crontab -e
## block those who try to brute-force the SSH password
59 * * * * sh ~/ssh_security.sh
vim ~/ssh_security.sh
1 #!bin/bash
2
3 #$(date +%Y%m%d)
4 n_day=$(date +%d)
5 n_houer=$(date +%H)
6 oldii="111"
7 declare -i count=0
8 allip=`cat /var/log/secure | grep Invalid | grep $n_day" "$n_houer":" | grep -E -o '[0-9]{1,3}(\.[0-9]{1,3}){3}'`
9
10 for i in $allip
11 do
12
13 if [ $oldii != $i ]; then
14 if [ $count -gt 3 ]; then
15 echo $(date)"|"$oldii"|"$count >> "/var/log/ssh_security_lomix.log"
16 iptables -A INPUT -s $i -j DROP
17 fi
18 oldii=$i
19 count=0
20 else
21 count=$count+1
22 fi
23 #echo "-"$i
24 done
25 exit 0