【shell实战之编写安全脚本-12】

一、自动化禁止恶意IP访问

应用场景：防止恶意IP尝试ssh登录。
脚本说明：将密码输入错误超过4次的IP地址通过firewalld防火墙阻止访问
ssh远程访问记录在文件中/var/log/secure
登录成功时，该文件最后：
Jul 25 14:07:01 localhost sshd[2516]: Accepted password for root from 192.168.131.108 port 45944 ssh2
登录失败时，该文件最后：
Jul 25 14:11:23 localhost sshd[2538]: Failed password for root from 192.168.131.108 port 45946 ssh2

1.使用iptables对强行攻击192.168.131.109机器的主机进行拒绝访问

了解iptables知识：

[root@localhost sh]# yum install iptables-services
[root@localhost sh]# systemctl start iptables
[root@localhost ~]# iptables -F  #清空默认规则
[root@localhost ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[root@localhost ~]# iptables -I INPUT -p tcp --dport 22 -s 192.168.131.108 -j DROP
#service iptables save之后将永久保存在/etc/sysconfig/iptables文件中
[root@localhost sh]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  确定  ]
[root@localhost sh]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.21 on Sat Jul 25 14:40:17 2020
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [43:4704]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Sat Jul 25 14:40:17 2020
[root@localhost sh]# iptables  -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       tcp  --  192.168.131.108