统计访问IP次数，防火墙过滤

IP_ADDR=`tail -n 100 /var/log/secure |grep "Failed password"| egrep -o "([0-9]{1,3}\.){3}[0-9]{1,3}"|sort -nr|uniq -C|awk '$1>=10 {print $2}'`

IPTABLE_CONF=/etc/sysconfig/iptables

echo

cat <<EOF

++++++++welcome to use ssh login DROP failed

ip ++++++++

EOF

for i in `echo $IP_ADDR`

do

cat $IPTABLE_CONF|grep $i>/dev/null

if[$? -ne 0];then

sed -i "/lo/a -A INPUT -s $i -m state --state NEW -m tcp -p tcp --dport 22 -j DROP" $IPTABLE_CONF

#匹配lo后面一行添加-A INPUT -s $i -m state --state NEW -m tcp -p tcp --dport 22 -j DROP" $IPTABLE_CONF

else

echo "这个$i 是不存在的"

exit

fi

done

/etc/init.d/iptables restart

转载于:https://www.cnblogs.com/todayORtomorrow/p/10845259.html