自动封堵暴力破解ssh账号的入侵者
(2011-05-10 23:24)
无限发现他的ssh服务器有人企图暴力破解账号，我也自查了一下，发现我也一样受到了此类攻击，ssh中的相关log如下：
- May 10 23:20:21 localhost sshd[9075]: Invalid user x from x.x.x.x
- #!/usr/bin/ruby
-
#
-
-
class Daemon
-
def Daemon.start
-
exit!(0) if fork
-
Process::setsid
-
exit!(0) if fork
-
Dir::chdir("/")
-
File::umask(0)
-
STDIN.reopen("/dev/null")
-
STDOUT.reopen("/dev/null", "w")
-
STDERR.reopen("/dev/null", "w")
-
yield if block_given?
-
end
-
end
-
-
def block_ip(ip)
-
cmd = "iptables -A block_ip -s #{ip} -j DROP"
-
system(cmd)
-
end
-
-
def block_invalid(filename)
-
block_limit = 10
-
-
log_file = File.new(filename)
-
ips = Hash.new
-
blocked_ips = Hash.new
-
log_file.each do |line|
-
field = line.split
-
if field[5] == "Invalid"
-
ip = field[field.length - 1]
-
if ips.key?(ip)
-
ips[ip] += 1
-
else
-
ips[ip] = 1
-
end
-
if ips[ip] > block_limit and not blocked_ips.key?(ip)
-
blocked_ips[ip] = 1
-
block_ip(ip)
-
end
-
end
-
end
-
end
-
-
if system("iptables -nvL block_ip &>/dev/null")
-
system("iptables -F block_ip")
-
else
-
system("iptables -N block_ip")
-
system("iptables -I INPUT -j block_ip")
-
end
-
-
Daemon.start do
-
block_invalid("/var/lib/myips.fifo")
- end
防攻击```