自動添加並啟用IP黑名單

from pandas import *
import subprocess
from datetime import datetime,timedelta
import sys, os
import numpy as np

def wrt_csv(lines,fname):
  ip=[i.split()[0] for i in lines]
  tflag=[i.split()[3].replace('[','') for i in lines]
  dates=[i.split(':')[0] for i in tflag]
  df=DataFrame({'ip':ip,'time':tflag,'date':dates})
  pv=pivot_table(df,index=['ip','date'],values='time',aggfunc='count').reset_index()
  pvc=pivot_table(pv,index='ip',values='date',aggfunc='count').reset_index()
  pvs=pivot_table(pv,index='ip',values='time',aggfunc='sum').reset_index()
  pvsc=merge(pvc,pvs,on='ip')
  pvsc=pvsc.sort_values('time',ascending=False).reset_index(drop=True)
  pvsc['city']=[0 for i in range(len(pvsc))]
  for i in range(min(10,len(pvsc))):
    ii=pvsc.ip[i]
    lst=subprocess.check_output('curl -s ipinfo.io/'+ii+'\?token=TOKEN',shell=True).decode('utf8').split('\n')
    itm=[j.split('"')[1] for j in lst if len(j)>1]
    val=[j.split('"')[3] for j in lst if len(j)>1]
    dip={it:va for it,va in zip(itm,val)}
    pvsc.loc[i,'city']=dip['city']
  pvsc.set_index('ip').to_csv(fname)
  return 0
with open('/usr/local/var/log/httpd/access_log','r') as f:
  lines=[i for i in f]
fname='~/bin/BlockIP/IP_count.csv'
r=wrt_csv(lines,fname)

TF=(datetime.now()+timedelta(hours=0)).strftime("%d/%b/%Y:%H")
accfname='/usr/local/var/log/httpd/access_log'
lines=subprocess.check_output('/usr/bin/grep --color=never  "'+TF+'" '+accfname,shell=True).decode('utf8').split('\n')
lines=[i for i in lines if len(i)>1]
fname='~/bin/BlockIP/IP_count'+TF.replace('/','_')+'.csv'
r=wrt_csv(lines,fname)

#kuang@114-32-164-198 ~/bin/BlockIP
#$ cat ana_accHr.py
#!/opt/anaconda3/bin/python
from datetime import datetime,timedelta 
import subprocess
from pandas import *
import sys, os
import numpy as np

TF=(datetime.now()+timedelta(hours=-1)).strftime("%d/%b/%Y:%H")
accfname='/usr/local/var/log/httpd/access_log'
lines=subprocess.check_output('/usr/bin/grep --color=never  "'+TF+'" '+accfname,shell=True).decode('utf8').split('\n')
if len(lines)<=500:sys.exit('acc less than 500 times')
lip=[i.split()[0] for i in lines if len(i)>0]
sip=list(set(lip))
nip=np.array([lip.count(i) for i in sip])
mip=np.max(nip)
if mip>500:
  msg='tell app "System Events" to display dialog "Hourly acc >500 !!,tail /etc/pf.conf"'
  os.system("/usr/bin/osascript -e '"+msg+"'&")
  df=DataFrame({'ip':sip,'nm':nip})
  dfm=df.loc[df.nm>500]
  for i in dfm.ip:
    os.system('echo "block drop from any to '+i+'">>/etc/pf.conf')   
  os.system('pfctl -e -f /etc/pf.conf')

kuang@114-32-164-198 ~/bin/BlockIP
$ tail ana_accHr.py
  bname='/Users/kuang/bin/BlockIP/pf.blocked.ip.conf'
  msg='tell app "System Events" to display dialog "Hourly acc >500 !!,tail /etc/pf.conf"'
  os.system("/usr/bin/osascript -e '"+msg+"'&")
  df=DataFrame({'ip':sip,'nm':nip})
  dfm=df.loc[df.nm>500]
  for i in dfm.ip:
    nline=subprocess.check_output('grep '+i+' '+bname+'|wc -l',shell=True).decode('utf8').strip('\t').split()[0]
    if nline>0:continue
    os.system('echo '+i+'>>'+bname)
    
  os.system('/sbin/pfctl -ef /etc/pf.conf')