防止ssh暴力破解

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

#! /bin/bash

cat /var/log/secure|awk '/Failed/{print $(NF-3)}'|sort|uniq -c|awk '{print $2"="$1;}' > /usr/local/bin/black.list



for i  in `cat  /usr/local/bin/black.list`
do
  IP=`echo $i |awk -F= '{print $1}'`
  NUM=`echo $i|awk -F= '{print $2}'`
  if [ ${NUM} -gt 5 ]; then
    grep $IP /etc/hosts.deny > /dev/null
    # 如果找到 ，进程就正常退出，exit
    # 这里 我解释一下，如果文件里没有这个ip，就返回 1， 1 great than 0 ,所以是 true
    if [ $? -gt 0 ];then
      echo "sshd:$IP:deny" >> /etc/hosts.deny
    fi
  fi
done

# echo "OKh"

1
2
3
4
5
6

# 1min 执行一次操作
*/1 * * * *  sudo sh  /root/temp/backssh.sh  >> /root/temp/backssh.log 2>&1

# 查看被记录的IP
cat /root/usr/local/bin/black.list

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

#! /bin/bash

cat /var/log/secure|awk '/Failed/{print $(NF-3)}'|sort|uniq -c|awk '
BEGIN{
                total=0;

}

{

                if($1> 50) {


                   print $2"="$1;
                   total += $1;
                }


}END {
                printf ("total= %d \n", total);


}'




# echo "OKh"