阿里云IP遭受DDOS攻击 快速切换IP实践

阿里云IP遭受DDOS攻击 快速切换IP实践

#1 先容

运行平台: 阿里云
访问链路: 域名 -> 负载均衡EIP -> 容器

• 网站无法访问，查询服务运行正常，查询公网流量异常高后断流了
  
• 咨询工程师是公网IP遭受DDOS攻击后触发风控安全DDOS黑洞断流
  
• 阿里云EIP默认提供不凌驾5Gbps的基础DDoS防护本领
  
• 创建shell脚本检查网站断流后快速切换公网IP恢复
  

#2、创建shell脚本实践

#2.1 检测域名是否可达

1. # 域名
2. domain_name="elvin.vip"
3. domain_sub="k8s-lb"
4. if ping -c 1 $domain_sub.$domain_name &> /dev/null; then
5.     echo "$(date +'%F %T') $domain_sub.$domain_name is online"
6. else
7.     echo "$(date +'%F %T') $domain_sub.$domain_name is not online."
8. fi

复制代码

#2.2 查询负载均衡器的公网IP

1. #安装aliyun cli
2. wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz
3. tar -zxf aliyun-cli-linux-latest-amd64.tgz -C /usr/local/bin/
4. rm -f aliyun-cli-linux-latest-amd64.tgz
6. # 设置阿里云访问密钥和区域ID
7. export ALICLOUD_ACCESS_KEY_ID='key_id_xxx'
8. export ALICLOUD_ACCESS_KEY_SECRET='key_secret_xxx'
9. export ALICLOUD_REGION_ID='cn-shanghai'

复制代码

1. #负载均衡实例id
2. LOAD_BALANCER_ID="lb-xxxxxxxx"
4. # 查询绑定LB的EIP
5. EIP_INFO=$(aliyun vpc DescribeEipAddresses --RegionId $ALICLOUD_REGION_ID | jq --arg lb_id "$LOAD_BALANCER_ID" '.EipAddresses.EipAddress[] | select(.InstanceId == $lb_id and .InstanceType == "SlbInstance")')
6. # 提取EIP的ID和IP地址
7. OLD_EIP_IP=$(echo $EIP_INFO | jq -r '.IpAddress')
8. OLD_EIP_ID=$(echo $EIP_INFO | jq -r '.AllocationId')

复制代码

#2.3 创建新的EIP

1. # 创建EIP 按量付费模式 峰值带宽100M
2. EIP_OUTPUT=$(aliyun vpc AllocateEipAddress --RegionId $ALICLOUD_REGION_ID --InternetChargeType PayByTraffic --Bandwidth 100 --Name $domain_sub)
3. # 获取EIP的ID和IP地址
4. EIP_ID=$(echo $EIP_OUTPUT | jq -r '.AllocationId')
5. EIP_IP=$(echo $EIP_OUTPUT | jq -r '.EipAddress')

复制代码

#2.4 负载均衡器绑定新的EIP

1. # 解绑现有的EIP
2. aliyun vpc UnassociateEipAddress --RegionId $ALICLOUD_REGION_ID --AllocationId $OLD_EIP_ID --InstanceId $LOAD_BALANCER_ID --InstanceType SlbInstance
4. # 绑定EIP到负载均衡器
5. ASSOCIATE_OUTPUT=$(aliyun vpc AssociateEipAddress --RegionId $ALICLOUD_REGION_ID --AllocationId $EIP_ID --InstanceId $LOAD_BALANCER_ID --InstanceType SlbInstance)
7. # 释放旧的EIP
8. aliyun vpc ReleaseEipAddress --AllocationId $OLD_EIP_ID

复制代码

#2.5 更新域名的A记录

1. # 获取域名RecordId
2. RECORD_ID=$(aliyun alidns DescribeDomainRecords --DomainName $domain_name | jq -r --arg rr "$domain_sub" '.DomainRecords.Record[] | select(.RR == $rr) | .RecordId')
4. # 更新域名的A记录
5. aliyun alidns UpdateDomainRecord --RecordId $RECORD_ID --RR $domain_sub --Type A --Value $EIP_IP

复制代码

#3 完备的shell实例

1. #!/bin/bash# aliyun.lb.eip.update.sh# */12 * * * *  bash /opt/aliyun.lb.eip.update.sh# 域名和负载均衡相干信息domain_name="elvin.vip"domain_sub="k8s-lb"LOAD_BALANCER_ID="lb-xxxxxxxx"#file[ -d /data/txt ] || mkdir -p /data/txtckFile=/data/txt/$domain_sub.$domain_name.ckrunLog=/data/txt/$domain_sub.$domain_name.log#跳过一次实行if [ -f $ckFile ]; then    now_time=$(date +%s)    file_time=$(stat -c %Y $ckFile)    time_diff=$((now_time - file_time))    # 判断是否凌驾10分钟    if [ $time_diff -ge 600 ]; then        rm -f $ckFile        echo "$(date +'%F %T') skip run once" >>$runLog        exit 0    fifi# 检测域名是否可达,错误时连续检查3次for((i=1; i /dev/null; then        echo "$(date +'%F %T') $domain_sub.$domain_name is online" >>$runLog        nk=99        i=99        exit 0    else        echo "$(date +'%F %T') $domain_sub.$domain_name is not online. Retrying..." >>$runLog        sleep 5    fidoneif [ "$nk" = "99" ];then    exit 0else    echo "$(date +'%F %T') Domain is not reachable after 3 attempts." >>$runLogfi# 设置阿里云访问密钥和区域IDexport ALICLOUD_ACCESS_KEY_ID='key_id_xxx'export ALICLOUD_ACCESS_KEY_SECRET='key_secret_xxx'export ALICLOUD_REGION_ID='cn-shanghai'# 查询绑定LB的EIPEIP_INFO=$(aliyun vpc DescribeEipAddresses --RegionId $ALICLOUD_REGION_ID | jq --arg lb_id "$LOAD_BALANCER_ID" '.EipAddresses.EipAddress[] | select(.InstanceId == $lb_id and .InstanceType == "SlbInstance")')# 提取EIP的ID和IP地址OLD_EIP_IP=$(echo $EIP_INFO | jq -r '.IpAddress')OLD_EIP_ID=$(echo $EIP_INFO | jq -r '.AllocationId')# 验证结果if [ -z "$OLD_EIP_IP" ]; then    echo "$(date +'%F %T') Failed to find OLD_EIP_IP" >>$runLog    exit 1fiecho "$(date +'%F %T') Old EIP: $OLD_EIP_IP" >>$runLog# 创建EIP 按量付费模式 峰值带宽100M
2. EIP_OUTPUT=$(aliyun vpc AllocateEipAddress --RegionId $ALICLOUD_REGION_ID --InternetChargeType PayByTraffic --Bandwidth 100 --Name $domain_sub)
3. # 获取EIP的ID和IP地址
4. EIP_ID=$(echo $EIP_OUTPUT | jq -r '.AllocationId')
5. EIP_IP=$(echo $EIP_OUTPUT | jq -r '.EipAddress')# 验证EIP创建if [ -z "$EIP_ID" ] || [ -z "$EIP_IP" ]; then    echo "$(date +'%F %T') Test Failed: Failed to create EIP." >>$runLog    echo "eip_create: $EIP_OUTPUT" >>$runLog    exit 1fiecho "$(date +'%F %T') New EIP: $EIP_IP" >>$runLog# 解绑现有的EIPecho "$(date +'%F %T') Remove LB-EIP" >>$runLog >>$runLogaliyun vpc UnassociateEipAddress --RegionId $ALICLOUD_REGION_ID --AllocationId $OLD_EIP_ID --InstanceId $LOAD_BALANCER_ID --InstanceType SlbInstance >>$runLogsleep 2# 绑定EIP到负载均衡器ASSOCIATE_OUTPUT=$(aliyun vpc AssociateEipAddress --RegionId $ALICLOUD_REGION_ID --AllocationId $EIP_ID --InstanceId $LOAD_BALANCER_ID --InstanceType SlbInstance)# 验证绑定if [ $? -ne 0 ]; then    echo "$(date +'%F %T') EIP add to LB Failed." >>$runLog    echo "eip_update: $ASSOCIATE_OUTPUT" >>$runLog    exit 1else    # echo "EIP add to LB successfully."    echo "$(date +'%F %T') eip_update: $ASSOCIATE_OUTPUT" >>$runLogfisleep 2# 开释旧的EIPecho "$(date +'%F %T') Release old EIP $OLD_EIP_ID" >>$runLogaliyun vpc ReleaseEipAddress --AllocationId $OLD_EIP_ID  >>$runLog# 获取域名RecordIdRECORD_ID=$(aliyun alidns DescribeDomainRecords --DomainName $domain_name | jq -r --arg rr "$domain_sub" '.DomainRecords.Record[] | select(.RR == $rr) | .RecordId')# 更新域名的A记录echo "$(date +'%F %T') Update IP: $domain_sub.$domain_name  $EIP_IP" >>$runLogaliyun alidns UpdateDomainRecord --RecordId $RECORD_ID --RR $domain_sub --Type A --Value $EIP_IP >>$runLog#notie msg#dingtalkexport ddtxt="notice from ip-update \n$domain_sub.$domain_name \n$EIP_IP"export ddtoken="10b70b4fcb8a5ddad86b7a4396183639a6a99c2660xxxxxx"curl -ks -m 5 http://files.elvin.vip/shell/ddmsg.url.txt.sh |bash#larkexport txtmsg="notice from ip-update \n$domain_sub.$domain_name \n$EIP_IP"export larktoken="f6bfc69d-2617-46d7-a42b-123xxxxxx"curl -ks -m 5 http://files.elvin.vip/shell/lkmsg.txt.sh |bash# 记录完成时间date +"%F %T" >$ckFileexit 0

复制代码

source: https://gitee.com/alivv/elvin-demo/blob/master/shell/aliyun.lb.eip.update.sh

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。