Shell automatically checks SSH brute-force IP and blocks attacks

#!/bin/bash

local_ip= "192.168.0.4" #定义本地IP不会被拒绝

tmp_log= ' Mktemp '

Cat/var/log/secure |grep "Failed password for root from" |awk ' {print $11} ' |uniq-c > $tmp _log

Cat $tmp _log |while Read line

Do

Attack_num= ' echo $line |awk ' {print $} '

Attact_ip= ' echo $line |awk ' {print $} '

If ["$attack _num"-GT "] && [" $local _ip "! =" $attack _ip "]

Then

echo sshd: "$attact _ip":d eny >>/etc/hosts.deny

Fi

Done

Sort-u/etc/hosts.deny > $tmp _log #过滤相同IP

Cp-f $tmp _log/etc/hosts.deny

Rm-f $tmp _log

Every 5 minutes to detect, in 5 minutes to try password login error more than 10 times deny this IP

Crontab-e

*/5 * * * */sh/sshtool.sh

View denied IPs

Cat/etc/hosts.deny

This article is from the "Shell" blog, be sure to keep this source http://zhizhimao.blog.51cto.com/3379994/1936556

Shell automatically checks SSH brute-force IP and blocks attacks