#/bin/bash
#auto drop ssh failed ip address
#author by efoni 2018.7
SEC_FILE=/var/log/secure
#如下為截取secure文件惡意ip遠(yuǎn)程登錄22端口，大于等于4次就寫入防火墻deny，禁止以后在登錄22端口，egrep -o "[0-9]{1,3}.){3}[0-9]{1,3}"是匹配ip的正則表達(dá)式
IP_ADDR=tail -n 1000 $SEC_FILE|grep "Failed password"|egrep -o "[0-9]{1,3}.){3}[0-9]{1,3}"|sort -nr |uniq -c|awk '$1>=4 {print $2}'
IPTABLE_CONF=/etc/sysconfig/iptables
echo
cat <<EOF
++++++++++++++++++++++++++++++++welcome to use ssh login drop failed ip++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
EOF

for i in echo $IP_ADDR
do
#查看iptables配置文件是否已經(jīng)含有提取的IP信息
cat $IPTABLE_CONF|grep $i >/dev/null
fi
[ $? -ne 0 ];then
#判斷iptables配置文件是否已存在要拒絕的ip，不存在則加入
sed -i "/lo/a -A INPUT -s $i -m state --state NEW -m tcp --dport 22 -j DROP" $IPTABLE_CONF
else
echo "This $i is exist in iptables,please exit."
fi
done
#最后重啟iptables 生效

轉(zhuǎn)載于:https://blog.51cto.com/efoni/2146447

總結(jié)

以上是生活随笔為你收集整理的auto drop ssh failed ip address的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。