awk入門-保護ssh防止暴力登陸

awk入門例子-保護SSHD

 

一臺Linux 服務器(不能用iptables )天天都有ssh 暴力鏈接，統計下最多居然達到5650次

1 secure 日誌

1. /bin/awk '/Failed/{print $(NF-3)}' /var/log/secure | /bin/sort | /usr/bin/uniq -c  | sort -rn 

   5650 123.29.68.70
    893 219.232.104.2
    139 87.110.156.171
    139 41.212.83.191
     75 111.74.82.33
     35 61.155.178.242
     32 201.236.80.4
     24 218.91.253.123
     15 122.194.200.3
      8 221.230.133.67
      7 190.146.233.184
      4 94.76.229.11
      4 77.76.109.119
      4 209.165.131.61
      3 208.254.58.144
      3 109.75.21.195
      2 93.189.94.179
      2 116.58.221.96
      2 109.75.21.200
      1 64.185.226.120
      1 138.100.78.80

secure日誌記錄 61.155.178.242 這個ip嘗試使用的帳戶 test/admin 等等

1. /bin/awk '/Failed/' /var/log/secure  | tail -n 35 

Oct  9 08:58:04 gw-new sshd[18864]: Failed password for root from 61.155.178.242 port 35336 ssh2
Oct  9 08:58:06 gw-new sshd[18866]: Failed password for root from 61.155.178.242 port 36064 ssh2
Oct  9 08:58:08 gw-new sshd[18868]: Failed password for root from 61.155.178.242 port 36365 ssh2
Oct  9 08:58:10 gw-new sshd[18870]: Failed password for root from 61.155.178.242 port 36643 ssh2
Oct  9 08:58:13 gw-new sshd[18872]: Failed password for root from 61.155.178.242 port 37517 ssh2
Oct  9 08:58:15 gw-new sshd[18874]: Failed password for root from 61.155.178.242 port 37852 ssh2
Oct  9 08:58:17 gw-new sshd[18876]: Failed password for root from 61.155.178.242 port 38683 ssh2
Oct  9 08:58:20 gw-new sshd[18878]: Failed password for root from 61.155.178.242 port 39059 ssh2
Oct  9 08:58:22 gw-new sshd[18880]: Failed password for root from 61.155.178.242 port 39919 ssh2
Oct  9 08:58:24 gw-new sshd[18882]: Failed password for root from 61.155.178.242 port 40181 ssh2
Oct  9 08:58:27 gw-new sshd[18884]: Failed password for root from 61.155.178.242 port 41065 ssh2
Oct  9 08:58:29 gw-new sshd[18886]: Failed password for root from 61.155.178.242 port 41404 ssh2
Oct  9 08:58:32 gw-new sshd[18888]: Failed password for root from 61.155.178.242 port 42254 ssh2
Oct  9 08:58:33 gw-new sshd[18890]: Failed password for invalid user oracle from 61.155.178.242 port 42614 ssh2
Oct  9 08:58:35 gw-new sshd[18892]: Failed password for invalid user test from 61.155.178.242 port 42997 ssh2
Oct  9 08:58:38 gw-new sshd[18894]: Failed password for invalid user admin from 61.155.178.242 port 43646 ssh2
Oct  9 08:58:40 gw-new sshd[18896]: Failed password for invalid user admin from 61.155.178.242 port 44022 ssh2
Oct  9 08:58:43 gw-new sshd[18898]: Failed password for invalid user test from 61.155.178.242 port 44820 ssh2
Oct  9 08:58:45 gw-new sshd[18900]: Failed password for invalid user admin from 61.155.178.242 port 45177 ssh2
Oct  9 08:58:47 gw-new sshd[18902]: Failed password for invalid user admin from 61.155.178.242 port 45979 ssh2
Oct  9 08:58:50 gw-new sshd[18904]: Failed password for root from 61.155.178.242 port 46233 ssh2
Oct  9 08:58:53 gw-new sshd[18906]: Failed password for root from 61.155.178.242 port 47140 ssh2
Oct  9 08:58:55 gw-new sshd[18908]: Failed password for root from 61.155.178.242 port 47430 ssh2
Oct  9 08:58:57 gw-new sshd[18910]: Failed password for root from 61.155.178.242 port 48241 ssh2
Oct  9 08:58:59 gw-new sshd[18912]: Failed password for root from 61.155.178.242 port 48526 ssh2
Oct  9 08:59:02 gw-new sshd[18914]: Failed password for root from 61.155.178.242 port 49295 ssh2
Oct  9 08:59:05 gw-new sshd[18916]: Failed password for root from 61.155.178.242 port 49739 ssh2
Oct  9 08:59:07 gw-new sshd[18918]: Failed password for root from 61.155.178.242 port 50554 ssh2
Oct  9 08:59:09 gw-new sshd[18920]: Failed password for root from 61.155.178.242 port 50838 ssh2
Oct  9 08:59:11 gw-new sshd[18922]: Failed password for root from 61.155.178.242 port 51625 ssh2
Oct  9 08:59:14 gw-new sshd[18924]: Failed password for root from 61.155.178.242 port 51876 ssh2
Oct  9 08:59:16 gw-new sshd[18926]: Failed password for root from 61.155.178.242 port 52718 ssh2
Oct  9 08:59:18 gw-new sshd[18928]: Failed password for root from 61.155.178.242 port 52969 ssh2
Oct  9 08:59:21 gw-new sshd[18930]: Failed password for root from 61.155.178.242 port 53268 ssh2
Oct  9 08:59:22 gw-new sshd[18932]: Failed password for root from 61.155.178.242 port 54034 ssh2


2 編寫shell 腳本

思路:使用crontab 每3分鐘執行一次defend_ssh.sh腳本, defend_ssh.sh調用 defend_ssh.awk 程序，awk 程序分析/var/log/secure日誌，並輸出超過20次的Failed ip地址 ，由shell腳本輸出到 /etc/hosts.deny 文件，以達到拒絕某IP的目的，因爲secure日誌將保留7天，因此 此IP 將被拒絕7天。

1. crontab -l 

*/3 * * * *  /root/sh/defend_ssh.sh >> /root/sh/cron_log 2>&1

1. cat defend_ssh.sh  
2. #!/bin/bash 
3. #Defend sshd  
4. #Deny More than 20 black ip to "/etc/hosts.deny" 
5. #/var/log/secure* log rotate every 7 days 
6. #20120928 by dongnan
7.  
8. #variables 
9. allow_num=20 
10.  
11. #main 
12. /bin/awk -v allow=$allow_num -f /root/sh/defend_ssh.awk /var/log/secure > /etc/hosts.deny 

1. cat defend_ssh.awk  
2. /Failed/ { ++S[$(NF-3)]}  
3. END { 
4.     for (a in S) {  
5.         if(S[a] > allow) print "sshd:"a 
6.     } 
7. } 

awk 程序入門

-v 選項用於使用外部變量，這裏在shell 中定義變量allow_num=20

-f 選項用於調用awk 程序

/Failed/ 爲模式部分，具體是使用/正則表達式/ 匹配含有 Failed 行

{ ++S[$(NF-3)]}  爲動做部分，使用數組每匹配一個Failed 則 ip([$(NF-3)]) 加1

END是特殊的動做，用於全部輸入數據已經被處理完成以後，它多半用於產生摘要報告，這裏則是使用循環for 讀取數組S 元素 ，並使用if 語句判斷是否大於20次，條件真則使用print 語句 輸出。

 

3 測試-超過20次拒絕鏈接

1. awk '/refused/' /var/log/secure 

Oct  8 22:55:01 gw-new sshd[10324]: refused connect from ::ffff:218.91.253.123 (::ffff:218.91.253.123) Oct  9 06:25:03 gw-new sshd[18367]: refused connect from ::ffff:201.236.80.4 (::ffff:201.236.80.4) Oct  9 15:47:11 gw-new sshd[20491]: refused connect from ::ffff:61.155.178.242 (::ffff:61.155.178.242) Oct  9 16:31:38 gw-new sshd[20742]: refused connect from ::ffff:61.155.178.242 (::ffff:61.155.178.242) Oct  9 21:39:45 gw-new sshd[21892]: refused connect from ::ffff:61.155.178.242 (::ffff:61.155.178.242) Oct 10 07:05:03 gw-new sshd[30559]: refused connect from ::ffff:211.113.151.201 (::ffff:211.113.151.201) Oct 10 07:36:47 gw-new sshd[30668]: refused connect from ::ffff:61.155.178.242 (::ffff:61.155.178.242)