Windows下实时动态获取IP并实现用户访问认证的方案咨询

问题背景 #

需要在Windows系统中实时获取本地IP，与指定IP范围对比，持续验证用户访问特定资源的IP合规性。现有静态Python代码无法实现动态IP获取，nmap尝试未成功。

Python实现方案 #

核心改进点 #

1. 动态获取活跃IPv4地址：通过socket或netifaces模块获取当前系统正在使用的非回环IP
2. IP范围校验：使用ipaddress模块支持单个IP、子网段（如192.168.1.0/24）的校验
3. 持续监控：通过循环+定时刷新实现实时验证

修改后的完整代码 #

import pandas as pd
import socket
import ipaddress
import time

# 指定允许的IP范围（支持单个IP或子网段）
ALLOWED_IP_RANGES = [
    "192.168.1.0/24",
    "192.168.0.10/32",
    "192.168.0.11/32",
    "192.168.2.30/32",
    "192.168.2.31/32"
]

def load_employee_info():
    try:
        employees_info = pd.read_csv('Employees_info.csv')
    except FileNotFoundError:
        print("错误：未找到Employees_info.csv文件。")
        return pd.DataFrame()
    return employees_info

def get_current_active_ip():
    """动态获取当前系统活跃的IPv4地址（排除回环）"""
    try:
        # 通过连接外部地址获取当前出口IP
        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        s.connect(("8.8.8.8", 80))
        current_ip = s.getsockname()[0]
        s.close()
        return current_ip
    except Exception as e:
        # 备选：遍历网卡获取活跃IP
        import netifaces
        for interface in netifaces.interfaces():
            addrs = netifaces.ifaddresses(interface)
            if netifaces.AF_INET in addrs:
                for addr_info in addrs[netifaces.AF_INET]:
                    ip = addr_info['addr']
                    if not ip.startswith('127.'):
                        return ip
        print("错误：无法获取活跃IP地址。")
        return None

def is_ip_allowed(ip):
    """检查IP是否在允许的范围列表中"""
    if not ip:
        return False
    try:
        target_ip = ipaddress.ip_address(ip)
        for range_str in ALLOWED_IP_RANGES:
            ip_range = ipaddress.ip_network(range_str, strict=False)
            if target_ip in ip_range:
                return True
        return False
    except ValueError as e:
        print(f"错误：IP格式无效 - {e}")
        return False

def retrieve_ip_address_risk_score(user_id):
    employees_info = load_employee_info()
    if employees_info.empty:
        print("错误：Employees_info.csv文件为空。")
        return 1

    users = employees_info.loc[employees_info["user_id"] == user_id]
    if users.empty:
        print("错误：未找到该用户ID。")
        return 1

    try:
        registered_ip = users["ip_address"].values[0]
    except IndexError:
        print("错误：无法提取用户注册IP地址。")
        return 1

    current_ip = get_current_active_ip()
    if not current_ip:
        return 1

    # 双重校验：当前IP是否在允许范围，且与注册IP匹配（可根据需求调整逻辑）
    if is_ip_allowed(current_ip) and current_ip == registered_ip:
        return 0.1
    elif is_ip_allowed(current_ip):
        print(f"警告：用户{user_id}使用允许范围内的非注册IP访问 - {current_ip}")
        return 0.5
    else:
        print(f"风险：用户{user_id}使用未授权IP访问 - {current_ip}")
        return 1

# 实时监控逻辑
def start_real_time_monitoring(user_id, interval=5):
    """持续监控IP合规性，interval为刷新间隔（秒）"""
    print(f"开始实时监控用户{user_id}的IP访问状态...")
    while True:
        risk_level = retrieve_ip_address_risk_score(user_id)
        print(f"当前风险等级：{risk_level}")
        time.sleep(interval)

# 使用示例
if __name__ == "__main__":
    start_real_time_monitoring("user123", interval=10)

说明 #

• 安装依赖：若使用netifaces，需执行pip install netifaces
• ALLOWED_IP_RANGES可灵活配置单个IP或子网段
• 实时监控默认每10秒刷新一次，可根据需求调整interval参数

PowerShell实现方案 #

核心逻辑 #

1. 动态获取活跃IPv4
2. 校验IP是否在指定范围
3. 循环执行实现实时监控

脚本代码 #

# 允许的IP范围（支持单个IP或子网，格式如"192.168.1.0/24"）
$allowedIpRanges = @(
    "192.168.1.0/24",
    "192.168.0.10/32",
    "192.168.0.11/32",
    "192.168.2.30/32",
    "192.168.2.31/32"
)

function Get-CurrentActiveIp {
    # 获取当前活跃的非回环IPv4地址
    $ipAddress = Get-NetIPAddress -AddressFamily IPv4 | 
                 Where-Object { $_.InterfaceAlias -notlike "*Loopback*" -and ($_.PrefixOrigin -eq "Dhcp" -or $_.PrefixOrigin -eq "Manual") } |
                 Select-Object -First 1 -ExpandProperty IPAddress
    return $ipAddress
}

function Test-IpInRange {
    param(
        [string]$Ip,
        [string]$IpRange
    )
    $ipObj = [System.Net.IPAddress]::Parse($Ip)
    $rangeParts = $IpRange.Split("/")
    $networkAddr = [System.Net.IPAddress]::Parse($rangeParts[0])
    $prefixLength = [int]$rangeParts[1]

    $maskBytes = New-Object byte[] 4
    for ($i=0; $i -lt 4; $i++) {
        if ($prefixLength -ge 8) {
            $maskBytes[$i] = 255
            $prefixLength -= 8
        } else {
            $maskBytes[$i] = [byte](255 - (2**(8-$prefixLength) - 1))
            $prefixLength = 0
        }
    }
    $subnetMask = New-Object System.Net.IPAddress($maskBytes)

    $network = [System.Net.IPAddress]::Parse(([System.BitConverter]::ToString($ipObj.Address -band $subnetMask.Address)).Replace("-","."))
    return $network.Equals($networkAddr)
}

function Get-IpRiskScore {
    param(
        [string]$UserId
    )
    # 加载员工信息（需根据实际路径调整）
    try {
        $employeeInfo = Import-Csv -Path ".\Employees_info.csv"
    } catch {
        Write-Host "错误：未找到Employees_info.csv文件。"
        return 1
    }

    $user = $employeeInfo | Where-Object { $_.user_id -eq $UserId }
    if (-not $user) {
        Write-Host "错误：未找到该用户ID。"
        return 1
    }

    $registeredIp = $user.ip_address
    $currentIp = Get-CurrentActiveIp
    if (-not $currentIp) {
        Write-Host "错误：无法获取当前活跃IP。"
        return 1
    }

    $isAllowed = $false
    foreach ($range in $allowedIpRanges) {
        if (Test-IpInRange -Ip $currentIp -IpRange $range) {
            $isAllowed = $true
            break
        }
    }

    if ($isAllowed -and $currentIp -eq $registeredIp) {
        return 0.1
    } elseif ($isAllowed) {
        Write-Host "警告：用户$UserId使用允许范围内的非注册IP访问 - $currentIp"
        return 0.5
    } else {
        Write-Host "风险：用户$UserId使用未授权IP访问 - $currentIp"
        return 1
    }
}

# 实时监控
function Start-RealTimeMonitoring {
    param(
        [string]$UserId,
        [int]$Interval = 10
    )
    Write-Host "开始实时监控用户$UserId的IP访问状态..."
    while ($true) {
        $riskScore = Get-IpRiskScore -UserId $UserId
        Write-Host "当前风险等级：$riskScore"
        Start-Sleep -Seconds $Interval
    }
}

# 使用示例
Start-RealTimeMonitoring -UserId "user123" -Interval 10

说明 #

• 直接在PowerShell中运行脚本即可
• 可根据需求调整监控间隔Interval参数
• 员工信息CSV路径需与脚本执行路径一致，或修改Import-Csv的路径

内容的提问来源于stack exchange，提问作者SurgeFier