FRP日志分析

hangye168

这几天搞了群晖，部署了个FRP，把端口代{过}{滤}理出去。
我的服务器是按流量计费的，本着流量不能浪费的原则，对安全这块还是比较在意的
昨天登录FRP发现，无缘无故的流量一直在跑
看了下FRP的日志，有请求一直在访问FRP。
我在服务器上开的端口，本来就很大，还是再被扫描
于是决定，写个脚本，分析下日志，把这些有问题的IP给封掉。
下面是我写的Python脚本，水平有限，大佬勿喷。
代码有什么问题，可以指出来，我不一定会改。

[Asm] 纯文本查看 复制代码

import datetime
import openpyxl

log_data = []

target_contents = ["get a user connection"]
target_content = "get a user connection"

start_time = datetime.datetime.strptime("2023-06-29 16:30:30", "%Y-%m-%d %H:%M:%S")
end_time = datetime.datetime.strptime("2023-06-29 16:31:30", "%Y-%m-%d %H:%M:%S")

log_map = {}

print_map = {}

print_list = []


# 读取文件
def read_file():
    file = open("frp.log", encoding='utf-8')
    content = file.readline().replace("\n", "")
    if is_save(content):
        log_data.append(content)
    while content:
        content = file.readline().replace("\n", "")
        if is_save(content):
            log_data.append(content)


# 判断是否需要保存该条日志记录
def is_save(content):
    for i in target_contents:
        if i in content:
            return True
    return False


# 日志数据解析 保存到map中
def print_data():
    for i in log_data:
        try:
            content = str(i)
            log_time = content.split("[I]")[0].replace("\x1b[1;34m", "").strip()
            ip_str = content.split(target_content)[1]
            ip_str = ip_str.replace("[", "").replace("]", "").split(":")[0].strip()
            log_datetime = datetime.datetime.strptime(log_time, "%Y/%m/%d %H:%M:%S")
            map_data = log_map.get(ip_str)
            data_list = []
            if map_data is None:
                data_list.append(log_datetime)
                log_map[ip_str] = data_list
            else:
                data_list = map_data
                data_list.append(log_datetime)
                log_map[ip_str] = data_list
        except Exception as e:
            continue


# 按日志时间保存数据到map中
def print_data_date():
    for i in log_data:
        try:
            content = str(i)
            log_time = content.split("[I]")[0].replace("\x1b[1;34m", "").strip()
            ip_str = content.split(target_content)[1]
            ip_str = ip_str.replace("[", "").replace("]", "").split(":")[0].strip()
            log_datetime = datetime.datetime.strptime(log_time, "%Y/%m/%d %H:%M:%S")
            if end_time > log_datetime > start_time:
                map_data = log_map.get(ip_str)
                data_list = []
                if map_data is None:
                    data_list.append(log_datetime)
                    log_map[ip_str] = data_list
                else:
                    data_list = map_data
                    data_list.append(log_datetime)
                    log_map[ip_str] = data_list
        except Exception as e:
            continue


# 数据处理
def handler_log_map():
    for key, value in log_map.items():
        ip_num = len(value)
        begin_time = value[0]
        stop_time = value[-1]
        request_duration = stop_time - begin_time
        request_seconds = request_duration.seconds
        # print(request_duration.seconds)
        start_date_time = value[0]
        value.remove(start_date_time)
        request_all_rate = 0
        for i in value:
            end_date_time = i
            duration = end_date_time - start_date_time
            request_all_rate = request_all_rate + duration.seconds
            start_date_time = i
        local_print_list = [key, begin_time, stop_time, ip_num, int(request_all_rate / ip_num), request_seconds,
                            int(request_seconds / 60), int(request_seconds / 3600), int(request_seconds / 86400)]
        print_list.append(local_print_list)
        print(
            "IP地址{}:   开始请求时间{},   最后一次请求时间{},   请求次数{},   请求频率 = {},   请求跨度(秒) = {}, 请求跨度(分) = {}, 请求跨度(时) = {}, 请求跨度(天) = {}"
            .format(key, begin_time, stop_time, ip_num, int(request_all_rate / ip_num), request_seconds,
                    int(request_seconds / 60), int(request_seconds / 3600), int(request_seconds / 86400)))


# 导出Excel
def save_excel():
    book = openpyxl.Workbook()
    ws = book.active
    col = ('IP地址', '开始请求时间', "最后一次请求时间", "请求次数", "请求频率", "请求跨度(秒)", "请求跨度(分)",
           "请求跨度(时)", "请求跨度(天)")
    ws.append(col)  # 先写表头
    for key in print_list:
        ws.append(key)
    savepath = './FRP分析结果.xlsx'
    book.save(savepath)


if __name__ == '__main__':
    read_file()
    print_data()
    # print_data_date()
    handler_log_map()
    save_excel()

q352232141

我觉得frp还需要多关注安全，估计好用的工具会被盯上，再加上是开源的，虽然不懂，但还是支持楼主分享。