当 IP 地址被禁止时，我如何检查被禁止的 IP 地址是否来自中国。如果是，则将其添加到永久禁止列表中。
我觉得这很好指导将被禁止的IP写入文件。
原因：我每天都会遭受大量来自中国的暴力攻击，值得庆幸的是，fail2ban 正在帮助限制这种攻击，尽管他们的攻击似乎越来越严重，而且他们只是在改变他们的 IP 地址。
或者如果有一个维护已知黑客 IP 地址的数据库就更好了。
示例 1
Hi,
The IP 60.169.78.77 has just been banned by Fail2Ban after
4 attempts against vsftpd.
Here are more information about 60.169.78.77:
% [whois.apnic.net node-7]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html
inetnum: 60.166.0.0 - 60.175.255.255
netname: CHINANET-AH
descr: CHINANET anhui province network
descr: China Telecom
descr: A12,Xin-Jie-Kou-Wai Street
descr: Beijing 100088
country: CN
admin-c: CH93-AP
tech-c: JW89-AP
mnt-by: APNIC-HM
mnt-routes: MAINT-CHINANET-AH
mnt-lower: MAINT-CHINANET-AH
status: ALLOCATED PORTABLE
changed: [email protected] 20040721
source: APNIC
person: Chinanet Hostmaster
nic-hdl: CH93-AP
e-mail: [email protected]
address: No.31 ,jingrong street,beijing
address: 100032
phone: +86-10-58501724
fax-no: +86-10-58501724
country: CN
changed: [email protected] 20070416
mnt-by: MAINT-CHINANET
source: APNIC
person: Jinneng Wang
address: 17/F, Postal Building No.120 Changjiang
address: Middle Road, Hefei, Anhui, China
country: CN
phone: +86-551-2659073
fax-no: +86-551-2659287
e-mail: [email protected]
nic-hdl: JW89-AP
mnt-by: MAINT-NEW
changed: [email protected] 19990818
source: APNIC
Regards,
Fail2Ban
示例 2
Hi,
The IP 60.169.78.81 has just been banned by Fail2Ban after
4 attempts against vsftpd.
Here are more information about 60.169.78.81:
% [whois.apnic.net node-6]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html
inetnum: 60.166.0.0 - 60.175.255.255
netname: CHINANET-AH
descr: CHINANET anhui province network
descr: China Telecom
descr: A12,Xin-Jie-Kou-Wai Street
descr: Beijing 100088
country: CN
admin-c: CH93-AP
tech-c: JW89-AP
mnt-by: APNIC-HM
mnt-routes: MAINT-CHINANET-AH
mnt-lower: MAINT-CHINANET-AH
status: ALLOCATED PORTABLE
changed: [email protected] 20040721
source: APNIC
person: Chinanet Hostmaster
nic-hdl: CH93-AP
e-mail: [email protected]
address: No.31 ,jingrong street,beijing
address: 100032
phone: +86-10-58501724
fax-no: +86-10-58501724
country: CN
changed: [email protected] 20070416
mnt-by: MAINT-CHINANET
source: APNIC
person: Jinneng Wang
address: 17/F, Postal Building No.120 Changjiang
address: Middle Road, Hefei, Anhui, China
country: CN
phone: +86-551-2659073
fax-no: +86-551-2659287
e-mail: [email protected]
nic-hdl: JW89-AP
mnt-by: MAINT-NEW
changed: [email protected] 19990818
source: APNIC
Regards,
Fail2Ban
示例 3
Hi,
The IP 222.133.244.99 has just been banned by Fail2Ban after
4 attempts against vsftpd.
Here are more information about 222.133.244.99:
% [whois.apnic.net node-6]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html
inetnum: 222.133.244.96 - 222.133.244.127
netname: LCZFFHQ
country: CN
descr: liaochenggovermentfanghuoqiang
admin-c: DS95-AP
tech-c: DS95-AP
status: ASSIGNED NON-PORTABLE
changed: [email protected] 20060122
mnt-by: MAINT-CNCGROUP-SD
source: APNIC
route: 222.132.0.0/14
descr: CNC Group CHINA169 Shandong Province Network
country: CN
origin: AS4837
mnt-by: MAINT-CNCGROUP-RR
changed: [email protected] 20060118
source: APNIC
person: Data Communication Bureau Shandong
nic-hdl: DS95-AP
e-mail: [email protected]
address: No.77 Jingsan Road,Jinan,Shandong,P.R.China
phone: +86-531-6052611
fax-no: +86-531-6052414
country: CN
changed: [email protected] 20050330
mnt-by: MAINT-CNCGROUP-SD
source: APNIC
Regards,
Fail2Ban
答案1
我建议不要使用 Whois 来实现这一点，而是使用可用的 GeoIP 数据库，例如http://www.maxmind.com/download/geoip/database/
大多数编程语言（如 PHP、Python、Perl 等）都有绑定，可以轻松解析这些格式。
如今，“黑客 IP”数据库已不再有任何意义，特别是由于：
- IPv4 IP 所有者频繁变更
- 由于僵尸网络广泛存在，IP 的所有权和使用权不明确
- 采用 IPv6（终于！）使第一个问题变得更糟，并且维护 2^128 个地址的数据库几乎是不可行的（即使它可能很稀疏）