linux自动将恶意登录ip加入防火墙黑名单

背景

服务器每天都有大量的登陆失败信息

查看日志

tail -n 15 /var/log/secure

加黑名单脚本

#!/bin/bash

logFile=/opt/cronTask/log/login_black_list.txt

# 过滤登陆失败大于5次的ip
ipList=$(grep "Failed password" /var/log/secure|awk '{print $(NF-3)}'|sort|uniq -c|sort -nr|awk '{if($1>=5) print $2}')
localTime=$(date +"%Y-%m-%d %H:%M:%S")

# 白名单
whiteList=""

echo ===================localTime:$localTime=================== >> $logFile
for ip in ${ipList[@]}
do
    # 过滤重复ip
    if [[ $(grep $ip /etc/sysconfig/iptables) ]]
    then
        continue
    fi

    # 过滤白名单ip
    if [[ $(echo $whiteList |grep $ip) ]]
    then
        continue
    fi
    echo ----------------------add ip:$ip to black list--------------------------
    sed -i "/lo/a -A INPUT -s $ip -j DROP" /etc/sysconfig/iptables >> $logFile 2>&1
done

设置定时任务，定时检查添加

crontab -e
0 22 * * * sh /opt/cronTask/login_black_list.sh

服务器没有iptables解决办法

yum install iptables-services iptables-devel
systemctl enabel iptables-services && systemctl start iptables-services

参考文章