Automatically check the ip address used to scan the ssh port, and automatically disable command 01 for 100 scans #! /Bin/bash02 # sshd, failed03cd/var/bakwww.2cto. com04cat/var/log/secure | grepFailed | awk & amp; #39; {print $13} & amp; #39; | sort | uniq...
Automatically check the ip address used to scan the ssh port, and automatically disable command 01 for 100 scans #! /Bin/bash02 # sshd, failed03cd/var/bak www.2cto.com 04cat/var/log/secure | grep Failed | awk '{print $13}' | sort | uniq-c> loginfailed.txt 05cat/var/log/secure | grep Failed | awk '{print $11}' | sort | uniq-c> loginfailed.txt 06sed-I '/[a-z]/d' loginfailed.txt 07sed-I '/ [A-Z]/d 'loginfailed.txt 08cat loginfailed.txt | awk' {if (length ($2)> 7) print} '| sort-n> abc.txt 09 email-s "198, sshd failed" 41187 6027@qq.com <abc.txt 10cat abc.txt | awk '{if (length ($1)> 2) print} '| awk' {print $2} '> bb.txt 11 # cat abc.txt | awk' {if ($1 ~ /5 | 6 | 7 | 8 | 9/) print} '| awk' {print $2} '> bb.txt 12cat bb.txt | xargs-I {} echo "sshd: {} ">/etc/hosts. deny13rm abc.txt 14rm bb.txt 15rm loginfailed.txt 16cp/var/log/secure/var/logbak/secure 'date + % F-% t' 17>/var/log/secure www.2cto.com
