由于服务器最近遭受DOS攻击，笔者想到为自己的服务器设置自动黑名单屏蔽功能，实现方式如下：

1 安装OpenResty

由于需要使用lua语言处理nginx的HTTP链接，因此需要安装OpenResty，编译安装可从官网下载，然后执行以下程序进行编译安装：

./configure --prefix=/usr/local/openresty --user=www --group=www --error-log-path=/www/log/nginx-error.log --conf-path=/www/server/nginx/nginx.conf --with-http_stub_status_module
gmake
gmake install

2 配置环境

由于笔者之前使用的是原生nginx，因此需要重新配置环境，首先创建并打开/usr/lib/systemd/system/openresty.service文件，编辑后保存文件为以下内容：

[Unit]
Description=OpenResty Nginx Web Server
After=network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
PIDFile=/www/server/nginx/nginx.pid
ExecStart=/usr/local/openresty/bin/openresty
ExecReload=/usr/local/openresty/bin/openresty -s reload
ExecStop=/usr/local/openresty/bin/openresty -s stop
PrivateTmp=true

[Install]
WantedBy=multi-user.target

使用如下命令停止并删除原有的nginx：

systemctl disable nginx
rm -rf /usr/lib/systemd/system/nginx.service

最后，我们还需要改变环境的PATH变量，打开\etc\profile文件后，可见文件最后对环境变量的默认设置为：

export MYSQL_HOME=/usr/local/mysql
export NGINX_HOME=/usr/local/nginx
export PHP_HOME=/usr/local/php
export REDIS_HOME=/usr/local/redis
export ZABBIX_HOME=/usr/local/zabbix
export POSTFIX_HOME=/usr/local/postfix
export PATH=$PATH:$MYSQL_HOME/bin:$NGINX_HOME/sbin:$PHP_HOME/bin:$PHP_HOME/sbin:$REDIS_HOME/bin:$ZABBIX_HOME/bin:$ZABBIX_HOME/sbin:$POSTFIX_HOME/usr/bin:$POSTFIX_HOME/usr/sbin:$POSTFIX_HOME/libexec/postfix

将文件修改为以下内容：

export MYSQL_HOME=/usr/local/mysql
export OPENRESTY_HOME=/usr/local/openresty
export PHP_HOME=/usr/local/php
export REDIS_HOME=/usr/local/redis
export ZABBIX_HOME=/usr/local/zabbix
export POSTFIX_HOME=/usr/local/postfix
export PATH=$PATH:$MYSQL_HOME/bin:$OPENRESTY_HOME/bin:$PHP_HOME/bin:$PHP_HOME/sbin:$REDIS_HOME/bin:$ZABBIX_HOME/bin:$ZABBIX_HOME/sbin:$POSTFIX_HOME/usr/bin:$POSTFIX_HOME/usr/sbin:$POSTFIX_HOME/libexec/postfix

3 自动黑名单程序设置

我们需要写lua脚本，来完成自动黑名单的相关功能，我们需要下了解具体功能的流程图：

具体程序代码如下：

local redis_service = ngx.var.redis_service

local redis_port = tonumber(ngx.var.redis_port)

local redis_db = tonumber(ngx.var.redis_db)

local black_count = tonumber(ngx.var.black_count)

local black_rule_unit_time = tonumber(ngx.var.black_rule_unit_time)

local cache_ttl = tonumber(ngx.var.black_ttl)

local remote_ip = ngx.var.remote_addr

local redis_connect_timeout = 60

local redis = require "resty.redis"

local Redis = redis:new()

local auto_blacklist_key = ngx.var.auto_blacklist_key

Redis:set_timeout(redis_connect_timeout)

local RedisConnectOk,ReidsConnectErr = Redis:connect(redis_service,redis_port)

if not RedisConnectOk then
    ngx.log(ngx.ERR,"ip_blacklist connect Redis Error :" .. ReidsConnectErr)
else
    Redis:select(redis_db)
    local key = auto_blacklist_key..":"..remote_ip
    local Status = Redis:get(key)
    if Status ~= ngx.null then
        if Status == "Connect" then
            local key_connect_count = auto_blacklist_key..":key_connect_count:"..remote_ip
            local count = Redis:get(key_connect_count)
            if count ~= ngx.null then
                if tonumber(count) > black_count then
                    Redis:del(key_connect_count)
                    Redis:set(key,"Black")
                    Redis:expire(key,cache_ttl)
                else
                    Redis:set(key_connect_count,tonumber(count)+1)
                    Redis:expire(key_connect_count,black_rule_unit_time)
                end
            end
        elseif Status == "Black" then
            ngx.log(ngx.ERR,"The visit is blocked by the blacklist because it is too frequent. Please visit later.")
            return ngx.exit(ngx.HTTP_FORBIDDEN)
        end
    else
        local key_connect_count = auto_blacklist_key..":key_connect_count:"..remote_ip
        local count = Redis:get(key_connect_count)
        if count == ngx.null then
            Redis:del(key_connect_count)
        end
        Redis:set(key,"Connect")
        Redis:set(key_connect_count,1)
        Redis:expire(key,black_rule_unit_time)
        Redis:expire(key_connect_count,black_rule_unit_time)
    end
end

4 修改网页的vhost配置

程序写好了，还需要Nginx引擎去读，让这段脚本生效，因此，我们需创建一个/www/server/nginx/lua并创建一个/www/server/nginx/lua/ip_blacklist.lua，创建文件的命令如下：

mkdir /www/server/nginx/lua
vi ip_blacklist.lua

输入以上程序后保存文件，然后输入vi /www/server/nginx/blacklist_params指令创建blacklist_params文件，并输入以下内容：

set $redis_service "127.0.0.1";
set $redis_port 6379;
set $redis_db 0;
set $black_count 300;
set $black_rule_unit_time 1;
set $black_ttl 3600;

然后可以执行vi /www/server/nginx/vhost/qhjack.conf打开/www/server/nginx/vhost/qhjack.conf文件，可见文件内容如下：

server {
    listen 80 default_server;
    server_name qhjack.cn www.qhjack.cn;
    root /www/root/qhjack;
    index index.php index.html;
    limit_req zone=server burst=20 nodelay;
    limit_req_status 503;
    limit_req_log_level error;
    limit_rate 100k;
    location ~ \.php$ {
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME $document_root/$fastcgi_script_name;
        include        fastcgi_params;
    }
    charset utf-8;
    error_log /www/log/qhjack/error.log;
    access_log /www/log/qhjack/access.log;
    location / {
        if (-f $request_filename/index.html){
            rewrite (.*) $1/index.html break;
        }
        if (-f $request_filename/index.php){
            rewrite (.*) $1/index.php;
        }
        if (!-f $request_filename){
            rewrite (.*) /index.php;
        }
    }

    location ~* \.(jpg|jpeg|gif|png|ico|swf)$ {
        expires 3y;
        access_log off;
        gzip off;
    }

    location /robots.txt$ {
        allow all;
        log_not_found off;
        access_log off;
    }
}

修改为以下内容：

server {
    listen 80 default_server;
    server_name qhjack.cn www.qhjack.cn;
    root /www/root/qhjack;
    index index.php index.html;
    limit_req zone=server burst=20 nodelay;
    limit_req_status 503;
    limit_req_log_level error;
    limit_rate 100k;
    set $auto_blacklist_key "blacklist:qhjack";
    include blacklist_params;
    access_by_lua_file /www/server/nginx/lua/ip_blacklist.lua;
    location ~ \.php$ {
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME $document_root/$fastcgi_script_name;
        include        fastcgi_params;
    }
    charset utf-8;
    error_log /www/log/qhjack/error.log;
    access_log /www/log/qhjack/access.log;
    location / {
        if (-f $request_filename/index.html){
            rewrite (.*) $1/index.html break;
        }
        if (-f $request_filename/index.php){
            rewrite (.*) $1/index.php;
        }
        if (!-f $request_filename){
            rewrite (.*) /index.php;
        }
    }

    location ~* \.(jpg|jpeg|gif|png|ico|swf)$ {
        expires 3y;
        access_log off;
        gzip off;
    }

    location /robots.txt$ {
        allow all;
        log_not_found off;
        access_log off;
    }
}