限制登陆

编辑/etc/hosts.allow
sshd: ALL: spawn ( /usr/local/src/sshblock.sh )& : ALLOW

cat /usr/local/src/sshblock.sh

#!/bin/bash

PATH=/sbin:/bin:/usr/sbin:/usr/bin

LOG_FILE=/var/log/secure
KEY_WORD="Illegal user"
KEY_WORD1="Failed password for root"
PERM_LIST=/etc/firewall/bad.list.perm
LIMIT=3
[email protected]
IPT_SAV="$(iptables-save)"
bad_list=$(egrep "$KEY_WORD" $LOG_FILE | awk '{print $NF}' | xargs)
bad_list1=$(egrep "$KEY_WORD1" $LOG_FILE | awk '{print $11}' | xargs)
bad_list="$bad_list $bad_list1"

for i in $(echo -e "${bad_list// /\n}" | sort -u)
do
hit=$(echo $bad_list | egrep -o "$i" | wc -l)
[ "$hit" -ge "$LIMIT" ] && {
echo "$IPT_SAV" | grep -q "$i .*-j DROP" || {
echo -e "\n$i was dropped on $(date)\n" | mail -s "DROP by ${0##*/}: $i" $MAIL_TO
iptables -I INPUT -s $i -j DROP
}
egrep -q "^$i$" $PERM_LIST || echo $i >> $PERM_LIST
}
done