DDOS ve Spam saldırılarına karşı şöyle özel bir script buldum kardeşim.Bu kodları include edilebilen bir dosyaya include edip gerekli yerleri doldurman ve FTP'de firewall_logs diye bir klasör oluşturarak chmod izinlerini 777 vermen yeterlidir.
İyi günler , iyi forumlar.
Kod:
<?php
########################################################
########### www.ayna.pro ###############################
########### PHP FIREWALL ###############################
########################################################
$conf = array();
# Ayarlamalar #####################################################################
$conf['path'] = $_SERVER["DOCUMENT_ROOT"].'/firewall_logs'; // Logların kayıt edileceği klasor chmod 777 olmalıdır.
$conf['mailadds'] = '[email protected]'; // Webmaster E-Posta adresiniz. Uyarı mesajında çıkar.
$conf['mailname'] = 'Webmaster Email'; // Mail Görüntü Adı.
$conf['maxaccess'] = 5; // Bir ip nin Max. Bağlantı Sayısı
$conf['interval'] = 10; // Zaman aşımında gereksinimlerin tutulması saniye cinsinden.
$conf['requests'] = 25; // 1 Dakika içersinde gezilebilecek max. bağlantı sayısı
$conf['blocktime'] = 100; // Banlanma süresi saniye cinsinden...
# Ayarlamalar #####################################################################
$conf['now'] = time();
$conf['addr'] = fetch_ip();
$conf['save_log'] = $conf['addr'].' - '.$_SERVER['HTTP_USER_AGENT'].' - '.get_gmdate($conf['now']).' - "'.$_SERVER['REQUEST_METHOD'].' '.fetch_url().' '.$_SERVER['SERVER_PROTOCOL'].'"'."\r\n";
# Başlangıç
check_spam($conf['path'].'/spamips.txt', $conf['save_log']);
$bot_safe = check_bot();
if( ! $_GET['adsess'] || ! $bot_safe )
{
check_attack($conf['path'].'/attackips.txt', $conf['save_log']);
check_flood($conf['path'].'/'.$conf['addr']);
}
function check_bot()
{
# Arama motoru botları
$apps[] = 'googlebot'; // Google
$apps[] = 'mediapartners-google'; // Google Adsense
$apps[] = 'yahoo! slurp'; // Yahoo
$apps[] = 'yahoo-mm'; // Yahoo-MMCrawler/Yahoo-MMAudVid
$apps[] = 'slurp@inktomi'; // Hot Bot
$apps[] = 'lycos'; // Lycos
$apps[] = 'fast-webcrawler'; // Fast AllTheWeb
$apps[] = 'msnbot'; // MSN Search
$apps[] = 'ask jeeves'; // Ask Jeeves
$apps[] = 'teoma'; // Teoma
$apps[] = 'scooter'; // Altavista
$apps[] = 'ia_archiver'; // Archive.org
$apps[] = 'almaden'; // IBM Almaden Web Crawler
$apps[] = 'gigabot'; // Gigabot spider
$apps[] = 'whatuseek'; // What You Seek
# Http istek aparatları
$apps[] = 'w3c_validator';
$apps[] = 'wdg_validator';
$apps[] = 'libwww-perl';
$apps[] = 'jakarta commons-httpclient';
$apps[] = 'python-urllib';
for( $i = 0; $i <= count($apps); $i++ )
{
if( stristr($_SERVER['HTTP_USER_AGENT'], $apps[$i]) ) return TRUE;
}
}
function check_spam($path,$log)
{
$apps = array('CherryPicker','Crescent','DDoSkit','EmailCollector','EmailSiphon','EmailWolf','ExtractorPro','FileHound','Mozilla/3.Mozilla/2.01','NICErsPRO','Wget','Whacker');
for( $i = 0; $i <= count($apps); $i++ )
{
if( stristr($_SERVER['HTTP_USER_AGENT'], $apps[$i]) )
{
check_log($path, 'a', $log);
exit();
}
}
}
function check_attack($path,$log)
{
$input = strtolower($_SERVER['QUERY_STRING']);
$array = array('alter','create','drop','rename','delete%20','handler','load%20data','replace','select','join','union','truncate','describe','lock%20tables','grant','revoke','set%20password','flush','kill','shutdown','distinct','having','procedure','order%20by','group%20by','exec');
$return = str_replace($array, "", $input);
if( $input != $return )
{
check_log($path, 'a', $log);
print_error("Your activities have been banned.");
}
}
function check_flood($path)
{
global $conf;
$pass = 0;
# Kontrol
$blocktime = check_log($path.'.lock','rb');
if( $blocktime == 'banned' )
{
print_error("IP Address <font color='red'>{$conf['addr']}</font> Yasaklandi.<br />Lutfen yoneticiye mail atiniz. <br />to <a href='mailto:{$conf['mailadds']}'>{$conf['mailname']}</a> .");
}
elseif( $blocktime > 0 )
{
if( ( $conf['now'] - $blocktime ) <= $conf['blocktime'] )
{
print_error("Gercek olmayan hareketlenme tespiti!<br /><font color='red'>{$conf['blocktime']} Saniye Bekleyiniz...</font> (Bekleme Sureniz : ".($conf['now'] - $blocktime)." saniye).");
}
else
{
$pass = 1;
check_log($path.'.lock');
}
}
# Log IP
$content = check_log($path,'rb');
if( $content )
{
$content = preg_replace("/,$/", "", $content);
if( substr_count($content, ',') >= ( $conf['requests'] + 1 ) )
{
$pass = 1;
$count = 0;
$cache = explode(',', $content);
for( $i = 1; $i <= count($cache); $i++ )
{
if( ( $cache[$i] - $cache[$i-1] ) <= $conf['interval'] ) $count++;
}
if( $count >= $conf['requests'] )
{
# Atak sayısı kontrolü
$log_file = $conf['path'].'/floodips.txt';
$floodips = check_log($log_file,'rb');
$floodips = preg_replace("/,$/", "", $floodips);
if( substr_count($floodips, $conf['addr']) <= $conf['maxaccess'] )
{
check_log($path.'.lock', 'w', $conf['now']);
check_log($log_file, 'a', $conf['save_log']);
}
else
{
check_log($path.'.lock', 'w', 'banned');
exit();
}
}
}
else
{
$pass = 0;
}
}
if( $pass )
{
check_log($path);
}
else
{
check_log($path, 'a', $conf['now'].',');
}
}
function check_log($path,$mode='w',$str='')
{
$buffer = '';
if( $FH = @fopen($path, $mode) )
{
if( $mode == 'rb' )
{
while( ! @feof($FH) )
{
$buffer .= @fgets($FH, 1024);
}
}
else
{
@fwrite($FH, $str);
}
@fclose($FH);
@chmod($path, 0777);
}
return $buffer;
}
function fetch_ip()
{
# X_FORWARDED_FOR IP Aktivasyon
$do_check = 0;
$addrs = array();
if( $do_check )
{
foreach( array_reverse(explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'])) as $x_f )
{
$x_f = trim($x_f);
if( preg_match('/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/', $x_f) )
{
$addrs[] = $x_f;
}
}
$addrs[] = $_SERVER['HTTP_CLIENT_IP'];
$addrs[] = $_SERVER['HTTP_PROXY_USER'];
}
$addrs[] = $_SERVER['REMOTE_ADDR'];
foreach( $addrs as $v )
{
if( $v )
{
preg_match("/^([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$/", $v, $match);
$ip = $match[1].'.'.$match[2].'.'.$match[3].'.'.$match[4];
if( $ip && $ip != '...' )
{
break;
}
}
}
if( ! $ip || $ip == '...' )
{
print_error("ip adresinde bir bilinmezlik var?.");
}
return $ip;
}
function fetch_url()
{
if( $_SERVER['REQUEST_URI'] || $_ENV['REQUEST_URI'] )
{
$url = $_SERVER['REQUEST_URI'] ? $_SERVER['REQUEST_URI'] : $_ENV['REQUEST_URI'];
}
else
{
if( $_SERVER['PATH_INFO'] || $_ENV['PATH_INFO'] )
{
$url = $_SERVER['PATH_INFO'] ? $_SERVER['PATH_INFO'] : $_ENV['PATH_INFO'];
}
elseif( $_SERVER['REDIRECT_URL'] || $_ENV['REDIRECT_URL'] )
{
$url = $_SERVER['REDIRECT_URL'] ? $_SERVER['REDIRECT_URL'] : $_ENV['REDIRECT_URL'];
}
else
{
$url = $_SERVER['PHP_SELF'] ? $_SERVER['PHP_SELF'] : $_ENV['PHP_SELF'];
}
if( $_SERVER['QUERY_STRING'] || $_ENV['QUERY_STRING'] )
{
$url .= '?'.( $_SERVER['QUERY_STRING'] ? $_SERVER['QUERY_STRING'] : $_ENV['QUERY_STRING'] );
}
}
$url = preg_replace('/s=[a-z0-9]{32}?&?/', '', $url);
$url = preg_replace('/&(?!#[0-9]+;)/si', '&', $url);
$url = str_replace(array('<','>','"'), array('<','>','"'), $url);
$url = preg_replace(array('#javascript#i','#vbscript#i'), array('java script','vb script'), $url);
return $url;
}
function get_gmdate($time="")
{
$offset = 1 * 3600; // GMT+01:00
$timenow = $time ? $time : time();
return gmdate("D d-M-Y H:i:s A", ($timenow + $offset));
}
function print_error($msg)
{
echo "
<html>
<head><title>Karantina Bolgesi</title>
<style type='text/css'>
html{ overflow-x:auto; }
body{ background:#FFF; color:#222; font-family:Arial, Verdana, Tahoma, Times New Roman, Courier; font-size:11px; line-height:135%; margin:0; padding:0; text-align:center; }
a:link, a:visited, a:active{ background:transparent; color:#0066CC; text-decoration:none; }
a:hover{ background:transparent; color:#000000; text-decoration:underline; }
#wrapper{ margin:5px auto 20px auto; text-align:left; width:80%; }
.borderwrap{ background:#FFF; border:1px solid #EEE; padding:3px; margin:0; }
.borderwrap p{ background:#F9F9F9; border:1px solid #CCC; margin:5px; padding:10px; text-align:left; }
.warnbox{ border:1px solid #F00; background:#FFE0E0; padding:6px; margin-right:1%; margin-left:1%; text-align:left; }
</style>
<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />
</head>
<body>
<div id='wrapper'><br /><br />
<div class='borderwrap'>
<p style='font-size:15pt; color:#FF3300;'><b>Uyari:</b></p><br /><br />
<div class='warnbox'>
<b>$msg</b>
</div><br />
</div><br />
<div align='center' style='border:1px solid #EEE; padding:5px 0px 5px 5px; color:#808080; font-face:Tahoma;'><b>PHP Firewall</b> © ".date('Y')." <b> ayna.pro </b></div>
</div>
</body>
</html>";
exit();
}
?>İyi günler , iyi forumlar.