将密码输入错误超过4次的IP地址通过iptables防火墙阻止访问

编写脚本文件

#!/bin/bash
#########################
#File name:ssh.sh
#Version:v1.0
#Email:admin@test.com
#Created time:2023-01-07 13:55:03
#Description:
#########################
ip_address=`grep "Failed password" /var/log/secure | awk '{print $(NF-3)}' | sort | uniq -c | tr -s " " | tr " " "#"`
for i in $ip_address
do
        count=`echo $i | awk -F\# '{print $2}'`
        ip=`echo $i | awk -F\# '{print $3}'`
        if [ $count -gt 4 ];then
                firewall-cmd --permanent --zone=public --add-rich-rule="rule family='ipv4' source address='$ip/32' service='ssh' reject" &> /dev/null
                filwall-cmd --reload > /dev/null
                echo "$ip has been blocked!"
        fi
done

给脚本文件添加执行权限

[root@zyf ~]# chmod a+rx ssh.sh

脚本执行结果