IP过滤—防止暴力破解
方法
读取/var/log/secure,查找关键字 Failed。eg.
Dec 17 09:09:06 mgmt sshd[17028]: Failed password for root from 59.47.0.149 port 41952 ssh2
Dec 17 09:09:09 mgmt sshd[17028]: Failed password for root from 59.47.0.149 port 41952 ssh2
Dec 17 09:09:11 mgmt sshd[17028]: Failed password for root from 59.47.0.149 port 41952 ssh2
Dec 17 09:09:13 mgmt sshd[17028]: Failed password for root from 59.47.0.149 port 41952 ssh2
从这些行中提取IP地址,如果次数达到5次则将该IP写到 /etc/hosts.deny中。
步骤
1、先把始终允许的IP填入 /etc/hosts.allow ,这很重要!比如:
sshd:1.51.203.0:allow
2、编写脚本 /root/secure_ssh.sh