Shell script automatically adds black malicious attack IP

Shell script automatically adds black malicious attack IP

System environment: Centos 6.5 X64

If we open the SSH 22 port to all the users, then we can see in the/var/log/secure file, where the face is full of malicious attacks of IP, then how can we deny the IP in the next attack directly to the black, sealed off it? Or this IP to try to log in 4 or 7 times I turned him down, and his IP permanently sealed off it? This time we can use the following script to implement.

[Email protected] ssh]# vi/etc/ssh/blocksship

#!/bin/bash

#auto drop SSH failed IP address

#by authors Evanli 2017-6-13

Sec_file=/var/log/failed.txt

Ip_regex= "[[:d igit:]]{1,3}\. [[:d Igit:]] {1,3}\. [[:d Igit:]] {1,3}\. [[:d Igit:]] {1,3} "

Grep-r "Failed password"/var/log/secure >/var/log/failed.txt

Ip_addr= ' tail-n 100/var/log/failed.txt |grep "Failed password" | Egrep-o $ip _regex | Sort-nr | uniq-c | awk ' $1>=7 {print $} '

Iptables_conf=/etc/sysconfig/iptables

For i in ' echo $IP _addr '

Do

Cat $IPTABLES _conf |grep $i >/dev/null

If

[$?-ne 0];then

Sed-i "5 a-a input-s $i-M State--state new-m tcp-p TCP--dport 22-j DROP" $IPTABLES _conf

Else

echo "This is $i are exist in Iptables,please exit ..."

Fi

Done

Script description

One, Sir, into a file with the keyword "Failed password"/var/log/failed.txt

Second, look for IP addresses with more than 7 occurrences in the Failed.txt file.

Third, awk ' $1>=7 indicates that the number of matches in the file number of more than 7 of the IP, only to blacklist. This number 7 can be changed as you want .

Iv. determine if there is a rejected IP in the iptables configuration file, if it does not exist, no longer add the corresponding entry, if present "This is the IP is exist in Iptables,please exit ..."

V. Sed-i "5 a-a input-s $i-M State--state new-m tcp-p TCP--dport 22-j DROP" $IPTABLES _conf

Represents a new row of drop policies after the 5th line of the Iptables file. Be sure to choose to insert a new drop policy in the first few lines according to your iptables file.

To execute permissions, and execute

[Email protected] ssh]# chmox +x/etc/ssh/blocksship

[Email protected] ssh]# /etc/ssh/blocksship

After execution, check to see if the iptables file is healthy. If no problem, restart the service.

[Email protected] ssh]# vi/etc/sysconfig/iptables

[Email protected] ssh]# service iptables Restart

Added to Scheduled tasks, executed every 1 hours

[Email protected] postfix]# vi/etc/crontab

0 */1 * * * root/etc/ssh/blocksship

The following is the effect of a single command after it is executed separately

Generate a file with the keyword "Failed password"

[Email protected] ssh]# grep-r "Failed password"/var/log/secure >/var/log/failed.txt

Displays the 11th column of information in the Failed.txt file, which is the IP address

[Email protected] ssh]# tail-n 100/var/log/failed.txt |grep "Failed password" | awk ' {print $11} '

62.145.211.15

62.145.211.15

62.145.211.15

62.145.211.15

219.132.35.82

62.145.211.15

62.145.211.15

62.145.211.15

62.145.211.15

62.145.211.15

62.145.211.15

62.145.211.15

62.145.211.15

Count the number of times an IP is attempting to log in directly with a command

[Email protected] ssh]# tail-n 100/var/log/failed.txt |grep "Failed password" | awk ' {print $11} ' |sort|uniq-c |sort -nr

62.145.211.15

1 219.132.35.82

indicates that the IP has occurred 12 times

Displays IPs greater than 7 times

[Email protected] ssh]# tail-n 100/var/log/failed.txt |grep "Failed password" | awk ' {print $11} ' |sort|uniq-c |sort -nr | awk ' $1>=7 {print $} '

62.145.211.15

Reference articles

http://kangh.iteye.com/blog/2304836

The test was successful on 2017.6.13 day, Evan.li

This article is from the "Virtualized apps" blog, so be sure to keep this source http://liwenhn.blog.51cto.com/854522/1935129

Shell script automatically adds black malicious attack IP