使用Python定时从Nginx的日志中获取黑客的ip并加入访问黑名单

import re
import subprocess
from datetime import datetime

# 日志文件和黑名单文件路径
NGINX_LOG_FILE = '/var/log/nginx/access.log'
BLACKLIST_FILE = '/etc/nginx/includes/blackListIp.conf'

# 正则表达式匹配含十六进制特殊字符的请求
HEX_PATTERN = re.compile(r'\\x[0-9A-Fa-f]{2}')
IP_PATTERN = re.compile(r'(\d{1,3}\.){3}\d{1,3}')

def extract_suspicious_ips(log_file):
    """从Nginx日志中提取可疑的IP地址"""
    suspicious_ips = set()
    with open(log_file, 'r') as file:
        for line in file:
            # 检查行中是否包含特殊十六进制字符
            if HEX_PATTERN.search(line):
                # 提取IP地址
                match = IP_PATTERN.search(line)
                if match:
                    ip_address = match.group(0)
                    suspicious_ips.add(ip_address)
    return suspicious_ips

def update_blacklist(blacklist_file, suspicious_ips):
    """更新黑名单文件，添加新的可疑IP"""
    # 读取现有的黑名单文件
    existing_ips = set()
    with open(blacklist_file, 'r') as file:
        for line in file:
            ip_match = IP_PATTERN.search(line)
            if ip_match:
                existing_ips.add(ip_match.group(0))

    # 计算新的IP列表
    new_ips = suspicious_ips - existing_ips
    if not new_ips:
        print(f"{datetime.now()}: 没有新的可疑IP需要添加。")
        return False

    # 将新的IP写入黑名单文件
    with open(blacklist_file, 'a') as file:
        for ip in new_ips:
            file.write(f"deny {ip};\n")

    print(f"{datetime.now()}: 添加新的可疑IP到黑名单: {', '.join(new_ips)}")
    return True

def reload_nginx():
    """重新加载Nginx配置"""
    try:
        subprocess.run(['nginx', '-s', 'reload'], check=True)
        print(f"{datetime.now()}: 成功重新加载Nginx配置。")
    except subprocess.CalledProcessError:
        print(f"{datetime.now()}: 重新加载Nginx配置失败。")

def main():
    suspicious_ips = extract_suspicious_ips(NGINX_LOG_FILE)
    if update_blacklist(BLACKLIST_FILE, suspicious_ips):
        reload_nginx()

if __name__ == "__main__":
    main()

# 编辑crontab
crontab -e

# 添加以下行，每小时运行脚本
0 * * * * /usr/bin/python3 /home/pythontools/script.py