基于 IP 的动态黑名单
各位，我们都知道 IP 黑名单不起作用 - 垃圾邮件发送者可以通过代理进入，此外，合法用户可能会受到影响...也就是说，在我看来，黑名单似乎是阻止持续攻击者的有效机制，因为实际的 IP 列表是根据应用程序的反馈和用户行为动态确定的。
例如： - 有人试图暴力破解您的登录屏幕 - 写得不好的机器人向您的网站发出非常奇怪的 HTTP 请求 - script-kiddie 使用扫描器来查找应用程序中的漏洞
我想知道以下机制是否有效，如果可以，您知道是否有任何工具可以做到这一点：
- 在 Web 应用程序中，开发人员有一个钩子报告“冒犯”。 一次违规行为可能很轻微（无效密码），需要数十次此类违规行为才会被列入黑名单； 或者可能是严重的，24 小时内出现几次这样的违规行为就会将您踢出局。
- 某种形式的网络服务器级块会在每个页面加载之前启动，并确定用户是否来自“不良”IP。
- 有一个内置的“宽恕”机制：一段时间后，攻击不再会计入 IP。
谢谢！
额外说明：如果解决方案能够在 PHP 中运行那就太棒了，但我很想听听您对任何语言/平台的总体方法的想法
Folks, we all know that IP blacklisting doesn't work - spammers can come in through a proxy, plus, legitimate users might get affected... That said, blacklisting seems to me to be an efficient mechanism to stop a persistent attacker, given that the actual list of IP's is determined dynamically, based on application's feedback and user behavior.
For example:
- someone trying to brute-force your login screen
- a poorly written bot issues very strange HTTP requests to your site
- a script-kiddie uses a scanner to look for vulnerabilities in your app
I'm wondering if the following mechanism would work, and if so, do you know if there are any tools that do it:
- In a web application, developer has a hook to report an "offense". An offense can be minor (invalid password) and it would take dozens of such offenses to get blacklisted; or it can be major, and a couple of such offenses in a 24-hour period kicks you out.
- Some form of a web-server-level block kicks in on before every page is loaded, and determines if the user comes from a "bad" IP.
- There's a "forgiveness" mechanism built-in: offenses no longer count against an IP after a while.
Thanks!
Extra note: it'd be awesome if the solution worked in PHP, but I'd love to hear your thoughts about the approach in general, for any language/platform
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
呃，这种系统很简单也很常见，我可以很容易地给你我的系统
，这里简单扼要地解释一下 http://www.alandoherty.net/info/webservers/
编写的脚本不可下载{因为当前未添加评论}，但请从上面的网站给我发一封电子邮件，我会将代码扔给您，并很乐意帮助您调试/调整它到您的服务器
err this sort of system is easy and common, i can give you mine easily enough
its simply and briefly explained here http://www.alandoherty.net/info/webservers/
the scripts as written arn't downloadable {as no commentry currently added} but drop me an e-mail, from the site above, and i'll fling the code at you and gladly help with debugging/taloring it to your server
你在 *nix 机器上吗？ 这种事情可能最好留给操作系统级别，使用类似 iptables
编辑
：回复评论，是的（有点）。 然而，我们的想法是 iptables 可以独立工作。 您可以设置一定的阈值来限制（例如，阻止端口 80 TCP 上超过 x 个请求/分钟的请求），并且这一切都是透明处理的（即，您的应用程序实际上不需要了解任何有关它的信息，发生动态阻塞）。
如果您可以完全控制该框，并且更愿意让您的防火墙处理节流，我建议您使用 iptables 方法（优点是，您不需要将此逻辑构建到您的 Web 应用程序中，并且它可以根据请求节省资源在它们到达您的网络服务器之前就被删除了）
否则，如果您预计阻塞不会是一个巨大的组件（或者您的应用程序是可移植的并且无法保证对 iptables 的访问），那么将该逻辑构建到您的应用程序中会更有意义。
are you on a *nix machine? this sort of thing is probably better left to the OS level, using something like iptables
edit:
in response to the comment, yes (sort of). however, the idea is that iptables can work independently. you can set a certain threshold to throttle (for example, block requests on port 80 TCP that exceed x requests/minute), and that is all handled transparently (ie, your application really doesn't need to know anything about it, to have dynamic blocking take place).
i would suggest the iptables method if you have full control of the box, and would prefer to let your firewall handle throttling (advantages are, you don't need to build this logic into your web app, and it can save resources as requests are dropped before they hit your webserver)
otherwise, if you expect blocking won't be a huge component, (or your app is portable and can't guarantee access to iptables), then it would make more sense to build that logic into your app.
我认为应该是用户名加IP地址的组合。 不仅仅是IP。
I think it should be a combination of user-name plus IP block. Not just IP.
您正在查看自定义锁定代码。 开源世界中的一些应用程序包含各种类型的此类代码。 也许您应该看看其中的一些，尽管您的要求非常微不足道，所以标记一个 IP/用户名组合，并利用它来阻止 IP X 时间。 （请注意，我说的是阻止 IP，而不是用户。用户可能会尝试通过有效的 IP/用户名/密码组合上网。）
事实上，您甚至可以保留用户登录的痕迹，以及从未知登录时的痕迹具有 3 次攻击的用户名/密码组合的 IP，可以将该 IP 锁定，无论您喜欢该用户名多久。 （请注意，许多 ISP 共享 IP，因此......）
您可能还希望在身份验证中设置延迟，以便 IP 不能在每“y”秒左右尝试登录多次。
you're looking at custom lockout code. There are applications in the open source world that contain various flavors of such code. Perhaps you should look at some of those, although your requirements are pretty trivial, so mark an IP/username combo, and utilize that for blocking an IP for x amount of time. (Note I said block the IP, not the user. The user may try to get online via a valid IP/username/pw combo.)
Matter of fact, you could even keep traces of user logins, and when logging in from an unknown IP with a 3 strikes bad username/pw combo, lock that IP out for however long you like for that username. (Do note that a lot of ISPs share IPs, thus....)
You might also want to place a delay in authentication, so that an IP cannot attempt a login more than once every 'y' seconds or so.
我为客户端开发了一个系统，该系统可以跟踪对 Web 服务器的点击，并在操作系统/防火墙级别动态禁止 IP 地址一段时间，以应对某些攻击，所以，是的，这绝对是可能的。 正如 Owen 所说，与 Web 服务器相比，防火墙规则是执行此类操作更好的地方。 （不幸的是，客户选择对此代码持有严格的版权，因此我无权分享它。）
我通常使用 Perl 而不是 PHP，但是，只要您的防火墙有一个命令行界面规则引擎（例如 /sbin/iptables），您应该能够通过任何能够执行系统命令的语言相当轻松地完成此操作。
I have developed a system for a client which kept track of hits against the web server and dynamically banned IP addresses at the operating system/firewall level for variable periods of time for certain offenses, so, yes, this is definitely possible. As Owen said, firewall rules are a much better place to do this sort of thing than in the web server. (Unfortunately, the client chose to hold a tight copyright on this code, so I am not at liberty to share it.)
I generally work in Perl rather than PHP, but, so long as you have a command-line interface to your firewall rules engine (like, say, /sbin/iptables), you should be able to do this fairly easily from any language which has the ability to execute system commands.
看看fail2ban。 一个 Python 框架，允许您从跟踪日志文件中引发 IP 表块以查找错误行为模式。
Take a look at fail2ban. A python framework that allows you to raise IP tables blocks from tailing log files for patterns of errant behaviour.