对抗暴力破解

1、iptables规则

iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

2、编写脚本，通过/var/log/secure记录的ssh登陆请求，写入IP到/etc/hosts.deny

#! /bin/bash
cat /var/log/secure|awk '/Failed/{print $(NF-3)}'|sort|uniq -c|awk '{print $2"="$1;}' > /usr/local/bin/black.list
for i in `cat  /usr/local/bin/black.list`
do
	IP=`echo $i |awk -F= '{print $1}'`
	NUM=`echo $i|awk -F= '{print $2}'`
	
        #例外IP,准确IP与阿里云内网IP
        if [[ "$IP" = "此处输入例外IP" ]] || [[ $IP =~ 10\.[0-9]*\.[0-9]*\.[0-9]* ]]
        then
            echo ""
        elif [ $NUM -gt 3 ]
        then
            grep $IP /etc/hosts.deny > /dev/null
            if [ $? -gt 0 ]
            then
                echo "sshd:$IP:deny" >> /etc/hosts.deny
            fi
        fi
done