Linux SSH 登录失败多少次禁止该IP访问 防止暴力破解

Linux 系统SSH 登录失败的内容会记录到/var/log/secure文件,通过查找关键字 Failed,可以定位到这些异常的IP地址,比如:

[root@www.cndba.cn ~]# cat /var/log/secure|grep 36.250.229.118
Jan 10 16:54:25 iZbp15upsrdbnwnq3zksepZ sshd[10813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.101.235  user=root
Jan 10 16:54:25 iZbp15upsrdbnwnq3zksepZ sshd[10813]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jan 10 16:54:27 iZbp15upsrdbnwnq3zksepZ sshd[10813]: Failed password for root from 103.152.101.235 port 59352 ssh2
Jan 10 16:54:27 iZbp15upsrdbnwnq3zksepZ sshd[10813]: Connection closed by 103.152.101.235 port 59352 [preauth]
Jan 10 16:54:29 iZbp15upsrdbnwnq3zksepZ sshd[10820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.101.235  user=root
Jan 10 16:54:29 iZbp15upsrdbnwnq3zksepZ sshd[10820]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jan 10 16:54:31 iZbp15upsrdbnwnq3zksepZ sshd[10820]: Failed password for root from 103.152.101.235 port 60970 ssh2
Jan 10 16:54:31 iZbp15upsrdbnwnq3zksepZ sshd[10820]: Connection closed by 103.152.101.235 port 60970 [preauth]
Jan 10 16:54:33 iZbp15upsrdbnwnq3zksepZ sshd[10825]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.101.235  user=root
Jan 10 16:54:33 iZbp15upsrdbnwnq3zksepZ sshd[10825]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jan 10 16:54:35 iZbp15upsrdbnwnq3zksepZ sshd[10825]: Failed password for root from 103.152.101.235 port 34445 ssh2
Jan 10 16:54:35 iZbp15upsrdbnwnq3zksepZ sshd[10825]: Connection closed by 103.152.101.235 port 34445 [preauth]
Jan 10 16:54:37 iZbp15upsrdbnwnq3zksepZ sshd[10831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.101.235  user=root
Jan 10 16:54:37 iZbp15upsrdbnwnq3zksepZ sshd[10831]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jan 10 16:54:39 iZbp15upsrdbnwnq3zksepZ sshd[10831]: Failed password for root from 103.152.101.235 port 36166 ssh2
Jan 10 16:54:39 iZbp15upsrdbnwnq3zksepZ sshd[10831]: Connection closed by 103.152.101.235 port 36166 [preauth]
Jan 10 16:54:41 iZbp15upsrdbnwnq3zksepZ sshd[10836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.101.235  user=root
Jan 10 16:54:41 iZbp15upsrdbnwnq3zksepZ sshd[10836]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jan 10 16:54:43 iZbp15upsrdbnwnq3zksepZ sshd[10836]: Failed password for root from 103.152.101.235 port 37866 ssh2
Jan 10 16:54:43 iZbp15upsrdbnwnq3zksepZ sshd[10836]: Connection closed by 103.152.101.235 port 37866 [preauth]
Jan 10 16:54:45 iZbp15upsrdbnwnq3zksepZ sshd[10841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.101.235  user=root
Jan 10 16:54:45 iZbp15upsrdbnwnq3zksepZ sshd[10841]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jan 10 16:54:47 iZbp15upsrdbnwnq3zksepZ sshd[10841]: Failed password for root from 103.152.101.235 port 39832 ssh2
Jan 10 16:54:47 iZbp15upsrdbnwnq3zksepZ sshd[10841]: Connection closed by 103.152.101.235 port 39832 [preauth]
Jan 10 16:54:49 iZbp15upsrdbnwnq3zksepZ sshd[10847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.101.235  user=root
Jan 10 16:54:49 iZbp15upsrdbnwnq3zksepZ sshd[10847]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jan 10 16:54:51 iZbp15upsrdbnwnq3zksepZ sshd[10847]: Failed password for root from 103.152.101.235 port 41558 ssh2
Jan 10 16:54:52 iZbp15upsrdbnwnq3zksepZ sshd[10847]: Connection closed by 103.152.101.235 port 41558 [preauth]

比如这里,明显这个IP地址在进行SSH 扫描,不断的更换端口和用户进行暴力测试。

在Linux里面有两个相关的文件:

/etc/hosts.allow: 允许哪些IP访问主机

cat /etc/hosts.allow
sshd:19.16.18.1:allow
sshd:19.16.18.2:allow

/etc/hosts.deny 禁止哪些IP访问主机:

cat /etc/hosts.deny
sshd:13.7.3.6:deny
sshd:92.4.0.4:deny
sshd:94.10.4.2:deny
sshd:94.4.1.6:deny
sshd:11.64.11.5:deny

因此,我们只需要从/var/log/secure文件中提取IP地址,如果次数达到10次则将该IP写到 /etc/hosts.deny中,禁止这些IP访问主机。

脚本如下secure_ssh.sh:

#! /bin/bash
cat /var/log/secure|awk '/Failed/{print $(NF-3)}'|sort|uniq -c|awk '{print $2"="$1;}' > /boss/config/black.list
for i in `cat  /boss/config/black.list`
do
  IP=`echo $i |awk -F= '{print $1}'`
  NUM=`echo $i|awk -F= '{print $2}'`
  echo $IP=$NUM
  if [ $NUM -gt 10 ]; then
    grep $IP /etc/hosts.deny > /dev/null
    if [ $? -gt 0 ];then
      echo "sshd:$IP:deny" >> /etc/hosts.deny
    fi
  fi
done

将secure_ssh.sh脚本放入cron计划任务,每1小时执行一次。

# crontab -e
0 */1 * * *  sh /usr/local/bin/secure_ssh.sh
  • 4
    点赞
  • 11
    收藏
    觉得还不错? 一键收藏
  • 3
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 3
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值