CloudFlare自动根据系统负载情况开关的五秒盾防御DDoS攻击脚本-实测有效

#!/bin/bash

# $1 = 1min, $2 = 5min, $3 = 15min，这里选择使用哪个负载值为阈值。
loadavg=$(awk '{printf "%f", $1}' < /proc/loadavg)

# Linux系统负载（load average）达到10即开启五秒盾，您可以根据情况来修改这个数值。
maxload=10

# 配置 Cloudflare 的API
# 您 CloudFlare 的Global API Key (https://dash.cloudflare.com/profile)
api_key=
# 您 CloudFlare 账号邮箱
email=
# 您 CloudFlare 账号的**区域 ID** (https://dash.cloudflare.com/_zone-id_/domain.com)
zone_id=
# 没有攻击时CloudFlare的默认安全级别
default_security_level=high
# 是否将调试消息写入脚本目录下的 debug.log 文件
debug=0

basedir=$(dirname "$0")

attacked_file=$basedir/attacked

[ "$debug" -eq 1 ] && exec > "${logfile:-$basedir/debug.log}"


# 您可以就地放置上述配置值，也可以将其放置在脚本目录中名为“config”的文件中。
config_file=$basedir/config
[ -e "$config_file" ] && source "$config_file"

api_set_mode() {
    local mode
    mode=$1
    curl -s -X PATCH "https://api.cloudflare.com/client/v4/zones/$zone_id/settings/security_level" \
        -H "X-Auth-Email: $email" \
        -H "X-Auth-Key: $api_key" \
        -H "Content-Type: application/json" \
        --data "{\"value\":\"$mode\"}" \
    || echo "Error: failed to set security level to $mode"
}

# 如果不存在则创建文件“attacked”
if [ ! -e "$attacked_file" ]; then
    echo 0 > "$attacked_file"
fi

was_under_attack=$(cat "$attacked_file")
under_attack=$(echo "$loadavg > $maxload" | bc)

if [[ "$1" != [01] ]]; then
    echo "Incorrect usage! Please pass either 0 or 1 as an argument"
    exit 1
fi

if [ $debug -eq 1 ]; then
    echo "Mode: $1; was under attack: $was_under_attack; now under attack: $under_attack"
    echo "Load average: $loadavg"
fi

if [ "$1" -eq 0 ] && [ "$was_under_attack" -eq 0 ] && [ "$under_attack" -eq 1 ]; then
    # attack just started and we want to enable under-attack mode

    # Activate protection
    [ "$debug" -eq 1 ] && echo "Activating under-attack mode!"
    echo 1 > "$attacked_file"
    api_set_mode under_attack

elif [ "$1" -eq 1 ] && [ "$was_under_attack" -eq 1 ] && [ "$under_attack" -eq 0 ]; then
    # attack just finished (and up to 20 minutes passed since) 
    # and we want to disable under-attack mode

    # Disable Protection
    [ "$debug" -eq 1 ] && echo "Leaving under-attack mode!"
    echo 0 > "$attacked_file"
    api_set_mode "$default_security_level"

fi
exit 0

然后在crontab定时任务里添加这个脚本的执行定时计划即可：

*/1 * * * * /root/DDoS/Cloudflare.sh 0 # 如果未启用五秒盾保护，则每 1 分钟检查一次
*/20 * * * * /root/DDoS/Cloudflare.sh 1 # 每 20 分钟检查一次五秒盾保护是否已启用

本文来自投稿，不代表站三界导航立场，如若转载，请注明出处：https://www.zhansanjie.com/article/details/40179.html