vim ban_ip_ssh.sh

#! /bin/bash

cat /var/log/secure|awk '/Disconnected/{print $(NF-3)}'|sort|uniq -c|awk '{print $2"="$1;}' > /root/被拒绝的IP次数.txt

cat /var/log/secure|awk '/Failed password/{print $(NF-3)}'|sort|uniq -c|awk '{print $2"="$1;}' > /root/IP黑名单.txt
for i in `cat  /root/IP黑名单.txt`
do
  IP=`echo $i |awk -F= '{print $1}'`
  NUM=`echo $i|awk -F= '{print $2}'`
   if [ $NUM -gt 0 ];then
      grep $IP /etc/hosts.deny > /dev/null
    if [ $? -gt 0 ];then
      # 留了2个IP白名单
      A="0.0.0.0"
      B="0.0.0.1"
      if [[ $IP == *$B* ]] || [[ $IP == *$A* ]] || [[ $IP == *$C* ]]
      then
        echo "包含白名单$IP"
      else
        echo "$IP $(date "+%Y-%m-%d %H:%M:%S")" >> /root/IP第一次进入黑名单时间.txt
        echo "sshd:$IP:deny" >> /etc/hosts.deny
      fi
    fi
  fi
done

加入定时任务,30秒执行一次

crontab -e

*/30 * * * * /usr/local/bin/secure_ssh.sh >> /root/banlog.log