auto drop ssh failed ip address

#/bin/bash
#auto drop ssh failed ip address
#author by efoni 2018.7
SEC_FILE=/var/log/secure
#如下为截取secure文件恶意ip远程登录22端口，大于等于4次就写入防火墙deny，禁止以后在登录22端口，egrep -o "[0-9]{1,3}.){3}[0-9]{1,3}"是匹配ip的正则表达式
IP_ADDR=tail -n 1000 $SEC_FILE|grep "Failed password"|egrep -o "[0-9]{1,3}.){3}[0-9]{1,3}"|sort -nr |uniq -c|awk '$1>=4 {print $2}'
IPTABLE_CONF=/etc/sysconfig/iptables
echo
cat <<EOF
++++++++++++++++++++++++++++++++welcome to use ssh login drop failed ip++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
EOF

for i in echo $IP_ADDR
do
#查看iptables配置文件是否已经含有提取的IP信息
cat $IPTABLE_CONF|grep $i >/dev/null
fi
[ $? -ne 0 ];then
#判断iptables配置文件是否已存在要拒绝的ip，不存在则加入
sed -i "/lo/a -A INPUT -s $i -m state --state NEW -m tcp --dport 22 -j DROP" $IPTABLE_CONF
else
echo "This $i is exist in iptables,please exit."
fi
done
#最后重启iptables 生效

转载于:https://blog.51cto.com/efoni/2146447

auto drop ssh failed ip address相关推荐

解决配置ssh免密时的错误：the ECDSA host key for ‘boylenubuntu0‘ differs from the key for the IP address
一.现象在搭建ssh免密过程中,尝试连接其他主机,结果报出警告:the ECDSA host key for 'boylenubuntu0' differs from the key for the ...
the ECDSA host key for ‘pc2‘ differs from the key for the IP address ‘192.168.144.250‘
一问题描述安装greenplum,执行gpssh-exkeys -f /home/gpadmin/conf/hostlist时报错: [ERROR]: Failed to ssh to pc2. ...
kafka自动提交offset失败：Auto offset commit failed
今天在服务日志中观察数据的消费情况时,发现了一个如下的警告,而且每隔几秒就会出现一次,虽然只是个警告, Auto offset commit failed for group order_group: ...
Linux安装中文总是提示失败,AnyBackup-Linux 客户端安装失败，提示错误信息：Self IP Address is invalid...
关键字 Self IP.invalid 适用产品 AnyBackup CDM 7.0.x AnyBackup Express 7.0.x 问题描述 Linux 系统在安装客户端时,执行安装命令后,提示 ...
Oracle 安装报错 [INS-06101] IP address of localhost could not be determined 解决方法[转]
--安装Oracle 11gR2,报错:[INS-06101] IP address of localhost could not be determined--------------------- ...
Your IP address is spelled incorrectly问题排查
nacos集成spring cloud stream时启动失败,报以下错误: Caused by: com.alibaba.nacos.api.exception.NacosException: fa ...
nginx启动失败nginx: [emerg] bind() to 0.0.0.0:7001 failed (98: Address already in use)
./nginx 启动nginx,在启动时报错端口被占用 [root@localhost sbin]# ./nginx nginx: [emerg] bind() to 0.0.0.0:7001 fai ...
MySQL删除用户报错:ERROR 1396 (HY000): Operation DROP USER failed for ‘tsjt‘@‘127.0.0.1‘
背景: 本地安装的MySQL的MariaDB,期间创建了两个名为tsjt的不同登录ip的用户,一个为127.0.0.1,另一个为localhost.测试完毕后准备删除. 此时却发现创建的tsjt@12 ...
go-zero出现retrying of unary invoker failed或者Auto sync endpoints failed
1. Auto sync endpoints failed 看看是不是docker-compose.yaml 的环境变量ETCD_ADVERTISE_CLIENT_URLS=http://etcd:2 ...

auto drop ssh failed ip address

auto drop ssh failed ip address相关推荐

最新文章

热门文章