Use shell to prevent email from being cracked violently

Mailbox server is placed in the intranet mapping company IP, after opening the port, has been constantly violently cracked, depressed to death. One of the IP has 6W multiple times; thus using scripts to block IP access.

1. The script is as follows:

#! / bin/bash# author: kuangl# mial: kuangl@orient-media.com# date: 2013-05-04source / etc/profileawk-F "['/ disconnect from unknown/ {print $NF}'/ var/log/maillog | grep-v" 189.154.4.22 "| sed" s /] / / g "| sort-nr | uniq-c | sort | awk'{print $1" = "$2}'> / root/bad_ip_tmp.txtawk-F": "'/ verification failed/ {print" $5}'/ var/log/maillog | grep-v "189.154.22" | grep-v "SASL" | sort-nr | uniq-c | awk'{print $1 "=" $2}'> > / root/bad_ip_tmp.txtawk-F "-"'/\ / phpmyadmin\ / scripts\ / setup\ .php / {print $1}'/ var/log/httpd/access_log | grep-v "189.154.22" | sort-nr | uniq-c | sort-n | awk'{print $1 "= "$2}'> / root/bad_ip_tmp.txtawk-F"-"'/ ZmEu/ {print $1}'/ var/log/httpd/access_log | grep-v" 189.154.4.22 "| sort-nr | uniq-c | sort-n | awk'{print $1" = "$2}'> > / root/bad_ip_tmp.txtsort / root/bad_ip_tmp.txt | uniq > / root/bad_ip.txtDEFINE=" 2 "for i in $(cat / root/bad_ip) .txt) doNUM= `echo $I | awk-F "='{print $1} '`IP= `echo $I | awk-F" =' {print $2} '`if [$NUM-ge $DEFINE] Theniptables-L-n | grep $IP > / dev/nullif [$?-gt 0]; theniptables-I RH-Firewall-1-INPUT 4-s $IP-j DROPfifidone

2. If the task is scheduled to run every 5 minutes

* / 5 * / home/kuangl/deny_bad_ip_for_smtp.sh0 1 * / etc/init.d/iptables restart

3. Check the firewall

DROP all-192.241.206.14 0.0.0.0/0DROP all-198.50.251.242 0.0.0.0/0DROP all-198.23.245.154 0.0.0.0/0DROP all-217.139.66.140 0.0.0.0/0DROP all-134.0 .27.102 0.0.0.0/0DROP all-- 218.22.226.6 0.0.0.0/0DROP all-- 218.22.226.5 0.0.0.0/0DROP all-- 202.158.163.158 0.0.0.0/0DROP all-- 109.169.86.193 0.0.0.0