应用介绍

怎么提高云服务器的安全性能， 如何让服务器避免密码被暴力破解呢， /var/log/secure日志记录一些ip访问这台服务器的日志信息，经常发现有这样的提示：

Jan 17 13:55:02 10-9-43-230 sshd[116965]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.199.114
Jan 17 13:55:04 10-9-43-230 sshd[116965]: Failed password for invalid user sysadm from 51.68.199.114 port 47718 ssh2
Jan 17 13:55:47 10-9-43-230 sshd[117665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.29.155.214
Jan 17 13:55:49 10-9-43-230 sshd[117665]: Failed password for invalid user oracle from 119.29.155.214 port 56482 ssh2

咱们放到定时任务，每隔一分钟执行脚本一次：修改 /etc/crontab文件

*/1 * * * * root  /usr/local/bin/secure_ssh.sh

#! /bin/bash
cat /var/log/secure|awk '/Failed/{print $(NF-3)}'|sort|uniq -c|awk '{print $2"="$1;}' > /usr/local/bin/black.list
for i in `cat  /usr/local/bin/black.list`
do
  IP=`echo $i |awk -F= '{print $1}'`
  NUM=`echo $i|awk -F= '{print $2}'`
  if [ ${#NUM} -gt 1 ]; then
        echo $IP
    grep $IP /etc/hosts.deny > /dev/null
    if [ $? -gt 0 ];then
      echo "sshd:$IP:deny" >> /etc/hosts.deny
    fi
  fi
done
~