#!/usr/bin/perl

use POSIX qw/strftime/;

$| = 1;

$output = `/root/antiddos/parse.sh`;

print strftime("%F %T\n", localtime);

#print "Netstat Data:\n";
#print $output;

open(RD, "/root/antiddos/ban.txt");
while(<RD>){ chomp;
    $heh{"$_"} = 1;
};
close(RD);

# debug
if (0) {
    print "Banned list:\n";
    for $ip (sort keys %heh) {
        print $ip."\n";
    };
};

print "Do action:\n";
@data = split("\n",$output);
foreach $line (@data) {
    ($num, $ip) = split(" ", $line);
    if ($heh{"$ip"} == 1) {
        print "\t$num $ip (already banned)\n";
        next;
    };
    print "\t$num $ip\n";
    if ($num > 20) {
        $run_cmd = "/sbin/iptables -A INPUT -s $ip -j DROP";
        system($run_cmd);
        system("echo $ip >> /root/antiddos/ban.txt");
        print $run_cmd."\n";
        print "$ip banned.\n";
    };
};
sleep(1);

# ok

#!/bin/bash

tail -1000 /var/log/nginx/access.log | grep 'wp-login.php' | awk '{print $1}' | sort | uniq -c | sort -n