nginx/sbin/nginx{,_bk} cp objs/nginx /usr/local/nginx/sbin nginx -t #检查语法 加载redis.lua   mkdir /usr/local/nginx/conf/lua cd /usr/local/nginx/conf/lua wget https://github.com/openresty/lua-resty-redis/raw/master/lib/resty/redis.lua 在/usr/local/nginx/conf/nginx.conf http { }中添加：   #the Nginx bundle: lua_package_path /usr/local/nginx/conf/lua/redis.lua;;; 防止CC规则waf.lua   将下面内容保存在/usr/local/nginx/conf/lua/waf.lua   local get_headers = ngx.req.get_headers local ua = ngx.var.http_user_agent local uri = ngx.var.request_uri local url = ngx.var.host .. uri local redis = require 'redis' local red = redis.new() local CCcount = 20 local CCseconds = 60 local RedisIP = '127.0.0.1' local RedisPORT = 6379 local blackseconds = 7200 if ua == nil then     ua = unknown end if (uri == /wp-admin.php) then     CCcount=20     CCseconds=60 end red:set_timeout(100) local ok, err = red.connect(red, RedisIP, RedisPORT) if ok then     red.connect(red, RedisIP, RedisPORT)     function getClientIp()         IP = ngx.req.get_headers()[X-Real-IP]         if IP == nil then             IP = ngx.req.get_headers()[x_forwarded_for]         end         if IP == nil then             IP  = ngx.var.remote_addr         end         if IP == nil then             IP  = unknown         end         return IP     end     local token = getClientIp() .. . .. ngx.md5(url .. ua)     local req = red:exists(token)     if req == 0 then         red:incr(token)         red:expire(token,CCseconds)     else         local times = tonumber(red:get(token))         if times >= CCcount then             local blackReq = red:exists(black. .. token)             if (blackReq == 0) then                 red:set(black. .. token,1)                 red:expire(black. .. token,blackseconds)                 red:expire(token,blackseconds)                 ngx.exit(503)             else                 ngx.exit(503)             end             return         else             red:incr(token)         end     end     return end Nginx虚拟主机加载waf.lua   在虚拟主机配置文件/usr/local/nginx/conf/vhost/oneinstack.com.conf   access_by_lua_file /usr/local/nginx/conf/lua/waf.lua; 测试   一分钟之内，一个页面快速点击20次以上，登录redis，看到black开通的key即被禁止访问（nginx 503）