Linux添加白名单黑名单

Linux添加黑白名单
centos7用的是firewall 添加单个黑名单只需要把ip添加到 /etc/hosts.deny
举例添加40.42 40.43添加黑名单

#
# hosts.deny    This file contains access rules which are used to
#               deny connections to network services that either use
#               the tcp_wrappers library or that have been
#               started through a tcp_wrappers-enabled xinetd.
#
#               The rules in this file can also be set up in
#               /etc/hosts.allow with a 'deny' option instead.
#
#               See 'man 5 hosts_options' and 'man 5 hosts_access'
#               for information on rule syntax.
#               See 'man tcpd' for information on tcp_wrappers
#
sshd:192.168.40.42:deny
sshd:192.168.40.43:deny

centos7用的是firewall 添加单个白名单只需要把ip添加到 /etc/hosts.allow
添加一个IP为白名单

#
# hosts.allow   This file contains access rules which are used to
#               allow or deny connections to network services that
#               either use the tcp_wrappers library or that have been
#               started through a tcp_wrappers-enabled xinetd.
#
#               See 'man 5 hosts_options' and 'man 5 hosts_access'
#               for information on rule syntax.
#               See 'man tcpd' for information on tcp_wrappers
sshd:all:allow

==============================================================================================================================================================
多次失败登录即封掉IP，防止暴力破解的脚本，超过20次的就加到黑名单
1、编辑脚本

vim /usr/local/bin/secure_ssh.sh
#! /bin/bash
cat /var/log/secure|awk '/Failed/{print $(NF-3)}'|sort|uniq -c|awk '{print $2"="$1;}' > /usr/local/bin/black.txt
for i in `cat  /usr/local/bin/black.txt`
do
  IP=`echo $i |awk -F= '{print $1}'`
  NUM=`echo $i|awk -F= '{print $2}'`
   if [ $NUM -gt 20 ];then
      grep $IP /etc/hosts.deny > /dev/null
    if [ $? -gt 0 ];then
      echo "sshd:$IP:deny" >> /etc/hosts.deny
    fi
  fi
done

2、创建记录登录失败次数的文件 touch /usr/local/bin/black.txt
3、添加定时 10分钟执行一次  crontab -e */10 * * * * root  sh /usr/local/bin/secure_ssh.sh