小企鵝開談 : [分享]一張網卡 bind 兩個不同網段的 IP

Jan 21 05:32:32 www sshd[24782]: Invalid user office from ::ffff:210.202.33.129
Jan 20 21:32:32 www sshd[24783]: input_userauth_request: invalid user office
Jan 21 05:32:35 www sshd[24782]: Failed password for invalid user office from ::ffff:210.202.33.129 port 61321 ssh2

#!/bin/bash
# Name: banip.sh
# Author: Andowson Chang (andowson [at] gmail [dot] com)
# Version: 0.1
# Last Modified: 2007-01-21

# 修改這邊的參數
EXTERNAL_INTERFACE="ppp0" # you must edit this
BANNEDHOSTFILE="/tmp/bannedhosts.txt" #edit this as required
HISTORYHOSTSFILE="/tmp/history.txt" #edit this as required
IPTABLES="/sbin/iptables"
GREP_PARAM="^[[:digit:]]*\.[[:digit:]]*\.[[:digit:]]*\.[[:digit:]]*"

# 找出攻擊的主機IP
grep "Failed password for invalid user" /var/log/secure | cut -d" " -f13 | sort | uniq | cut -d":" -f4 > /tmp/attack.log
grep "Failed password for invalid user" /var/log/secure | cut -d" " -f14 | sort | uniq | cut -d":" -f4 >> /tmp/attack.log

# 刪除一些不是IP的字，目前發現的有from和port，也可以包含測試用的來源IP
sed -e '/from/d' -e '/port/d' -e '/192.168.1/d' /tmp/attack.log > /tmp/attack.txt

# 加入新增的主機
touch $HISTORYHOSTSFILE
sort /tmp/attack.txt | uniq > /tmp/ip1
sort $HISTORYHOSTSFILE | uniq > /tmp/ip2
comm -23 /tmp/ip[1-2] > $BANNEDHOSTFILE   # 新增站台資料
rm -rf /tmp/ip[1-2]
rm -rf /tmp/attack.*

# 將攻擊的主機IP加到iptables擋掉
for i in $( grep $GREP_PARAM $BANNEDHOSTFILE )
do
	echo "Deny access to host: $i"
	$IPTABLES -A INPUT -i $EXTERNAL_INTERFACE -s $i -j DROP
	$IPTABLES -A OUTPUT -o $EXTERNAL_INTERFACE -d $i -j DROP
done

# 將處理過的IP清單加到歷史檔去
cat $BANNEDHOSTFILE >> $HISTORYHOSTSFILE
sort $HISTORYHOSTSFILE | uniq > /tmp/history.tmp
mv -f /tmp/history.tmp $HISTORYHOSTSFILE
rm -rf $BANNEDHOSTFILE

# ban intruder's ip (2007.01.21)
2 */5 * * * * root /root/admin/banip.sh > /var/log/banip.log

view sourceprint?1 iptables -D INPUT -i ppp0 -s 192.168.1.5 -j DROP
iptables -D OUTPUT -o ppp0 -d 192.168.1.5 -j DROP

view sourceprint?1 mv /tmp/history.txt /tmp/history.txt-`date +%Y%m%d`