shell脚本自动拉黑ssh登录失败3次以上的IP

#!/bin/bash

#Created By T.Sweet

iptables_file=/etc/sysconfig/iptables      #防火墙配置文件

IP_ADDR=`tail -n 500 /var/log/secure | grep "Failed password"  | awk ‘{print $11}‘ | uniq -c | awk ‘$1>= 3{print $2}‘`

#取出登录错误3次以上的IP

cat $iptables_file | grep $IP_ADDR  > /dev/null

if [ $? -ne 0 ];then

sed -i "/lo/a -A INPUT -s $IP_ADDR -p tcp --dport 22 -j DROP"   $iptables_file

/etc/init.d/iptables restart

else

echo "This ip has already Deny"

fi

练习写着玩  。。。。。