moinmoin에 계정 생성을 지속적으로 하는 그 아이피 차단하는 스크립트

block_moin_ddos.sh

#!/usr/local/bin/bash
patterns+='?action=newaccount '

access_file='/usr/local/www/wiki/.htaccess'

ips_tmp=`mktemp`
trap 'on_exit; exit' SIGINT SIGQUIT EXIT

function on_exit(){
	rm -f $ips_tmp
}

for pattern in $patterns; do
	grep "$pattern" /var/log/httpd-access.log | awk '{print $1}' | awk '{print $1"."$2"."$4}' FS=. >> $ips_tmp
done

ips=`sort $ips_tmp | uniq | tr '\n' ' '`

if [ -w $access_file ]; then
	cat > $access_file <<EOF
	Order deny,allow
	Deny from $ips
EOF
fi