linux清除ssh登录日志脚本,简单的SSH登录日志分析脚本

很多年前写的，用于每天分析messages，看有多少人试图登录SSH，多少人密码错误，多少人成功登录，并将结果发送到邮箱。

#!/bin/sh

###############################

###       File_define       ###

###############################

SECU_LOG=/lk/secu_log

FAILED_TMP=/tmp/failed_tmp

ACCEPTED_TMP=/tmp/accepted_tmp

TMP=/tmp/date_tmp

###############################

####       check_date      ####

###############################

function check_date

{

DAY=`date +%d`

#echo $DATE

> $TMP

oldifs=$IFS

IFS=

FG=6

case $DAY in

01)

DAY=" 1"

FG=7

;;

02)

DAY=" 2"

FG=7

;;

03)

DAY=" 3"

FG=7

;;

04)

DAY=" 4"

FG=7

;;

05)

DAY=" 5"

FG=7

;;

06)

DAY=" 6"

FG=7

;;

07)

DAY=" 7"

FG=7

;;

08)

DAY=" 8"

FG=7

;;

09)

DAY=" 9"

FG=7

;;

esac

MONTH=`date +%b`

grep -w "$MONTH $DAY" $1|cut -d " " -f $FG- >> $TMP

echo $MONTH$DAY

#echo $MONTH$DAY

IFS=$oldifs

}

###############################

##     get Accepted          ##

###############################

function get_Accepted

{

echo -e "Accepted top 10 \n" >$SECU_LOG

grep -w "Accepted" $TMP |cut -d " " -f 1-6 > $ACCEPTED_TMP

cat $ACCEPTED_TMP|grep  ^[^$]|uniq -c|sort -nr >> $SECU_LOG

}

###############################

##       get Failed          ##

###############################

#root

function get_Failed

{

echo -e "\nFailed top 10 \n" >>$SECU_LOG

grep -w "Failed password for root" $TMP|cut -d " " -f 1-6 > $FAILED_TMP

cat "$FAILED_TMP" | grep ^[^$] | sort |uniq -c | sort -nr >> $SECU_LOG

#Illegal

echo -e "\ninvalid top 10 \n" >>$SECU_LOG

grep -w "invalid" $TMP | cut -d " " -f 1-2,8 > $FAILED_TMP

cat "$FAILED_TMP" | grep ^[^$]|uniq -c | sort -nr >> $SECU_LOG

}

###############################

###       del_tmp           ###

###############################

function del_tmp

{

rm -f "$ACCEPTED_TMP"

rm -f "$FAILED_TMP"

rm -f "$TMP"

}

###############################

###         Main            ###

###############################

check_date /var/log/secure

rm -f $SECU_LOG

get_Accepted

get_Failed

del_tmp

DATE=`date +%D`

echo -e "\n" >> $SECU_LOG

echo "##########Disk Info -m########">>$SECU_LOG

df -m>>$SECU_LOG

echo "##########Backlist#########">>$SECU_LOG

cat /lk/backlist >>$SECU_LOG

mail -s "MailServer Secure Top 10 --- $DATE" < "$SECU_LOG"