\u767b\u5f55\u670d\u52a1\u5668\u7684root\u7528\u6237\u65f6\uff0c\u53ef\u80fd\u4f1a\u6536\u5230\u5982\u4e0b\u63d0\u793a\uff1a<\/p>\n\n\n\n
There were 3225 failed login attempts since the last successful login.<\/pre>\n\n\n\n\u8fd9\u8868\u793a\u6709\u5f88\u9ed1\u5ba2\u5728\u5c1d\u8bd5\u7528\u4e00\u4e9b\u7528\u6237\u548c\u5bc6\u7801\u767b\u5f55\u670d\u52a1\u5668\u3002\u4e3a\u4e86\u4fdd\u969c\u670d\u52a1\u5668\u5b89\u5168\uff0c\u5219\u53ef\u4ee5\u5728\u65e5\u5fd7\u6587\u4ef6\/var\/log\/secure\u4e2d\u67e5\u770b\u653b\u51fb\u7684IPs\u6765\u6e90\u548c\u5176\u5931\u8d25\u767b\u5f55\u7684\u6b21\u6570\u3002\u4f8b\u5982\uff1a<\/p>\n\n\n\n
Invalid user neisius from 211.144.12.75 port 34041
Failed password for invalid user server from 219.94.99.133 port 15139 ssh2
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.217.39<\/pre>\n\n\n\n\u82e5\u67d0\u4e2aIP\u6b21\u6570\u5f88\u9ad8\uff0c\u5219\u5c06\u5176IP\u4fe1\u606f\u6dfb\u52a0\u5230\/etc\/hosts.deny\u6587\u4ef6\u4e2d\u8fdb\u884c\u5c01\u7981\u3002\u4f8b\u5982\uff0c\u4fee\u6539\/etc\/hosts.deny\u6587\u4ef6\u5185\u5bb9\uff1a<\/p>\n\n\n\n
sshd:101.109.83.140
sshd:103.27.238.202
sshd:104.236.94.202
sshd:106.12.200.13
sshd:106.12.217.39
sshd:106.54.19.67
sshd:111.230.73.133
sshd:117.50.45.254
sshd:118.24.38.53
sshd:122.155.223.119<\/pre>\n\n\n\n\u4e3a\u4e86\u80fd\u81ea\u52a8\u5730\u5c01\u7981IPs\uff0c\u7f16\u5199\u540d\u4e3aIP_denied_for_ssh_security.pl\u7684perl\u7a0b\u5e8f\uff1a<\/p>\n\n\n\n
#! \/usr\/bin\/perl\nuse strict;\n\nmy $usage = <<USAGE;\nUsage:\n $0 <num>\n\n \u8fd0\u884c\u7a0b\u5e8f\u540e\uff0c\u7a0b\u5e8f\u8bfb\u53d6\/var\/log\/secure\u6587\u4ef6\u4e2d\u4fe1\u606f\u3002\u82e5\u5b58\u5728\u67d0\u4e2aIP\u767b\u5f55\u5931\u8d25(\u542b\u6709Invalid user|Failed password|authentication failure\u7b49\u4fe1\u606f)\u6b21\u6570\u8d85\u8fc7\u6307\u5b9a\u7684\u6b21\u6570\uff0c\u5219\u662f\u9700\u8981\u5c01\u7981\u7684IP\u3002\u6b64\u5916\uff0c\u7a0b\u5e8f\u518d\u8bfb\u53d6\/etc\/hosts.deny\u6587\u4ef6\u4e2d\u7684IP\u4fe1\u606f\uff0c\u5f97\u5230\u6240\u6709\u9700\u8981\u5c01\u7981\u7684IP\u3002\u7136\u540e\u7a0b\u5e8f\u5c06\u8fd9\u4e9bIP\u4fe1\u606f\u5168\u90e8\u5199\u5165\u5230\/etc\/hosts.deny\u6587\u4ef6\u4e2d\u8fdb\u884c\u5c01\u7981\u3002\n \u7a0b\u5e8f\u9700\u8981\u4ee5root\u6743\u9650\u8fd0\u884c\uff0c\u56e0\u4e3a\u53ea\u6709root\u6743\u9650\u624d\u80fd\u8bfb\u53d6\/var\/log\/secure\u6587\u4ef6\uff0c\u5bf9\/etc\/hosts.deny\u8fdb\u884c\u5199\u5165\u3002\n \u7a0b\u5e8f\u8fd0\u884c\u5b8c\u6bd5\u540e\uff0c\u4f1a\u6e05\u7a7a\/var\/log\/secure\u6587\u4ef6\u5185\u5bb9\u3002\n\nUSAGE\nif(@ARGV==0){die $usage}\n\nopen IN, \"\/var\/log\/secure\" or die \"Can not open file \/var\/log\/secure, $!\";\nmy %num;\nwhile (<IN>) {\n if (m\/Invalid user\/ or m\/Failed password\/ or m\/authentication failure\/) {\n $num{$1} ++ if m\/(\\d+\\.\\d+\\.\\d+\\.\\d+)\/;\n }\n}\nclose IN;\n\nmy %deny;\nmy $deny_num = 0;\nforeach (keys %num) {\n if ($num{$_} >= $ARGV[0]) {\n $deny{$_} = 1;\n $deny_num ++;\n }\n}\nprint STDERR \"$deny_num IPs were detected for blocking from file \/var\/log\/secure.\\n\";\n\nopen IN, \"\/etc\/hosts.deny\" or die \"Can not open file \/etc\/hosts.deny, $!\";\nwhile (<IN>) {\n $deny{$1} = 1 if m\/(\\d+\\.\\d+\\.\\d+\\.\\d+)\/;\n};\nclose IN;\n\nopen OUT, \">\", \"\/etc\/hosts.deny\" or die \"Can not create file \/etc\/hosts.deny, $!\";\nmy $total_num = 0;\nforeach (sort keys %deny) {\n print OUT \"sshd:$_\\n\";\n $total_num ++;\n}\nclose OUT;\nprint STDERR \"Total $total_num IPs were banned by file \/etc\/hosts.deny for SSH security.\\n\";\n\nopen OUT, \">\", \"\/var\/log\/secure\" or die \"Can not create file \/var\/log\/secure, $!\";\nclose OUT;<\/code><\/pre>\n\n\n\n\u4f7f\u7528root\u7528\u6237\u6267\u884c\u8be5perl\u7a0b\u5e8f\uff0c\u82e5\u767b\u5f55\u5931\u8d25\u6b21\u6570>=3\u6b21\uff0c\u5219\u5c01\u7981\u5bf9\u5e94\u7684IP\u3002<\/p>\n\n\n\n
IP_denied_for_ssh_security.pl 3<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"\u767b\u5f55\u670d\u52a1\u5668\u7684root\u7528\u6237\u65f6\uff0c\u53ef\u80fd\u4f1a\u6536\u5230\u5982\u4e0b\u63d0\u793a\uff1a There were 3225 … \u7ee7\u7eed\u9605\u8bfb