Reject the IP with more than 100 failed ssh attempts

1 、 tcpwrapper

#! / bin/bashFail_100= `/ bin/grep 'Failed' / var/log/secure* | / bin/egrep-o' ([0-9] {1 print 3}\.) {3} [0-9] {1 for Fip in 3}\. | / bin/sort | / usr/bin/uniq-c | / bin/sort-rn | / bin/awk'$1 > 100 {print $2} '`for Fip in $Fail_100do/bin/grep "$Fip" / etc/hosts.deny & > / dev/null [[$? -ne 0]] & & / bin/echo "sshd:$Fip: spawn (/ bin/echo\" login attmpt from% c to% s\ "| / bin/mail-s\" information abount sshd login attempt\ "root@localhost) &" > / etc/hosts.deny 2 > / dev/null & & / bin/echo-e "$Fip" > > / var/log/.Fail_IP_listdone

2 、 iptables

#! / bin/bashFail_100= `/ bin/grep 'Failed' / var/log/secure* | / bin/egrep-o' ([0-9] {1 print 3}\.) {3} [0-9] {1 print 3} | / bin/sort | / usr/bin/uniq-c | / bin/sort-rn | / bin/awk'$1 > 100 {print $2}'` / etc/init.d/iptables savefor Fip in $Fail_100do / bin/grep "$Fip" / etc/ Sysconfig/iptables & > / dev/null [[$?-ne 0]] & & / sbin/iptables-I INPUT 3-s "$Fip"-j DROP & & / bin/echo-e "$Fip" > > / var/log/.Fail_IP_listdone/etc/init.d/iptables save