将登陆失败的IP自动加入deny禁用掉（数量太多的话会有比较多无用的消耗，待优化）

#!/bin/sh
# * * * * * [[ -z $(ps -ef|grep -v grep|grep secure_check_login_fail.sh) ]]  && /bin/sh /root/secure_check_login_fail.sh >> /root/secure_check_login_fail.sh.log 2>&1
echo "--start--"
date
host=$(hostname)
aaa=$(cat /var/log/secure* |grep fail|grep -Eo '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'|sort -u|grep -v ^192\.168|grep -v ^172\.16|grep -v ^10\.)
for i in ${aaa}
do
    if [[ -z $(grep ${i} /etc/hosts.deny) ]] && [[ -z $(grep ${i} /root/secure_check_ip_list 2>/dev/null) ]]
    then
        # 调用接口获取IP的属地
        # country=$(curl http://192.168.0.24:9090/get_country/${i} 2>/dev/null)
        # if [[ ${country} != '中国' ]]
        # then
            echo "sshd: ${i}" >> /etc/hosts.deny
            echo "检测到ip ${i}登陆${host}失败，地址不为中国，已加入deny，返回值为：${country}"
        # fi
        echo "${aaa}" >> /root/secure_check_ip_list
    fi
done
date
echo "==end=="

标签：deny,grep,secure,IP,echo,sh,禁用,fail,check
来源： https://www.cnblogs.com/yscheng/p/16372210.html