{"id":50,"date":"2014-02-18T12:47:33","date_gmt":"2014-02-18T04:47:33","guid":{"rendered":"http:\/\/blog.cyszys.com\/?p=50"},"modified":"2014-02-19T13:27:41","modified_gmt":"2014-02-19T05:27:41","slug":"%e9%98%b2%e6%ad%a2ssh%e6%9a%b4%e5%8a%9b%e7%a0%b4%e8%a7%a3linux%e5%af%86%e7%a0%81","status":"publish","type":"post","link":"http:\/\/blog.cyszys.com\/?p=50","title":{"rendered":"\u9632\u6b62SSH\u66b4\u529b\u7834\u89e3linux\u5bc6\u7801"},"content":{"rendered":"

\u670d\u52a1\u5668\u5728\u4e92\u8054\u7f51\u4e2d\uff0c\u6bcf\u5929\u90fd\u6709\u4e9b\u6ca1\u4e8b\u513f\u5e72\u7684\u4eba\u5728\u4f60\u7684\u673a\u5668\u7aef\u53e3\u626b\u6765\u626b\u53bb\uff0c\u8ba9\u7ba1\u7406\u5458\u975e\u5e38\u70e6\u607c\u3002\u672c\u6587\u63cf\u8ff0\u4e00\u4e2a\u65b9\u6cd5\uff0c\u5229\u7528\u672c\u6587\u4ecb\u7ecd\u7684\u811a\u672c\u7ed3\u5408iptables\u670d\u52a1\u4e00\u5e76\u4f7f\u7528\uff0c\u7528\u6765\u9632\u6b62\u516c\u7f51\u8ba1\u7b97\u673a\u901a\u8fc7ssh\u8fdb\u884c\u7528\u6237\u53e3\u4ee4\u66b4\u529b\u7834\u89e3\u3002\u76ee\u524d\u7a33\u91cd\u811a\u672c\u5df2\u7ecf\u5728\u5176\u4ed6\u9879\u76ee\u7684\u5b9e\u9645\u8fd0\u8425\u73af\u5883\u4e2d\u5f97\u5230\u9a8c\u8bc1\u3002<\/p>\n

\u811a\u672c\u5185\u5bb9\uff1a<\/p>\n

#!\/bin\/bash\n# \u9632SSH\u5bc6\u7801\u66b4\u529b\u7834\u89e3\u811a\u672c\n# \u901a\u8fc7\u5206\u6790secure\u65e5\u5fd7\u6587\u4ef6\u4f7f\u7528iptables\u62d2\u7edd\u6076\u610f\u767b\u5165IP\n# by WangJun CaoYinSheng 2014.01.27\n\nsource \/root\/.bash_profile     #\u811a\u672c\u8fd0\u884c\u73af\u5883\u53d8\u91cf\nFILE_DIR=\/opt\/security_tools     #\u7a0b\u5e8f\u6267\u884c\u8def\u5f84\nLOG_FILE=\/var\/log\/secure     #\u65e5\u5fd7\u8def\u8def\u5f84\nSAVE_FILE=$FILE_DIR\/belialIP     #\u4fdd\u5b58iptables\u62d2\u7eddIP\u6587\u4ef6\u540d\nSAVE_TEMP_FILE=${SAVE_FILE}.temp      #\u4e34\u65f6\u4fdd\u5b58\u62d2\u7eddIP\u6587\u4ef6\u540d,\u6bd4\u8f83\u7528\nIP_REPEAT=15;          #\u5141\u8bb8\u5c1d\u8bd5\u767b\u5165\u6b21\u6570\n\n#\u4e8c\u6b21\u6b63\u5219\u662f\u8003\u8651\u65e5\u5fd7\u6587\u4ef6\u8fc7\u5927\u5bfc\u81f4sort\u6392\u5e8f\u8fc7\u6162\u7684\u95ee\u9898\nip=`cat $LOG_FILE | awk -F\":\" '{print $1\":\"$2\":\"$3\":\"$4\"\"$7}' |sed -n -e '\/.*Failed password.*\/p' | sort | uniq -c | awk -v nnm=$IP_REPEAT '{if($1 > num) print $0;}' | sed -n -e 's\/.*Failed password.*from[ ]\\(.*\\)[ ]port.*\/\\1\/p'| awk '{a[$0]++}END{for(i in a){print i}}'`;\n\nbackIFS=$IFS;\nIFS=\"\\n\";\n\nif [ -e $SAVE_FILE ]\nthen\necho $ip > $SAVE_TEMP_FILE;\ndiffer=`comm -13 $SAVE_FILE $SAVE_TEMP_FILE`;\ntmp=`cat $SAVE_FILE`;\necho -e $differ\"\\n\"$tmp | uniq | sort > $SAVE_FILE;\nelse\ndiffer=$ip;\necho $ip > $SAVE_FILE;\nfi\n\nif [ ${differ} ]\nthen\nIFS=$backIFS;\nips=`echo $differ | tr \"\\n\" ' ' | tr -s ' '`;\n\nfor dip in $ips;\ndo\niptables -A INPUT -s $dip -j DROP\ndone;\nfi<\/pre>\n
\u90e8\u7f72\u65b9\u6cd5\uff1a<\/strong><\/em><\/p>\n
1\u3001<\/strong>\u5728\/opt\/security_tools\u76ee\u5f55\u4e0b\u521b\u5efa\u6587\u4ef6killer.sh\uff0c\u5e76\u5c06\u811a\u672c\u5185\u5bb9\u7c98\u8d34\u5230\u6587\u4ef6\u4e2d\uff1b<\/p>\n
2\u3001<\/strong>\u8fd0\u884ckiller\u811a\u672c\uff1a<\/p>\n
#<\/em>sh -x .\/killer.sh<\/p>\n
\u627e\u5230root\u8fd0\u884c\u811a\u672c\u7684\u73af\u5883\u53d8\u91cf\u53ef\u80fd\u5982\u4e0b\uff1a<\/p>\n
########\u8f93\u51fa\u5185\u5bb9   \u5f00\u59cb############\nPATH=\/usr\/local\/ImageMagick-6.8.8-2\/bin:\/usr\/kerberos\/sbin:\/usr\/kerberos\/bin:\/usr\/local\/sbin:\/usr\/local\/bin:\/sbin:\/bin:\/usr\/sbin:\/usr\/bin:\/usr\/X11R6\/bin:\/root\/bin:\/root\/bin\n########\u8f93\u51fa\u5185\u5bb9   \u7ed3\u675f#############<\/pre>\n
#crontable -e<\/p>\n
\u5c06\u4e0a\u8ff0\u73af\u5883\u53d8\u91cf\u7c98\u8d34\u5230crontable\u7684\u6700\u9876\u7aef\u4e00\u884c\uff1b<\/p>\n
3\u3001<\/strong>\u521b\u5efacrontable\u8ba1\u5212<\/p>\n
#crontable -e<\/p>\n
\u5728crontable\u914d\u7f6e\u6587\u4ef6\u4e2d\u6dfb\u52a0\u5982\u4e0b\u4fe1\u606f\uff1a<\/p>\n
########\u6dfb\u52a0\u5185\u5bb9   \u5f00\u59cb############\n*\/10 * * * * \/bin\/sh \/opt\/security_tools\/killer.sh &               #\u6bcf\u969410\u5206\u949f\u8fd0\u884c\u4e00\u6b21killer.sh\u811a\u672c\n01 22 * * 2,6 \/bin\/sh \/opt\/security_tools\/killer.sh &          #\u6ca1\u5468\u4e8c\u5468\u516d\u665a\u4e0a22\u70b901\u5206\u8fd0\u884c\u4e00\u6b21killer.sh\u811a\u672c\n* 22 * * 2,6 service iptables restart &                                #\u6ca1\u5468\u4e8c\u5468\u516d\u665a\u4e0a22\u70b9\u6574\u8fd0\u884c\u4e00\u6b21iptables\u670d\u52a1\u91cd\u542f\n########\u6dfb\u52a0\u5185\u5bb9   \u7ed3\u675f#############<\/pre>\n
\u00a04\u3001<\/strong>\u6d4b\u8bd5<\/p>\n
10\u5206\u949f\u540e\u67e5\u770biptables --list \u89c2\u5bdf\u662f\u5426\u5df2\u7ecf\u6709\u88ab\u5e72\u6389\u7684\u5730\u5740\u3002<\/p>","protected":false},"excerpt":{"rendered":"
\u670d\u52a1\u5668\u5728\u4e92\u8054\u7f51\u4e2d\uff0c\u6bcf\u5929\u90fd\u6709\u4e9b\u6ca1\u4e8b\u513f\u5e72\u7684\u4eba\u5728\u4f60\u7684\u673a\u5668\u7aef\u53e3\u626b\u6765\u626b\u53bb\uff0c\u8ba9\u7ba1\u7406\u5458\u975e\u5e38\u70e6\u607c\u3002<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,12],"tags":[16,15,17,14],"aioseo_notices":[],"_links":{"self":[{"href":"http:\/\/blog.cyszys.com\/index.php?rest_route=\/wp\/v2\/posts\/50"}],"collection":[{"href":"http:\/\/blog.cyszys.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.cyszys.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.cyszys.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.cyszys.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=50"}],"version-history":[{"count":3,"href":"http:\/\/blog.cyszys.com\/index.php?rest_route=\/wp\/v2\/posts\/50\/revisions"}],"predecessor-version":[{"id":53,"href":"http:\/\/blog.cyszys.com\/index.php?rest_route=\/wp\/v2\/posts\/50\/revisions\/53"}],"wp:attachment":[{"href":"http:\/\/blog.cyszys.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=50"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.cyszys.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=50"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.cyszys.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=50"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}