#!/bin/bash
#command=$(cat /var/log/secure |awk '/Failed/{print $(NF-3)}' |sort|uniq -c|awk '{print $2"="$1;}')
cat /var/log/secure |awk '/Failed/{print $(NF-3)}' |sort|uniq -c|awk '{print $2"="$1;}' > /root/black.txt
#$command > /root/black.txt
for i in $(cat /root/black.txt); do IP=$(echo $i |awk -F "=" '{print $1}'); NUM=$(echo $i|awk -F "=" '{print $2}'); DEFINE=5; if [ $NUM -gt $DEFINE ];then grep $IP /etc/hosts.deny > /dev/null; if [ $? -gt 0 ];then echo "sshd:$IP:deny" >> /etc/hosts.deny; fi; fi; done
#!/bin/bash
#Usage: ./$0
#查看安全日志，登陆次数超过5次的ip地址添加到/etc/hosts.deny.禁止该ip访问linux 的sshd服务
#定义登陆失败的次数
time=5
cat /var/log/secure |awk '/Failed/{print $(NF-3)}' |sort|uniq -c|awk '{print $2"="$1;}' > /root/SSH_FAILD_IP.txt
for i in $(cat SSH_FAILD_IP.txt);
do
IP=$(echo $i |awk -F "=" '{print $1}');
NUM=$(echo $i|awk -F "=" '{print $2}');
if [ $NUM -gt $time ];then
grep $IP /etc/hosts.deny > /dev/null;
if [ $? -gt 0 ];then
echo "sshd:$IP:deny" >> /etc/hosts.deny;
fi;
fi;
done
