#!/usr/bin/env python
#_*_coding:utf-8_*_
'''
python deny_dns_allip.py your_filelog_name
动态获取dns日志的IP地址，把不满足条件的都drop掉
此脚本修改后可以动态拒绝任何日志内的IP
相当于 tail -f filename | awk -F "你的条件" ，然后 把结果输送到iptables -I INPUT -s %s -j DROP
'''
from sys import argv
import collections
import time,os,re
o = open(argv[1], 'r')
print(''.join(collections.deque(o, 5)).strip('\n')) # last 5 lines
o.seek(0,2) # jump to last line 

ip_list = []
while 1: line = o.readline() if not line: time.sleep(0.1) continue ret = line.strip('\n')try:#正则的条件，根据该字段获取该字段的IPip = str(ret.split("query: hoffmeister.be IN ANY +E")[0])ipstr = re.search('\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}',ip).group()#排除部分IP，排除172网段124网段211网段，根据需要自己定义exclude_ips = str(ipstr.split(".")[0])allow_ips = ['172','124','211']#
        #print("ip_list:",ip_list)if ipstr not in ip_list and exclude_ips not in allow_ips:ip_list.append(ipstr)#取最新的IP，然后drop掉print("======>>i:",ip_list[-1])os.system("iptables -I INPUT -s %s -j DROP"%(ip_list[-1]))print("iptables -I INPUT -s %s -j DROP"%(ip_list[-1]))else:passexcept:b=None

# -*- coding: utf-8 -*-
import requests,osdef checkip(ip):URL = 'http://ip.taobao.com/service/getIpInfo.php'try:r = requests.get(URL, params=ip, timeout=2)except requests.RequestException as e:#passprint(e)else:json_data = r.json()if json_data[u'code'] == 0:#print "ipvalues",type(ip.values())ret = json_data[u'data'][u'country'].encode('utf-8') + str(ip.values())#print retcountry = json_data[u'data'][u'country'].encode('utf-8')if country != '中国':ret_ip = ip.values()[0]print "---------------country and ip",country, ret_ipos.system("iptables -I INPUT -s %s -j DROP"%(ret_ip))print("iptables -I INPUT -s %s -j DROP"%(ret_ip))else:print"----china",ip.values()[0]#return json_data[u'data'][u'country'].encode('utf-8') + str(ip.values())#print '所在地区： ' + json_data[u'data'][u'area'].encode('utf-8')#print '所在省份： ' + json_data[u'data'][u'region'].encode('utf-8')#print '所在城市： ' + json_data[u'data'][u'city'].encode('utf-8')#print '所属运营商：' + json_data[u'data'][u'isp'].encode('utf-8')else:#passprint '查询失败,请稍后再试！'#ip= {'ip':'67.177.203.45'}
#checkip(ip)

#!/usr/bin/env python
#_*_coding:utf-8_*_from sys import argv
import collections
import time,os,re
import ip_checko = open(argv[1], 'r')
print(''.join(collections.deque(o, 5)).strip('\n')) # last 5 lines
o.seek(0,2) # jump to last line 

ip_list = []
while 1: line = o.readline() if not line: time.sleep(2) continue ret = line.strip('\n')try:ip = str(ret.split("query: hoffmeister.be IN ANY +E")[0])ipstr = re.search('\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}',ip).group()#
        exclude_ips = str(ipstr.split(".")[0])allow_ips = ['172','124','211']#
        #print("ip_list:",ip_list)if ipstr not in ip_list and exclude_ips not in allow_ips:ip_list.append(ipstr)print("======>>i:",ip_list[-1])#f = open('ip.txt','a+')#f.write(ip_list[-1]+'\n')#f.close()check_ips = {'ip':ip_list[-1]}ip_check.checkip(check_ips)else:passexcept:b=None

[root@localhost var]# ls
log  named  run  tmp
[root@localhost var]# cd log/
[root@localhost log]# ls
den_txt_ip.py          deny_dns_ip.py  ip-check.txt  query.log    query_log.10  query_log.13  query_log.16  query_log.2  query_log.5  query_log.8  test.log
deny_dns_allip.py      ip_check.py     ip.txt        query_log.0  query_log.11  query_log.14  query_log.17  query_log.3  query_log.6  query_log.9  test.py
deny_dns_allip.py.bak  ip_check.pyc    query_log     query_log.1  query_log.12  query_log.15  query_log.18  query_log.4  query_log.7  read_ip.py
[root@localhost log]# pwd
/var/named/chroot/var/log
[root@localhost log]# ps -ef |grep "named"
root       518     1  0 Jun22 ?        00:00:04 named -d 1
named     4400     1  2 11:20 ?        00:06:47 /usr/sbin/named -u named -t /var/named/chroot
root     29940 26031  0 15:47 pts/8    00:00:00 grep named
root     32069     1  0 Jun22 ?        00:00:01 named -d 1

logging {  /*指定服务器日志记录的内容和日志信息来源*/  channel "default_syslog" {  syslog daemon; /* 发送给syslog 的daemon facility */  severity info; /* 只发送此优先级和更高优先级的信息 */  };  channel default_debug {  file "data/named.run"; /* 写入工作目录下的named.run 文件。注意：如果服务器用-f 参数启动，则"named.run"会被stderr 所替换。*/  severity dynamic; /*  按照服务器当前的debug 级别记录日志 */  };  channel xfer_in_log {  file "/var/log/named/xfer_in_log" versions 100 size 10m;  severity info;  print-category yes;  print-severity yes;  print-time yes;  };  channel xfer_out_log {  file "/var/log/named/xfer_out_log" versions 100 size 10m;  severity info;  print-category yes;  print-severity yes;  print-time yes;  };  channel notify_log {  file "/var/log/named/notify_log" versions 100 size 10m;  severity info;  print-category yes;  print-severity yes;  print-time yes;  };  channel general_log {  file "/var/log/named/general_log" versions 400 size 100m;  severity info;  print-category yes;  print-severity yes;  print-time yes;  };  channel default_log {  file "/var/log/named/default_log" versions 400 size 100m;  severity info;  print-category yes;  print-severity yes;  print-time yes;  };  channel update_log {  file "/var/log/named/update_log" versions 100 size 10m;  severity info;  print-category yes;  print-severity yes;  print-time yes;  };  channel query_log {  file "/var/log/query_log" versions 1024 size 100m;  severity info;  print-category no;  print-severity no;  print-time yes;  };  category queries { query_log; };  category default { default_log; };  category general { general_log; };  category xfer-in { xfer_in_log; };  category xfer-out { xfer_out_log; };  category notify { notify_log; };  category update { update_log; };
};