shell实用脚本5

需求：iptables 自动屏蔽访问网站频繁的IP

1.屏蔽每分钟访问超过200的IP

#!/bin/bash
DATE=$(date +%d/%b/%Y:%H:%M) ABNORMAL_IP=$(tail -n5000 access.log |grep $DATE |awk '{a[$1]++}END{for(i in a)if(a[i]>100)pri nt i}')
for IP in $ABNORMAL_IP; do
	if [ $(iptables -vnL |grep -c "$IP") -eq 0 ]; then
    	iptables -I INPUT -s $IP -j DROP
	fi 
done

#!/bin/bash
ABNORMAL_IP=$(netstat -an |awk '$4~/:80$/ && $6~/ESTABLISHED/{gsub(/:[0 - 9]+/,"",$5)；{a[$5]++}}END{for(i in a)if(a[i]>100)print i}')
#gsub 是将第五列（ 客户端 IP） 的冒号和端口去掉
for IP in $ABNORMAL_IP; do
	if [ $(iptables -vnL |grep -c "$IP") -eq 0 ]; then
    	iptables -I INPUT -s $IP -j DROP
	fi 
done

2.屏蔽每分钟SSH尝试登录超过10次的IP

#!/bin/bash
DATE=$(date +"%a %b %e %H:%M") #星期月天时分	%e 单数字时显示 7，而%d 显示 07 ABNORMAL_IP=$(lastb |grep "$DATE" |awk '{a[$3]++}END{for(i in a)if(a[i]>10)print i}')
for IP in $ABNORMAL_IP; do
	if [ $(iptables -vnL |grep -c "$IP") -eq 0 ]; then
    	iptables -I INPUT -s $IP -j DROP
	fi 
done

#!/bin/bash
DATE=$(date +"%b %d %H") ABNORMAL_IP="$(tail -n10000 /var/log/auth.log |grep "$DATE" |awk '/Failed/{a[$(NF- 3)]++}END{for(i in a)if(a[i]>5)print i}')"
for IP in $ABNORMAL_IP; do
	if [ $(iptables -vnL |grep -c "$IP") -eq 0 ]; then
	    iptables -A INPUT -s $IP -j DROP
	    echo "$(date +"%F %T") - iptables -A INPUT -s $IP - j DROP" >>~/ssh-login-limit.log
	fi 
done