[script] ssh 22번 포트로 해킹 시도하는 ip block

1. secure 로그에 쌓이는 해킹시도 IP 추출 script

[root@ ~]# vi block-ip.sh 

#!/bin/sh

## Blocking invalid user's IPs

#

grep "Failed password for" /var/log/secure | egrep -v "invalid user" | egrep -v "{USERID}|{125.1xx.xxx.xxx}" | awk '{print $11}' | uniq | sed "s/^/all:/" > /root/ssh-login-ip

grep "Failed password for invalid user" /var/log/secure.1 | awk '{print $13}' | uniq | sed "s/^/all:/" >> /root/ssh-login-ip

cat /root/ssh-login-ip /etc/hosts.deny | sort | uniq > /root/hosts.deny

cp /root/hosts.deny /etc/hosts.deny

2. crontab에 등록

[root@ ~]# crontab -e 

* * * * /usr/bin/vncserver :1 >/dev/null 2>&1

*-/05 * * * * /root/block-ip.sh

3. crond 재시작

[root@ ~]# service crond restart