nginx自动屏蔽扫描的ip

auto_block.sh

#!/bin/bash

line=1000
times=10
conf=/opt/nginx/conf/blockip.conf

tail /data/logs/nginx/access.log -n $line | \
grep -E '("status":"404"|"status":"302")' | jq -r '.remote_addr' | \
sort | uniq -c | \
awk '$1>$times{print "deny "$2 ";"}' >> $conf

deny=$(sort $conf | uniq -c | awk '{print "deny "$3}')
echo $deny | sed "s/; /;\n/g" > $conf

/usr/local/sbin/nginx -t || exit
/usr/bin/systemctl reload nginx