判断ssh登录密码验证错误超过5次的IP被拉黑

[root@crushlinux ~]# cat securehost.sh
#!/bin/bash

awk '/Failed/ {print $(NF-3)}' /var/log/secure | sort |uniq -c | awk '{print $2"="$1}' > /tmp/ip.txt

for i in $(cat /tmp/ip.txt)
do
  ip=$(echo $i | awk -F= '{print $1}')
  cishu=$(echo $i | awk -F= '{print $2}')

  if [ $cishu -ge 5 ]
  then
    echo "sshd:$ip" >> /etc/hosts.deny
  else
    echo "$ip $cishu次登录异常" >> /tmp/ssh-error.txt
  fi
done

posted @ 2017-04-20 13:23  房佳亮  阅读(2318)  评论(0编辑  收藏  举报