Automatic Rejection of malicious IP remote login to Linux server script

With the development of the entire IT industry, security is very important for people, from personal computers to Big Data Storage of IT enterprises to Internet security, we can't just look at the whole, but sometimes the details are the most important. Relatively speaking, personal computer security requires us to defend from multiple aspects, such as using the authoritative mainstream 360 anti-virus software, then, in combination with your surfing habits, do not open anything with unknown experiences. What should we do for server-level security? First, the server itself is in the IDC environment security, human operation security, and operating system security, prohibit unnecessary ports and services, and configure the server's own firewall, such as iptables. In addition, is the server secure? Even if we do this, it is only relatively secure. Security is guaranteed by long-term protection and bit by bit. So much. What are we going to discuss today? Today, let's take a look at how to reject attacks from malicious IP addresses in Linux. Of course, there are many ways to achieve this. We use scripts today. Some servers have configured an Internet IP address to allow external access from port 22 due to business needs. (Of course, we will discuss the preliminary solution to this situation here, we can also use VPN, key logon, and other methods to eliminate this direct external login situation.) When we have configured iptables firewall, we allow access from port 22 to all Internet users, of course, this is also for convenience. We connect anywhere without VPN or ssh key verification, but our password is very complicated, 32 characters in case, special characters, and numbers cannot even be remembered by yourself, so it is impossible for others to scan for 3-5 years. So every day I read all the ip addresses in the/var/log/secure file that are maliciously attacked. How can I reject these ip addresses for next attack, or how to make these IP addresses try to access port 22 3-4 times? The Code is as follows: 1. #! /Bin/sh 2. # auto drop ssh failed IP address 3. # wugk 2013-1-2 4. # defining variables 5. SEC_FILE =/var/log/secure 6. # intercept the malicious ip address of the secure file to remotely log on to port 22. If it is greater than or equal to four times, write it to the firewall. Disable logon to port 22 of the server later. 7. IP_ADDR = 'Tail-n 1000/var/log/secure | grep "Failed password" | awk '{print $11}' | grep "\. "| sort | uniq-c | sort-nr | awk '$1 >=4 {print $2}'' 8. IPTABLE_CONF =/etc/sysconfig/iptables 9. echo 10. cat <EOF 11. ++ welcome to use ssh Login drop failed ip address ++ 12. ++ ++ 13. ++ ------------------------------------------------------ ++ 14. EOF 15. # print the dynamic scroll bar. Refer to the old boy's blog-array analysis article 16. echo-n "Please wait 5 seconds to start executing" 17. for (j = 0; j <= 4; j ++); do echo-n "----------"; sleep 1; done 18. echo 19. 20. for I in 'echo $ IP_ADDR '21. 22. 23. do 24. # Check whether the iptables configuration file contains extracted IP addresses Interest 25. cat $ IPTABLE_CONF | grep $ I>/dev/null 26. 27. if 28. [$? -Ne 0]; then 29. # determine whether a rejected ip address exists in the iptables configuration file. If it does not exist, no corresponding entries will be added. 30. sed-I "/lo/a-a input-s $ I-m state -- state NEW-m tcp-p tcp -- dport 22-j DROP" $ IPTABLE_CONF 31. else 32. # If it exists, print the prompt. 33. echo "This is $ I is exist in iptables, please exit ...... "34. 35. fi 36. 37. done 38. 39. # restart iptables to take effect. 40. /etc/init. d/iptables restart: After writing the above script, how can we automatically add malicious IP addresses? execute the following command and add it to crontab to automatically execute the script every five minutes. 1. echo "*/5 *****/bin/sh/data/sh/auto_deny_Login.sh>/data/logs/login. log 2> & 1 ">/var/spool/cron/root after several days of observation, we will find the following changes in the IPTABLES configuration file, all are malicious IP addresses: This method automatically rejects malicious IP addresses from remotely logging on to the Linux server. The above methods are for reference only. You can modify them based on your actual situation. You are welcome to discuss and discuss them together, here, we will link a comprehensive list of malicious attack ip addresses. http://pastebin.com/0b6S86sV