Linux SSH 登录失败多少次禁止该IP访问 防止暴力破解

Linux 系统SSH 登录失败的内容会记录到/var/log/secure文件，通过查找关键字 Failed，可以定位到这些异常的IP地址，比如：

[root@www.cndba.cn ~]# cat /var/log/secure|grep 36.250.229.118
Jan 10 16:54:25 iZbp15upsrdbnwnq3zksepZ sshd[10813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.101.235  user=root
Jan 10 16:54:25 iZbp15upsrdbnwnq3zksepZ sshd[10813]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jan 10 16:54:27 iZbp15upsrdbnwnq3zksepZ sshd[10813]: Failed password for root from 103.152.101.235 port 59352 ssh2
Jan 10 16:54:27 iZbp15upsrdbnwnq3zksepZ sshd[10813]: Connection closed by 103.152.101.235 port 59352 [preauth]
Jan 10 16:54:29 iZbp15upsrdbnwnq3zksepZ sshd[10820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.101.235  user=root
Jan 10 16:54:29 iZbp15upsrdbnwnq3zksepZ sshd[10820]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jan 10 16:54:31 iZbp15upsrdbnwnq3zksepZ sshd[10820]: Failed password for root from 103.152.101.235 port 60970 ssh2
Jan 10 16:54:31 iZbp15upsrdbnwnq3zksepZ sshd[10820]: Connection closed by 103.152.101.235 port 60970 [preauth]
Jan 10 16:54:33 iZbp15upsrdbnwnq3zksepZ sshd[10825]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.101.235  user=root
Jan 10 16:54:33 iZbp15upsrdbnwnq3zksepZ sshd[10825]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jan 10 16:54:35 iZbp15upsrdbnwnq3zksepZ sshd[10825]: Failed password for root from 103.152.101.235 port 34445 ssh2
Jan 10 16:54:35 iZbp15upsrdbnwnq3zksepZ sshd[10825]: Connection closed by 103.152.101.235 port 34445 [preauth]
Jan 10 16:54:37 iZbp15upsrdbnwnq3zksepZ sshd[10831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.101.235  user=root
Jan 10 16:54:37 iZbp15upsrdbnwnq3zksepZ sshd[10831]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jan 10 16:54:39 iZbp15upsrdbnwnq3zksepZ sshd[10831]: Failed password for root from 103.152.101.235 port 36166 ssh2
Jan 10 16:54:39 iZbp15upsrdbnwnq3zksepZ sshd[10831]: Connection closed by 103.152.101.235 port 36166 [preauth]
Jan 10 16:54:41 iZbp15upsrdbnwnq3zksepZ sshd[10836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.101.235  user=root
Jan 10 16:54:41 iZbp15upsrdbnwnq3zksepZ sshd[10836]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jan 10 16:54:43 iZbp15upsrdbnwnq3zksepZ sshd[10836]: Failed password for root from 103.152.101.235 port 37866 ssh2
Jan 10 16:54:43 iZbp15upsrdbnwnq3zksepZ sshd[10836]: Connection closed by 103.152.101.235 port 37866 [preauth]
Jan 10 16:54:45 iZbp15upsrdbnwnq3zksepZ sshd[10841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.101.235  user=root
Jan 10 16:54:45 iZbp15upsrdbnwnq3zksepZ sshd[10841]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jan 10 16:54:47 iZbp15upsrdbnwnq3zksepZ sshd[10841]: Failed password for root from 103.152.101.235 port 39832 ssh2
Jan 10 16:54:47 iZbp15upsrdbnwnq3zksepZ sshd[10841]: Connection closed by 103.152.101.235 port 39832 [preauth]
Jan 10 16:54:49 iZbp15upsrdbnwnq3zksepZ sshd[10847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.101.235  user=root
Jan 10 16:54:49 iZbp15upsrdbnwnq3zksepZ sshd[10847]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jan 10 16:54:51 iZbp15upsrdbnwnq3zksepZ sshd[10847]: Failed password for root from 103.152.101.235 port 41558 ssh2
Jan 10 16:54:52 iZbp15upsrdbnwnq3zksepZ sshd[10847]: Connection closed by 103.152.101.235 port 41558 [preauth]

比如这里，明显这个IP地址在进行SSH 扫描，不断的更换端口和用户进行暴力测试。

在Linux里面有两个相关的文件：

/etc/hosts.allow： 允许哪些IP访问主机

cat /etc/hosts.allow
sshd:19.16.18.1:allow
sshd:19.16.18.2:allow

/etc/hosts.deny 禁止哪些IP访问主机:

cat /etc/hosts.deny
sshd:13.7.3.6:deny
sshd:92.4.0.4:deny
sshd:94.10.4.2:deny
sshd:94.4.1.6:deny
sshd:11.64.11.5:deny

因此，我们只需要从/var/log/secure文件中提取IP地址，如果次数达到10次则将该IP写到 /etc/hosts.deny中，禁止这些IP访问主机。

脚本如下secure_ssh.sh：

#! /bin/bash
cat /var/log/secure|awk '/Failed/{print $(NF-3)}'|sort|uniq -c|awk '{print $2"="$1;}' > /boss/config/black.list
for i in `cat  /boss/config/black.list`
do
  IP=`echo $i |awk -F= '{print $1}'`
  NUM=`echo $i|awk -F= '{print $2}'`
  echo $IP=$NUM
  if [ $NUM -gt 10 ]; then
    grep $IP /etc/hosts.deny > /dev/null
    if [ $? -gt 0 ];then
      echo "sshd:$IP:deny" >> /etc/hosts.deny
    fi
  fi
done

将secure_ssh.sh脚本放入cron计划任务，每1小时执行一次。

# crontab -e
0 */1 * * *  sh /usr/local/bin/secure_ssh.sh