自动将恶意IP加入防火墙列表脚本

#!/bin/sh
#auto drop ssh failed IP address
#by zkg 2019-07-08

SEC_FILE=/var/log/secure
IP_ADDR=tail -n 100 $SEC_FILE |grep "Failed password"|egrep -o "([0-9]{1,3}\.){3}[0-9]{1,3}"|sort|uniq -c|sort -nr|awk '$1>=4 {print $2}'
IPTABLE_CONF=/etc/sysconfig/iptables

for i in echo $IP_ADDR
do
cat $IPTABLE_CONF |grep $i >/dev/null
if [ $? -ne 0 ];then
sed -i "/filter/a -A INPUT -s $i -m state --state NEW -m tcp -p tcp --dport 22 -j DROP" $IPTABLE_CONF
else
echo "this is $i exist in iptables,please exit...."
fi
done
/etc/init.d/iptables restart