使用宝塔面板受到CC攻击后自动开启 Cloudflare 经典的 5 秒盾

1
#!/bin/bash
2

3
# --------------------------使用前修改以下配置值--------------------------
4

5
mode="load"
6
# 两种模式可选，一：load (负载) 二：cpu。建议选 load
7

8
challenge="1"
9
# 是否同时开启验证码质询 设为1即开启。建议开启
10

11
keeptime="180"
12
# ≈开盾最小时间，如60 则开盾60秒内负载降低不会关，60秒后关。建议值 180
13

14
interval="1"
15
# 检测间隔时间，默认0.5秒。建议设为1
16

17
email="눈_눈"
18
# CloudFlare 账号邮箱
19

20
api_key="눈_눈"
21
# CloudFlare API KEY
22

23
zone_id="눈_눈"
24
# 区域ID 在域名的概述页面获取
25

26
default_security_level="high"
27
# 默认安全等级 关闭UAM时将会把安全等级调整为它
28

29
check="6"
30
#自定义开盾阈值（非必需）。load模式建议设为CPU核心数 + 2，如4核则设为6。
31
#load模式填负载值 如:8  cpu模式填百分数值 如:90
32

33
# --------------------------下方无需修改--------------------------
34

35
api_url="https://api.cloudflare.com/client/v4/zones/$zone_id/settings/security_level"
36
# API的地址
37

38
api_url1="https://api.cloudflare.com/client/v4/zones/$zone_id/firewall/rules"
39
# API的地址之二
40

41
api_url2="https://api.cloudflare.com/client/v4/zones/$zone_id/filters"
42
# API的地址之三
43

44
# 安装依赖
45
if ! which jq &> /dev/null; then
46
    echo "jq not found!"
47
    if [[ -f "/usr/bin/apt-get" ]]; then
48
        apt-get install -y jq
49
    elif [[ -f "/usr/bin/dnf" ]]; then
50
        dnf install -y epel-release
51
        dnf install -y jq
52
    elif [[ -f "/usr/bin/yum" ]]; then
53
        yum install -y epel-release
54
        yum install -y jq
55
    fi
56
fi
57

58
for ((;;)); do
59
    if [[ "$mode" == "cpu" ]]; then
60
        check=${check:-90}
61
        #系统空闲时间
62
        TIME_INTERVAL=5
63
        time=$(date "+%Y-%m-%d %H:%M:%S")
64
        LAST_CPU_INFO=$(cat /proc/stat | grep -w cpu | awk '{print $2,$3,$4,$5,$6,$7,$8}')
65
        LAST_SYS_IDLE=$(echo $LAST_CPU_INFO | awk '{print $4}')
66
        LAST_TOTAL_CPU_T=$(echo $LAST_CPU_INFO | awk '{print $1+$2+$3+$4+$5+$6+$7}')
67
        sleep ${TIME_INTERVAL}
68
        NEXT_CPU_INFO=$(cat /proc/stat | grep -w cpu | awk '{print $2,$3,$4,$5,$6,$7,$8}')
69
        NEXT_SYS_IDLE=$(echo $NEXT_CPU_INFO | awk '{print $4}')
70
        NEXT_TOTAL_CPU_T=$(echo $NEXT_CPU_INFO | awk '{print $1+$2+$3+$4+$5+$6+$7}')
71

72
        #系统空闲时间
73
        SYSTEM_IDLE=$(echo ${NEXT_SYS_IDLE} ${LAST_SYS_IDLE} | awk '{print $1-$2}')
74
        #CPU总时间
75
        TOTAL_TIME=$(echo ${NEXT_TOTAL_CPU_T} ${LAST_TOTAL_CPU_T} | awk '{print $1-$2}')
76
        load=$(echo ${SYSTEM_IDLE} ${TOTAL_TIME} | awk '{printf "%.2f", 100-$1/$2*100}')
77
    else
78
        load=$(cat /proc/loadavg | colrm 5)
79
        check=${check:-$(cat /proc/cpuinfo | grep "processor" | wc -l)}
80
    fi
81

82
    if [[ ! -f "status.txt" ]]; then
83
        echo "" > status.txt
84
    else
85
        status=$(cat status.txt)
86
    fi
87

88
    if [[ -f "ruleid.txt" ]]; then
89
        ruleid=$(cat ruleid.txt)
90
    fi
91

92
    if [[ -f "filterid.txt" ]]; then
93
        filterid=$(cat filterid.txt)
94
    fi
95

96
    now=$(date +%s)
97
    time=$(date +%s -r status.txt)
98

99
    echo "当前$mode负载:$load"
100
    if [[ $status -eq 1 ]]; then
101
        echo "UAM ON!"
102
        if [[ "$challenge" -eq 1 ]]; then
103
            echo "Challenge ON!"
104
        fi
105
    else
106
        echo "UAM OFF!"
107
        if [[ "$challenge" -eq 1 ]]; then
108
            echo "Challenge OFF!"
109
        fi
110
    fi
111

112
    newtime=$(expr $now - $time)
113
    closetime=$(expr $keeptime - $newtime)
114

115
    if [[ $(awk 'BEGIN {print ('$load'<'$check') ? 1:0}') -eq 1 ]] && [[ $status -eq 1 ]] && [[ $newtime -gt $keeptime ]]; then
116
        echo -e "\n$mode负载低于$check，当前已开盾超过规定时间$newtime秒，尝试调整至默认安全等级（$default_security_level）"
117
        # Disable Under Attack Mode
118
        result=$(curl -X PATCH "$api_url" \
119
            -H "X-Auth-Email: $email" \
120
            -H "X-Auth-Key: $api_key" \
121
            -H "Content-Type: application/json" \
122
            --data "{
123
                \"value\": \"$default_security_level\"
124
            }" --silent \
125
        | jq -r '.success')
126
        if [[ "$result" = "true" ]]; then
127
            echo 0 > status.txt
128
            echo -e "\n成功"
129
        fi
130
        if [[ "$challenge" -eq 1 ]]; then
131
            result=$(curl -X DELETE "$api_url1/$ruleid" \
132
                -H "X-Auth-Email: $email" \
133
                -H "X-Auth-Key: $api_key" \
134
                -H "Content-Type: application/json" \
135
                --silent)
136
            result1=$(curl -X DELETE "$api_url2/$filterid" \
137
                -H "X-Auth-Email: $email" \
138
                -H "X-Auth-Key: $api_key" \
139
                -H "Content-Type: application/json" \
140
                --silent)
141
            if echo $result | jq -e '.success' && echo $result1 | jq -e '.success'; then
142
                echo -e "\n验证码关闭成功"
143
            fi
144
        fi
145
    elif [[ $(awk 'BEGIN {print ('$load'<'$check') ? 1:0}') -eq 1 ]]; then
146
        echo -e "\n$mode负载低于$check，不做任何改变，状态持续了$newtime秒"
147
        if [[ $status -eq 1 ]]; then
148
            echo -e "将于$closetime秒后调整安全等级至$default_security_level"
149
        fi
150
    elif [[ $(awk 'BEGIN {print ('$load'>'$check') ? 1:0}') -eq 1 ]] && [[ $status -eq 1 ]] && [[ $newtime -gt $keeptime ]]; then
151
        echo -e "\n$mode负载高于$check，当前已开启UAM超过$keeptime秒，UAM无效"
152
    elif [[ $(awk 'BEGIN {print ('$load'>'$check') ? 1:0}') -eq 1 ]] && [[ $status -eq 1 ]]; then
153
        echo -e "\n$mode负载高于$check，当前已开启($newtime秒)，请再观察"
154
    elif [[ $(awk 'BEGIN {print ('$load'>'$check') ? 1:0}') -eq 1 ]]; then
155
        echo -e "\n$mode负载高于$check，开启UAM"
156
        # Enable Under Attack Mode
157
        result=$(curl -X PATCH "$api_url" \
158
            -H "X-Auth-Email: $email" \
159
            -H "X-Auth-Key: $api_key" \
160
            -H "Content-Type: application/json" \
161
                --data "{
162
                    \"value\": \"under_attack\"
163
                }" --silent \
164
        | jq -r '.success')
165
        if [[ "$result" = "true" ]]; then
166
            echo 1 > status.txt
167
            echo -e "\n成功"
168
        fi
169
        if [[ "$challenge" -eq 1 ]]; then
170
            while :; do
171
                result=$(curl -X POST "$api_url2" \
172
                    -H "X-Auth-Email: $email" \
173
                    -H "X-Auth-Key: $api_key" \
174
                    -H "Content-Type: application/json" \
175
                    --data '[{
176
                        "expression": "(not cf.client.bot)"
177
                    }]' --silent)
178
                if echo $result | jq -e '.success'; then
179
                    filterid=$(echo $result | jq -r '.result[].id')
180
                else
181
                    filterid=$(echo $result | jq -r '.errors[].meta.id')
182
                    for i in $filterid; do
183
                        result1=$(curl -X DELETE "$api_url2/$i" \
184
                            -H "X-Auth-Email: $email" \
185
                            -H "X-Auth-Key: $api_key" \
186
                            -H "Content-Type: application/json" --silent)
187
                    done
188
                    if echo $result1 | jq -e '.success'; then
189
                        echo "\n冲突的filter删除成功"
190
                    fi
191
                fi
192
                echo $result | jq -e '.success' && break
193
            done
194
            result=$(curl -X POST "$api_url1" \
195
                -H "X-Auth-Email: $email" \
196
                -H "X-Auth-Key: $api_key" \
197
                -H "Content-Type: application/json" \
198
                --data "[{
199
                    \"action\": \"challenge\",
200
                    \"filter\": {
201
                        \"id\": \"$filterid\",
202
                        \"expression\": \"(not cf.client.bot)\"
203
                    }
204
                }]" --silent)
205
            if echo $result | jq -e '.success'; then
206
                ruleid=$(echo $result | jq -r '.result[].id')
207
                echo "$filterid" > filterid.txt
208
                echo "$ruleid" > ruleid.txt
209
                echo -e "验证码开启成功，规则id：$ruleid"
210
            fi
211
        fi
212
    else
213
        echo 0 > status.txt
214
    fi
215
    sleep $interval
216
    clear
217
done