From 86d7bf5780e8e28eb69deccb324bd0d4c63eae7a Mon Sep 17 00:00:00 2001 From: aixiao Date: Sun, 11 Jul 2021 10:10:55 +0800 Subject: [PATCH] =?UTF-8?q?=E7=9B=B4=E6=8E=A5=E8=B0=83=E7=94=A8IPtables?= =?UTF-8?q?=E7=A6=81=E7=94=A8IP=E5=9C=B0=E5=9D=80.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Makefile | 2 +- README.md | 2 ++ denyhosts.sh | 12 ++------ rhost | Bin 20408 -> 23216 bytes rhost.c | 76 ++++++++++++++++++++++++++++++++++++--------------- rhost.o | Bin 8552 -> 16176 bytes 6 files changed, 60 insertions(+), 32 deletions(-) diff --git a/Makefile b/Makefile index b28e241..4f1f793 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,6 @@ CROSS_COMPILE ?= CC := $(CROSS_COMPILE)gcc -CFLAGS += -g -Wall +CFLAGS += -O2 -g -Wall OBG = rhost diff --git a/README.md b/README.md index 6314e30..60d4639 100644 --- a/README.md +++ b/README.md @@ -2,11 +2,13 @@ ssh防止暴力破解,适用Debian 8、9 +## Help Information cd /root git clone https://github.com/niuyuling/denyhosts.git cd denyhosts make clean; make chmod a+x /root/denyhosts/denyhosts.sh + crontab 定时任务,像这样. 0 22 * * * /root/denyhosts/denyhosts.sh diff --git a/denyhosts.sh b/denyhosts.sh index 057a344..35b66a2 100644 --- a/denyhosts.sh +++ b/denyhosts.sh @@ -7,8 +7,7 @@ # function init() { - num=20; - send_mail=1; + send_mail=0; pwd_path="/root"; TIME=`date +"%Y%m%d%H%M"`; log_file="${pwd_path}/${TIME}.log"; @@ -31,13 +30,7 @@ function run() echo "System SSH authorization information:" &>> ${log_file} /root/denyhosts/rhost | awk '{a[$1]+=1;} END {for(i in a){print a[i]" "i;}}' &>> ${log_file} - ip=$(echo $(/root/denyhosts/rhost | awk -v num=${num} '{a[$1]+=1;} END {for(i in a){if (a[i] >= num) {print i;}}}')) - - - ip_address=($ip) - for i in ${ip_address[@]} ; do - /sbin/iptables -I INPUT -s $i -j DROP - done + /sbin/iptables-save > /root/ipv4tables echo "" &>> ${log_file} @@ -59,5 +52,6 @@ exit 0; 20190103 20190911 20191008 +20210614 aixiao@aixiao.me diff --git a/rhost b/rhost index 7c397cd201cd07c60e39efd2b5570cee0a282a4f..0d124a580ebd2fd767a34dcbdf5a469f55504d86 100644 GIT binary patch literal 23216 zcmeHPeRx#WnLl@KW-^lrlYs_)w5Rk9PBnF&7fPe`fDqJS>k&GlWaXx^6 zR21zx+9XX9cwL$!emm}HH^4(Xo3rVNuzNvJX-6#CeJJcc6n2uH zqY5EOD&t8pq2qbsFPFBF5t5{&OR4jXWRUXPYdAZJt} zrBc*iQqf%2&>!hpy11b~Sl=IsruNtGU$(S<>0(bJ=2^tsU4e?wn7VFbH(T(?gX^E( zb?J-aE4to)=c;wfFPwSxQK~o9f&7sUCDNDSCpr@c$&Gg1j+}uJJrnxz0MSBe7X&l% z2p1HI9HazYqAlTxH@D$#`IJh$RN&k!Ui^21D_9EY5U2l86PC zFV_=^fIk{0tthDt#s))C;*zm`7VZrt6U6ib8wd>~LP_HApA823V~G&!j|Kew$;dzm z4g>rBdN>mG_eTy8i}N9%CzAenQXlX~$mbvxKro#ZOWAcD?XB19i#%6na*I4mnBLyC zK@W!Fq25R$8H#spxVAqQ4R!f@`pIeUKrAYp>V|4wMKs&O&m8(S|1)q^U{Z_1qyRe# zO8rD>b|f;5&cM$hPgtrtf+1^R50el{UN7bKZG=v6r1Ro>DDlGrKjGzKCUME1U2WiW zPSg1=(>W7fB0OdR{4y^m95-Kwy(XM&Wb%299APp>gmil8*YHo*44JljjU4GaB?!9P zYcPbP12d`5Yh(#`Wl+WjO?a6J-*3X@m>}_C6F!{)k?!^y8S-yFKaZMlF%%5Nso$vx zOhsTS0#gx~iojF^3P!+p@L`BA#wx#&&c5bHvlF%UCDpKSg{A@m|i~LpB95M> z_@L-#Y8%lLzVxbEC~-+Ry|2hOyrc>ZGL$;fzlF@mhuhNE6&*QL>L|PK+hjM~JPmrI zXHguggz->zX9#!)nl$UJEoF1tNN34U5G+(<^mS4jUUG`FKR{*M)2Ew8M(+Xq6s*v& ziydg{D}SM;BKH(^%IJEC;rRZ`ctzj*o{Q7hMlS;n2Pic4U`P4_>XLwC_#=DYy;s&g zMYnfNBPg*BmFyUM)~9qG3byi;vObE#TCBXD@h z2rPk)J`C2VesZBNJ<+TVQiI3Gsit$mbfm{eXM;A4yfqz-JVqt&1OEht%y;|qG=^^6 z*>Y3M&X!#*`g0f^qc8j?nO$rjUS%7740#^NaN0fg3|bB!C&|ZURFKhWcTtSr`a18g zrr)=x&+PK0f8{&!>+_vm9mCcY6!76`KcnJ?n^(bXeCEqnF!l%0zs<+4B#HGNBFjHa z&cx;6>yV=rNyqp(5trv=e1@C-Tz|<8L>6B3rO*4GeS5X<*$-8pa>{q+VzL4b?h+2{ z9BF^JxdwJD)zIxb(j0~sBK}6Q)OT;Q1^DPNnmgKuDxR`_1fjB1+DSTg5W=vh zZ0?;fW$b9nwvOTEvW1MbY;8}!+|u2i{-C9+CHzTtWX`1+28f1zvMsQPEb>)F4k z$vI80md!;UzK8y8OaHcIyy7+Ak>?cO@?WOjq-&w6GoVLTMt;rAx=Ql0r+%g)FcpER z2uwv_Dgsjxn2Nwu1g0YJ|2_h=E)!?*zE~n@{5H=|h*c_H_uhDDP^({~&D&L57xX7X z+Po{~_sv`Anc#x+7S7We_WI)u{juH#e=6DMK}Ne(XGa1I_b;@aVs>wrS@T%}py0X=^sNX$QlxcwIz` zL^c1ygORXS=f5$sQ@f^_3>Ipl{K(2fhYl^!Q16CBPbAt98BEfOSwgFC*V;FBc6Vv@ z32i>uo3*wrn>wMV%u!d;8Yw-53|+PEC24QTFjh{@-V$;8tO(5S7hoy<|Z7Kz#pWiI;}4E{gzf&<$Y?aOB*g~ zb=7^++Tv>bgssK3>`3u-uA`?*)iz6sYZ<^6R~?j~45L<;y~Sy~fAARGY)Acff*StX z$=@3Cw}$++kw2f|&wFz|SA5Oz4=^8u9}zP0HkGC#FcpER2uwv_Dgsjxn2Nwu1g0V| z6#+y*zCS15my`F*av`%+M#*htXhD?HV)0U2mBD7-%bO#3IajC_ynH{8<|ve;{DX_* zG0xLUFp_+i%_}nU9kxaxr?o;#9~dO_4qBz)&F|U~B+MA|8VWR3p>#NBKE)SGfz$h? zl(q{%;>SfrWW7hY7Gv_=I9Wbck9d0^=Bik6<2+xv28dND&dWHT7yMG;|0BU?>MhFo zzb5j%^4xNligB=3(5-@o1>Gy?Cj|WmK_3zHJA$4P^kqSRBj^P|ZQ>=rS%O|}e(4XD zI^i{HcHOntuF&e*LOl_GRBLMVEb=tfFI^~d+M>oqO^r=WjqFNj8(nX7pjWu#Q&+=N z*6#(V6>-F_jG?be7lFAM9vZXM;FKoY>Y3R~h}es7gRWXsd?!eeT~+LJh_@7f50Ste5AI5 zGj)zvNV1YMjgDTDtm4cv$1ajIbH?kqiM)9^<8xFH)54if2VEGft(@8JxR;o=S!-ar z+wm?rSX;3kq|b3P+4y*^2OYJ&+rOQ@`(W1o03QSlVilydifaA4&7iHc`AP%nVj zhGt&Qfi?>JAK>73I4T~8N2Pq-yWHyNlZkRXlmu{t0i1X`QSlPgl=5B!IQiW~#n;Kr z%+g0-S#<2~ClfQ0sL3q11rgc`tP{s9JD5G@x0n^rw5Je<+0_ty5gHHSs7wisI)GJ5 zx8)FiyOhQ%WwU~@T%8b?w#5+t9L7-L1+wacLgIzw?JUW#kaR#&fxo=m2GNj?)%I1j ztoq9)trZ!q*M_pSDn<3S!B^POa;Tby<|9GXp%!U8kGifFxFqAeJN-*XvJeN`3thBM}cZB9QpgCY@79Bgq1IImG z6!K>vzl+Pecs0t(8BY|-uNijMV;??|u;qlYPUxM6-Va4h5~yLbz^R5~0>71N$j8iP zgql@%2puZJh4D-yitCvBDJYaEXjcg(-cRPB-6E8J4yE-%iGn#~!UF=Q&PogXb?Dz= z;0|@Bh#aeaREXb(_;bRH!u~CRQ!u~D@h{c<6Py}Tsj#qA!wR{%k7gm*)E+9nI)nqexNFyaUYB0%1Q`b)7acU;)f2)$?0=H z4hbEO^<{I1K;ntfn9C=qS-tSIt_;>2R)7Ts6M{`YV!rUMZamWuBae zTs7Z9j*gPW7FW$uXwXs8p_JAvL57Z!jY_HZ7&2eNQOdLjL5}fk4ZWsEhx2x&tfmVY zI!Z2AOKVCfLr1YXO(T^Xao}!WnXb%tl{;0}99Q@3>53aS#Fkl1b**r&bS`(cBgkqk zb2_hq2Cigf$l?#4KoA}qA*5A&IU`~(S5%kNX;>=&9MeqBmch7W!aM3&4(Te~JCrI) zdpYS(tAU>e=(*s@ZuV5>QC3&UiY=&WFQ2Z=DE3x9&{{=yZmX#r%k0Nn(U9rD?6M&O zo3VH@R-T37*1iHjCIS`!GqV80`>acqrt&Sy6Rpnf+1s5voZFmKkJ(n%R4&S@Oy8j( zzDh~hnc3{^uu z7z!hg%5zO*aUx-dTq=;%*S2@80f4`76FJ%}rzZ_ms3ivsmPE)IZX+?7#lF2>BfqLA z73ojbN21qIJ(yKt4vV~hQQeBwT3%jJUT#%v>H#qJ${P-QZ%_~1VcTIXu>m+@E%}1g zYHQwM|C;TMh84E;wr#y{Y_qMmmfL1qt?Gefugwk*Ry&j(wub;K*3w^FXQ-t|!9QVj z6aI$PeHvV|%>%bHY)X;E>Q=vNd9O%;;&X>Q;8Fh5mQ_}@f-L?Kf>H<+tJ8LywG=L# zb`NT?+dk8_&gxK0Uq;c%r0s}p$5(Ckh8?!@mA2+jS<9ekx35A;uNvhZvDV%XZb!Yjh8LpGw>%~X z^aI#pi0y=%c#rW+!oN49hoV823=Isj1hzElV*MF|Ko7@5*rAxf9!IQ7lij{}BpK2N zu`yB)_xpPj3{HColCf}@i+fUGy~mIJl7JH-IKaNiJuJ}|izl(L3l{_a_?}Qa!Ik47 ze~=fQDF)_@2FIY>kvZ5O354`OY+%4oRUFX!VyQS$Y>&jA%xJI1f4FO%51L3+pV+`j zdpq?&Dh?0*se!266Y5XKBFrD}-OEzZM5H$w3TlBqKbjQl59(+N-~K7Kk)o`9LH`i8 zWJ0iXF@gibfZP_UX9`7-Y4fPDtrSK>Avm0fE`wRzHwTMMKTKp=c-`34ry-1AWcL#%-;>SF7K&NUIO~ z6GPEJUpy9#r4se2=)OoaSZ^$@n|hviF4c~A9v=r_sM~1_H4H?P4S|O41iH8(8c7YM zut&VNp)HiylZ*{E1VhmwdcPsT_(oZZ5)W-Eno5L%i_o4ye{c!!UhJcV({Ly*22WP} zU>HdRvqmJ9uIt7%2VLGr8*%w~jRZqFUYGD==*4hR<=u!*Bw3F?uqQQWj8|hcqYA(S zPz>xfba*p)qtR9P&-A@KCUTgNK0k$wz=R_h1TmBnrO=o*4MUAi1(ZxlUd!U*{$63- zGW#n2vQR2w?MEGU<560P5yi9)B$c4wf?GJ7ZkWeSl^SD2pb+u-jOBk7Zw z5!ETPvR4$gRl1Q;12oy4oDa)cufq82A!bE6>+2IW%{4LWQeF;O8LM3RU*lEWE6DGX zn00A?yZpXJHm)*yke8cOoK|++w&W%iPr>E$ZnI3qTSM}>cs5?lAF-ukK06$)1Mx=guW_`jeRq-~JT$jkkXR>_Hzg0Gi$?pba>tk-=H6un|WtHrB zUc8DunisF0>;#C)OpBe4kb_j#(|TcksSYcvH<CmNc4o?LaSss=P6C{W*`oYGYwrCH+tS7E~67pkXujyUkO~x(lnTNI6is&Z!6&E zX5em|FS+LhJ+sYMA1C3K$=8iL3+U66;(UG{D4_q90{C|e;I9_Ie-E76m3tld6YzX- za}=oOCBUcS$-@b6cCZ%`PMs^9VbaSJJv7hPURrgaet$`ffBDDM$8lk7B99~Q#`$&9 zYXXsdpZj-Zz6W-N5cj|j>F4%iRFo^P|8n6iQJ~zr3gEQvkgr{j0jK!nmiq*7ExYQR z`zi2wdGOx@&*wk$Bq9(`CX$#7U_LtWxf~sH0DPGziboc@9*pU|{jnZ@zaC7+;tAcK z+Rrd&9PAGzLqShtehvDBPek{}4PwggFUK?z6D}?$biXj5Aw3#3x9`cZ;$lP{w>F z3o^cklm!{{?JQ{0SCO)${BuiL2>K9nG~3KU)ABT`wA_`XyYrtA28lN=26U8lSs zYs&s|RF(s@5&yFw=1B|hk77z9N$w1@=`;*MWW9dQG(;EYu4DH7+ zokCEG@$usc^@)?FF9;`+Gfa)M$FPujl;9tT1W9@;B8Ja7ofJi;Zjn0(8u@Ra9L^gn{=4iT4R{H-^VoS#T4 z-@6fFt}F9IFT;Tak&L~Z$4FXBN~R?L&PZq}GG==@-;q?4ih}0aw*kL^cVA@v<-ABz zSw5bJ^Ms{_th5mv?s78qm-8n{-NG>*tn;=@dpv&UiDsTO6_e%5d6uLf7;2ecinTfI z0z>ciNP9USlayXSp(N`s^(5T`8NDkcdHKGOq>bDf>nosCwyeK^`3gA2RNBk=ounf| zQI;?5W&7`hoa|eLo_zmF(!-*`WRJVdO!?COK47Fm_2Wt2Zwg8_=0s(gQyPrfUK4hb z@;xdhgB1v zLe5*{_dIj!D|t!(9X4eqdpR#ZUr*j9#+$)S@Y4Qu2x#odZj$pU`MuP0qW*GxN;}z) z$6-q<(q7K<&o%%=sxwIDSK3SZCM0Hi<`t@q1||RIB<&=9A40ReoG%;~_OhPRhqROY zN5~K+>o4zv9~Jhw`XU_CoLxkYFrl8orTu~oVq~Pfq{Ya{yjk@p!eOr8TwR*4G1yF7 zrJw5xlt0>H7|6fF!aQRy`7H(PA8Ru-I;EnZvRnxhpVLG`w8kKA5&z4;F2*6dLtg*s e`j*o~Zs^{?$s}QJ`SiFjuf3@F?i_<0mi-rMEEi$` literal 20408 zcmeHPdyrezc|Vd?Ufq4%UGJ{n5R1hQ=CP9BUSm6G*Soehtc?MiK!Sa(mF}*DwUS1< zTD%4)24jY;Yids^khV!&lF3jeAx=ACC}|o~D38pL8k!UuVB%(=*<~P@gc1{i)!%pS z`DE#?l&1Y7ozCdY-us>J_dU)z-#Pc{oO|!tFZ2&?a=ToDlSh0?5O=!OMnXz(c9Y70 zghaP!#Q9>;DQ1ALlb9_J*#uHM#ogu9r*ID_**&b}PI`gTW6CuoN_N%KfqGlQRH$~4 zotH$4chXU+5E4_C7t8ZYu@DaGSM_IFYDck|?6U19HaNu*1G#iyxokK2C*93kcgQMHcXDW{&K)=i zBl(Z~@BH0u-@0Y%oNqqy*!ZEgPk#IM58fi(798ZmZr2^i*%;9m%^!{ut(G=J&{jdX zpbCBuaDN5;i>v6btAg*Yf(NSLUjy#P;Y@=7D%HQS3cjQY-dhF#Ti|{i&a@IhrE;$Y z-sw~(9^)WN-M(5FMk1Gvu3c;7a?wa?Smdm1Dw-J=nY@(~nRLcXiQy3wc?j?)GSOr@ zXNriGPKabW8cAA-Q4?OGdn3khA{9v{_7O`37&$AFwT#h7A|*Bt4)ks`mIu}pbISv( zgfXyvixD%k=13xEnc3}IHYU?4b9-bcNj^qK(<$Y{uvIH6qB(9kO6klwPccVh(gn^1 z%Gb}FM538Sa#msa`3a4@+zy@+-)H!~aB`-NpHcS_#t$ew6SC!uGylp}Hcr=qx;0AR zbO~O1{ZE$Q?28P}l;Eg%F`X^J>AK@IH)QANHcsv4Y7zK9i9q<^+rIE&@9RM!!iP>;?!u|?!KZys73)%1^)rYH zi{HSxWnl<8;^QQrI$c0o{1f77sy1~>@-GojQ?#j*lK%nmG=-cxA^CqKo~CM3$0h#+ z@iax7Ix6|UA)cm|QwJpf2=O#+n#xH2A>wI@Ikj8ze@;A2*`~Hhz7zcLQSdS?duL$c z#a-cvpM?*;ac0~0!6V*VP`B`rW{)Hro`hCm*1ux8^nT02K9X#Rz(M$k_p?OSp0#En zJdZ+7;n51GTNWN5$4@B={bf>r)n!C3Jr{oRoF_bSCj8{&RbkgN;TO+Y9dK|+Iq(%u z56g1c{=kO!AQJiDj_|<^!;}qAylFLs4{vx0%w!juG#SU~8SnGpT|3#1>C|ly?to4B zj<>g=7bd><_vZ?Q@Wgjc5IJ(_Imtacd0#oZO2YkT!iW3M91b-dJlpX3E5b)seSj%C zTJ&p>$vbV8v*CmL&x)2qe}Sq!F1wiq2Xud6>t3uw_l8p4e9qP*3)JA0EP2%~=!GYq zoxIvsoeUq|funyCo(62uIN@X|Nw8kzi;-@?a}AA76?%U*3+C{r|?d-X^XJ^l@9s>mk87#WS%C0JEX)VVn<0<{R#B2bG!EdsR&)FM!e zKrI4)*a*=3B}!RU>`2zk_`CZ3ox2t-iA5~a-+B4sc;}^o^IWX+(oTPHERqc-(<8x1 z-iim1@!#&3ro)j$GM_b>&BoI?i(FUp%Z_jNM{eEYzvQ+|Hj%RYi&pHvU6wp= zSe!$dt_7ZT-JtX^q3_*7;V#hkLB9c7ccxI-4mt(;H0YvV77A~G-UWIE){peQn38MX zb;7l`)wQ6h-gneh-%2=rlkhP7TuurqRn~`J$Vvb4Ula-_NLO#&q|g0yOXID+1LCUr z>n>ZdsFPr_@52#--_rMIWP3A?3sKKCv=;8sTkm#nY@Xp+?n0HM&Fz4@-zyY$f{I?f z^-tXW`rLax{ks21UBABMkG)}i>D@EJdiTNl&3fn-y}L(W+M_S&)&0HtTVsF+%+MW7aeS_Enls70U_fm#G=5vWC=7J>i25#a9t`MW=!<1;OOtEN6QM44d$Wh3^g7T+H#1zw-gi)2c3Y$A@Tf*C)hD#rCbsr2}pKra8Ig54g7 zr7B)k%Jv;s_ITqcd5$lZZ<7DKl7Fc9V!c&4e`vzrl{?E_t;WG7MQ>1aSkW;>?^g7F zMZd1-V~RebDEsH{OE+)ac%^?ypE;C>r2O516@jH)t1q=P;tD9+{b%>WKdEn3<@%Q$ zmC%nchU{VFbJfGJ>1qhSg2-1gboY_>SLUn*@%ZWoq2{TpzZRs<=W+QK6Ys8npNMP5 zC6e=A30-fU7f&W&;{6dh$ev6j~aMhq@K@CWz491yZ+KdjNT#b{yxrHIix79wJG%WaesKxT;$#8NU`GwJRmF zL|a8_>m;*OJ3x~4lIhkClg$RngtYIIT1YZsZ7(rBlG&y$A)8*w+$hg=eX|Fkuv;4> zwM`w@fW)<*6BCxT&S>`%GawmDn@8n*x{;o|?A1ObZ(G{7fgI3IklNOk&w#m8OOV<% zz8%00YLldPZHo!!9_>Ps+|>L9U`MqtlFjGlP@EssZXo97dAETa*RCgo$>}lbqo0YeI-d}?>cyI;QU9LCog2oJA z9~5TzNYF$bM)hi@kwWNtFpc+1g*}wLUS`K|mb%A~k-F_dzlTH<`j?~zb+-On%Kni= z^ykRkVLQJN`TF@yGzgkrht5klT15S`r0)9~313E5e*vfZ1@lSTdIYF%p}XZHsY4@1 zr@NQ7NSAqJg|=LJ)bB#0v^94A-=MColX(o{e}Aai(Pa+8DX+Xrc>fiG~kDMB}U$3c*s*M9up(bY+xXLLUL#^c9`zs{aDA zrsH-?U#I+E%_J9kf^@!a>zpC{QCsJyl>e60X?qTpaW#0U51e-l*I&MhJ4^dIsiBjG z=h!#)w|7W>KJ|d-*zx@x!x`afYNYOVAB)dg1vOW5BURUZ?8aH|kh0!Djy%Us?w|Dp ziCdbwQEkt$$M<)@wzc(bNZrSFcVw0cS9`-RrS4< zn(11sw>Nt91^P@^TYc*sc$zId`jw6A8rL=s;0N5Z2)*?wXke(fAdAtj5ZqvA5JFn@ zpAzsVhN>Ei|yFsrm| z0%prvc@aCRCu;F$=oYsKQs=ln(wlLX+u(=~=5u(uofry^M596MG%{ANRNIb5Qu$za zFp-KT^D$FMJ;hAd8%kjB$$zgBw8k@Lxgs9N({uAc6xGD;l~~Li4#a6Ygj7Wq0}VS` z@=?p!G%(l?0Au2O4iYw#C`Al!e39tT;o!jee{i;{< z9rL#N9`!c+zU*zf)7yNtx9L0HM(BGV^frALKHYWho7~v!;zFGgsh9wXWJiQGYV5<# z8tkIEMmAP9DTOvkBo`So4HMdyIhql1R5Jy*!3h45KleHL+JGhs`~B9YL;c z%_c0<$Y5KLF`SHyEX70lVPhzQ-9iSuk0r9{l)!GF>>e|llk%(?iOF({ zo?#&JmCu>6R7CCoL)AzZ zkr|3a_vABn*VAPLQ#m}AOKB8#(J@<7jsSazj9Ikpi+hIL$YCjkB^MwC6@S$7oEe4V zMAA&9rDN%g1|!N$=j{S$bf8wyPUK?tOEkJ2{EpkE>5 zu=C1a5pNc!D&l%^zjL|&7QyS^avVK5&Nk}RbPamTJZhA`NxW4Luw;?{eY08Df@uV4an+=tn zFRy}!fcwidZRUFtpFW;%uHq*JycOf$InL>u@izDL>pfq^&qNjc;VSrdfm6B8>yFkQ zmD=?(@R^vm^79gI`Wu8(kd+bUcrwxAyHY%VC2?E@D*ii_K5c)fq)&^JR*e4xA*HCu zlgiI&)xVc3{1fm)`p$S>CjINv7F5A1<@Q#=w*#j*IQ{Pi?k}&RELz$NVg9j3m=Tk)#o`(%GC5$?p}>^k^n&T4pS;X2o*s z2Ct+`GA05S13p2+eXF$^`Q{@GKVQjjtXG_1)zqQZ6 zR`PO1OmzBg+S;>aU}L#N?p_CkDU{J4RvyBA*9l|u;5EHHgT^(RHeKJp-PqpKJJ?TN z<(~IwE-$Nmesg>%#GBt~%R5#Cw7JkJ=##d=iZ3r(ndUziY4u(gPhD6G`THpE`=R@+5ZtZU&tDWhH^Pof}GCEe=Bfa zgTg}pPoNwz4E#F)?lJm50Tnm@m;d8|at{bK{>m{C$c>L;rU`0gZ5rnsCiZ4FBLbY>33IloJ=kpv&ZC6LXd;T@(-wI~ z@5^K+(t$VwC6=NVguOsPH3G$CDVDZorwA7+gNDADF&i zs};}6U6J2~9KB;6`OqVKqXZ;l{_8~(tWqV$?Fg>Xh zxqN5)?^5=?N{`<|F+EdakJ;9=_}vSPVxnGO(T}j56eXL|M0G7q6JSd1{mPE%iBe_c z9qz?_4tri#G3EBM8|InP1I*I$Ppbl$(v$kq#N{*gRb)!-d7Z|T-`BCev;FjlpX`gp z_?4!jKT#|bt~c}FMyAyMHNP!kx}Fskb(U|>$Iq9~>qDkKa$b_0gFpufoBsIENfzO1+4)eYM{Y_EV1x=ZnV3+@~Bm{W^7LSFwLu85SG^)@k2a z#r`RJ`GK^?Vc=lJ(kk}9S#8^Y(P7|V#d>A$Z0DbL+xBy~V{EnB{QE`s7e^65kT%-n5r=aw*Ot;6uCo0j{k8_Zj4MqJR{R%Jit9!I diff --git a/rhost.c b/rhost.c index 85ecd1d..e845422 100644 --- a/rhost.c +++ b/rhost.c @@ -6,42 +6,74 @@ #include #define BUFFER 270 +#define LONG_BUFFER 1024*100 +#define TOP_IP 20 +#define AWK "| awk -v num=%d '{a[$1]+=1;} END {for(i in a){if (a[i] >= num) {print i;}}}' " +#define GE_10 "grep -E \"^$(date \"+%h\").$(date \"+%d\")\" /var/log/auth.log | grep failure | grep rhost" +#define LE_10 "grep -E \"^$(date \"+%h\")..$(date | awk '{print $3}')\" /var/log/auth.log | grep failure | grep rhost" +#define IPTABLES "/sbin/iptables -I INPUT -s %s -j DROP" -int main(int argc, char *argv[]) +int main(int argc, char *argv[], char **env) { - FILE *fp; - char *temp; - char buffer[BUFFER]; - time_t timep; - struct tm *p; - time(&timep); - p = localtime(&timep); - char p1[2]; + FILE *fp, *fc; + char p[2], splice_command[LONG_BUFFER], command[LONG_BUFFER], *temp, buffer[BUFFER], awk[BUFFER], iptables[BUFFER]; - if (p->tm_mday >= 10) { - if ((fp = - popen - ("grep -E \"^$(date \"+%h\").$(date \"+%d\")\" /var/log/auth.log | grep failure | grep rhost", - "r")) == NULL) { + time_t timep; + struct tm *tp; + time(&timep); + tp = localtime(&timep); + memset(splice_command, 0, LONG_BUFFER); + memset(command, 0, LONG_BUFFER); + memset(buffer, 0, BUFFER); + memset(awk, 0, BUFFER); + memset(iptables, 0, BUFFER); + fp = NULL; + fc = NULL; + + if (tp->tm_mday >= 10) { + if ((fp = popen(GE_10, "r")) == NULL) { return 1; } } else { - if ((fp = - popen - ("grep -E \"^$(date \"+%h\")..$(date | awk '{print $3}')\" /var/log/auth.log | grep failure | grep rhost", - "r")) == NULL) { + if ((fp = popen(LE_10, "r")) == NULL) { return 1; } } - + while (fgets(buffer, BUFFER, fp) != NULL) { temp = strstr(buffer, "rhost"); sscanf(temp, "rhost=%s", temp); - - if (atoi(strncpy(p1, temp, 1)) > 0) - printf("%s\n", temp); + if (atoi(strncpy(p, temp, 1)) > 0) { + strcat(splice_command, temp); + strcat(splice_command, "\n"); + } + } + printf("%s", splice_command); // 测试没问题 + + // 拼接命令 + sprintf(awk, AWK, TOP_IP); + strcpy(command, "echo \""); + strcat(command, splice_command); + strcat(command, "\""); + strcat(command, awk); + //printf("%s", command); // 测试没问题 + if ((fp = popen(command, "r")) == NULL) { // 执行命令 + perror("popen"); + return 1; + } + while (fgets(buffer, BUFFER, fp) != NULL) { + buffer[strlen(buffer) - 1] = '\0'; // 去除回车 + sprintf(iptables, IPTABLES, buffer); + if ((fc = popen(iptables, "r")) == NULL) { + perror("popen"); + return 1; + } + } pclose(fp); + pclose(fc); + + return 0; } diff --git a/rhost.o b/rhost.o index 76e9a4dd9d9b1ad92dfa48b3ffc38925d38b5a27..652b2dcf3ee0e82270041f060c5a33188da4cc73 100644 GIT binary patch literal 16176 zcmcJW33Qyrk%0TxXhx%Jbo!7D@oytzDWGGFZ(AS<86;cy0Lurq8IPo2(!`n>F^6pV zh{56#AS^Gt3k0%w69}8|LI^o*&UnGt>`B6%hG@ekO zP4nXd{tZQkoCvA+$DAR%ZnZt{y6T$VV8XHIT{M4SUTu9^>YZ0R&u$nF#u^5r{SCon zVxS%}_5oW~?F)tmlQD-yl~U)}J5Z+beQje`=8hgL$}hR=2Uu^s3H2z*7u#<> zS#pyDyc3!<{p{5xbJ|cx+G-zriy|iRc?h;+?2P}U#7{vjXxL|+sis2isRA|*hL2nz z1O3HwK6zEvzyLT+-rqU)5ye9G+V8ly`l(8&?mtNZbdJ}7nCiPV+&Alf%}Q}rgG)U5YUi+Szido3m2aiH2u7O5PYooqVWTQcVc<$xMG_GahU`_Or( z+j8eX7)o1p22d%g@DsJ|W0RYO7LW5??;JZPmHj8rmgyaS0=umJ##1D?~1~L3q)&D8i3S z2?nMRu2*K@t#otffc|x3R@l}x$)x8b;IO^DpHbGa__AgfD)CzZ+1F= zY!>D{-uvLwrL5#(URrAplyF`C zBh!>d8+JP|+#2B(#<(=H(; zd7mXX9dg?g%{M<(i9=@jOJu7A&_%cG z6D^xkDZJ4tNeKlPy0pr9u41i*u*$6YzKTMZZ?>;%MwwMQ1KKuSxO^)LR~9ZW?5Kcl zs1}8Vmx2bYWF?S=2ObgV9uE@K%DYhD#am&ye1(Oowgn)+STnW^Di@@!!vnDbN>^1u zUs+a11?m^i1v?F(=L1V#-BL-tby*b$wxFt`qRcAKYo2*eYZcZjb!&cdW*l#YhLi#G zazlufFPh3KCNUUUl>kybkON@aB%rKMKi~3KTy33bE$o`HwQyVEmO_kUhFkb6$k)uV z!xr?fA8^&}hb@sa^Jps=o5dLQXUq1&WIa!2V1+tA)lT>FLTslk4S#_e2oO7ZPQAFS zYE@Ol$AJoAPeww_odlpF4@cu_i7tb{X81#^>p_!dk}a{x#8`RL=d8RjQ{|0QDqE(S zA?Jw340ZIkPg%hdn~jQaLh$*trd0f#F17uM;X1Q{fT5K+z$sdpjG2~L&e-HBH^LHA zoMb?3bMiH#hbcXn;ciSegOVk7n($%(s#{?N(h_ejHT3_I4TE!+sDUwQS-2rT zLb)Lsk2QoMJ%hwi^gNQ?|QaiNZ{>U*%|@kB4UuOEO;#C)&Q2YCoyYC;zFY4JoX*^>xd(b2gY0PGUe zxkM=J1QLppS|Y4OEP|Xe8;Wuk4ygK7epPoeG?=IhMJ|ff#98a?G4S>y7nFRY;zZQ0F1f|zUp>+nznhr?RmRlg=ej2OaI$jJZs$*o*8bp zYhR+@;{^+DFDU1G9t3Q;i+=7dcNI;5e8OFd{B3vX8IYPh^J^7S&I1{S9HzO zvXbR0+dAPc_PBOUc$>i2@JrODoI)60(EE{|p%IY?2lhoHjtF$Dmv>CW<2}JhpOoXl zVJF~3dPTws4~ckaAKW_;i1zix9Xis4F%jsCIZn)p2L?lM(1~XD#6k%tFqDWv*+}pKM0{v4)Z>5{4hJFhc&I<(^x8cG!5BImh$iJV9F2&lfDh z?S+jC{f&Nqqg@wHBqL5!zY}p{p&k%}v7Uh@SfT2cEVAqR?Yi{~?Yh2Td?eB{5Q|2l z$#`8dvL_Vjty5>c+Q?CZ1D1pI2*AMIV8k&++x+S&d-52sW1D0iL-_^p}TWZZN%JahE zy1>)6^W<_(=QORp(jz&ozL|HqT7C9-ZmX~6PIrs1@fJ^uZ`o+xmA;8HMXt7-0^c%# zExsC10%fSw>hrc_+iRj<_{$Z)K1Z%5U0kws5|V<89{6U73!h;bk_#VY8InuD4m(3~ z3D|;XNG^5iI;F&=j{Y+6%nf&m;wicaTSGr7shK$LkTdb^S$KCAK9Ggu(RU{MhqCZn zv+%pJ@ITAK|1=AKAPfI`7XGa){JUBBi7Y&|gRSqpyivf1A3rX^k45;g7(bTa$1?m_ ziXRJwd|(8w>|Ed4(ivEP#TD1A-W1r>(%QK?pskj)O;As0UWAQ@CSbYQf-CMF)Q*L> z0`y#iGJHhCMLzJ=Mu2t}q5;~430EMT3!k1-X(>WT$njW-c?UvB$mhTxa|amuvi0;%LX#_=m)CV~%s2?fjlN>d)194$V*0$2rOR<-}1R=Q#6u8oxl} zevMaayhG#jHNKrV`o&d_?RRVX7iv7A>Er6h`ujBwr$Z?|s@cJ{i1i=Uc#X#8H?|;S zduug*TC=a;m%r2O*qZ*&HU347|F_2Vcz6NEe$efE5kSItZ205&ZH?>wS*P)fH2uX{ zcr$Ul;F{0&@#{TI=oi;&=Dix%+cl(dy+3avju$uzOxYRJ^lgpvlN!H#Q_nKUKq^uf z`DDgt8Ghr23Hu5Y>LYJK0TMqknZHQ-7y~BcXtNOoNZ5y%kn2zLFG`xWzmVi*2ET^3 zDwi4jzvzCq8+<46^#)%`cJMiciQ|7)iK+7v<`cws)0KHG*&j0aJ!JoY!EYt~+YBBj zeSBVEV*Bq?e||&Z6z6B$_YBVK-ARK#Om_ak;9n>CO@qHc@w{X3qh#l|2H!$5|8$7s zcgPO@>;e<>VI_*$2FEWDFyX-vCf5Ie>?}6;gTz}6Zp+$2tT*^qi0?4?0kRV^_#cQ5 z8~i)OdEMhUcat8z3t(d2O!8L^{yN$DmcfguAC4RRc4bzaGWc@huNeHt#D8Y+b7cRl z!TCA*vB4iFJ8r7S?V3mNmmB;j@i_*sBF^h4+i~Lp2x+;YKbv@q!E;C+F!*t@A2;|Y z@vj-&MeTgV;LoaX#19Pq4C$XX_$cZB#Nf5$_g@Uo^XFFvpF#2`2LF`o=aD_`x9?Lt zl?FdVe6GO@NUk^d8j@EUe31OM8{A8Lv%x>4xP!zoj6BlC%U(nOD8y>0?x6@&Bs z={192Pw~H}actKcWakruze92%bri;l`gNo~UE^5xTe3gP;J+k3N8@Oxk?gk^oagh^ z20ul9!x~4wn`t~;Z}1Jo_Yuc1aGYF3@r-KvyeB~ycWWH&|0UVE$KVeVf55QM&yS}K zehC_f^qRr({T9;)2ER&SG0m+q9Dj)TN`t>ne1pb$4~9iMHBMPsqhI6LKYZYGSmT(b z=88Ktj{4K7KOfOJW_kV|*Es55NcwLY{3_z-4Bkh)k{W{|s_=fXTH|P+_dl0u9J43k z57Ro0qyBfue#GF<5x>RYFB5-A;}o*A|Cq+n{=1}q+Ted6{tJT_QAfM6G9*;f?U!gA zv(==($l!kBod)OUU$4PCNPk4*=ojB1F^y^*v;17V-{1+d^F4!)6F;SKZ2DF-4k@1o z46ifSQ2)#}cmd6mT7xeq{kklCvB8f~Jj=827K4|O-_=?8RR-tx>Wv03qd2!3{4wG? zvT(=XyzYmx@R-4CsJ+7m=l7^X23L0l?t2z~hr$1rDjdne?=|>BYVQMC_`?R@L;By$ z!k;ks6V%=x8l2zfpEYI$ihD` zILGs$!TEiFhOb;tXbQ?Z#?L-$p! z&t?1nL_D9%K?m>G8zfg|;pZ8A3ys?a2H!=z!QeL%Uy+6LdodPcJQJk9&d_JR+2Gv& zyl-VY&x0*Y{Qk?F+k3>Y!~7nDmry)k%fk7+nC(}RKK}m^OeTNU;7z3elEJw@e{67W zFYlMxehKM)YUuOxB9HvAK67p#^J!FnmZ8slp23?)pWm0+4#&^ujm&vG@V=XQyXr1+ zongO|cqj|M-rzj14j7#M@;M~?<#EOPbmqLz|E6Jw_vf_jlJA1FWXeeS+>7l{_^AtX z-p6uX=6tSX+TnQcY!(yib3Ba-r#Oj%&nH=*$Ins(keDk;2%9q4Y@Cm&R39G+!x!12 z9=|e?*8$EYoV^KAFTc94?~cbseJqLsYWnNpdmUYbZ*yYKV6YzRfI={qNDdL|b-I)N zfl#C`3dUqU*xem-h9?!n*Wi=nU@REvhhIb~tEyTC1iwOX*eZl2>hWuM2Y%a9ABiTM zdiV`R9RvfvdQouvbu9Hd>;F*vW#2m9xF)(y-E5r_~gX+!i0SCDk7?oQyD z{J%R_RhTGISM-Ob*c|(h0L$cmF?~7lpGKh}iW{@kpHF^I(fS5zGMV-9`+-dH@AWHv z_(`@*7%%=R!i*pHQKn6-@E*N@^SXr$lc{?ruuT4MTO!p{-`k*n>=M)e!@x|NShK1e zKgE>a1)I9ZKqr&`6XbsajX*;G*rlfb6TnQHfJBJ=^YaTCCQ}!`Kgs03eW_GW{TB)J zk6mi|KLreJn*IDHy_jE!#&^Q3-KDwq0unFb dj|L$9NL^B&+;0r%+Bo#{t#1Zjs5=>&}!a1DSBqX$8HJmTcyU*)K_Ue0Y zeFV&@v~dk8uF9nrNLqwwg&s$Kv?+IuclSO0OSp`X!v5pm$b}w)CvPGdPy<~4oChLIPf;LKeed>955fm(@;deMX^?ff4Lv-0c^?H9`jm;ChLEIE5F3OZ%^V`rLh5p#yk7sE3aSGkv2UmzVgEJM^>&$R8V^5nw9b7sOcoLg-p^cc_RsE#BYjo)nU`l zmK;k$XQbeIpJi7XzA0{w9f_~LvFO-&FTU!c$<_b07vYP4Z#&;*AJ;Gje^5f0I2OS# zf7!%o!33}hyt$+Ys$i%NQLu(rHKCvu;y55^tyUl%E4@aCctM3DZY6kcdlq^``@ZFs z_Cw3CT^o83zJtO_9k#jkH*401)`3nv5Ul2+Ityz7HrC$-U1rDFKXzP5`F`ILu=^BfwDTHZbs_m@vJr{ktI703TL! zVKj_&ZD=uHR4J^b}Il9J5p(mLX*qRNZD2vTO$h!`pUe|JnJ2kS3&=68LFW%5wxP%!L;KcmU}tGXN^6LsL~!QuNy5u;27)su zCfkOKOpAnZx&t#Ki@0=S7{d+B91<|vfQEuIXC?)1igZKR!I{&OZJ-;Ay$`*CnZs?x z^-ODR_&b+|2bhuu+5Mv=8)_;Nqk-Fs)fTKiV1&MwdsMwU)Zr60o$G1*4n8 zTf#lz0SGp@iiN}5K?0U~6EtBrBL;S)T4YeF?gEBYs8tI_!(pMV0a4%RGu92t4HfI~ zM6^Qh)^=FFnl{ji@{Q+$og~ObyL^h5w4+edxe$1acpak?d^0!=`JJ{Tv`gCM7*@9r zwBpcum)^Ux9bL5QKFfinjJ1KukQ^`)i~PQkSj?l+A$J%jM6nh=Fkw*mw#-}jC8xej zP~#qWi3C^@zBTRRXd`^{!wceM$%S{MJ(SF(Qpxe|jmE~V&a9m;jdy19rDS)~&Zn}a zw8gj_f%$Snw&(r_B1vzeXw4O5jK2#LDGb&1(rIfrF@lFFE(%Q;r|UVTlxOT2*xv^P ztf5K^H0%P9u*}>E*RUKXYrCFME9Ie?7M&T(D-=B=Rd6iP>Df8UKtV7^_Pv~d*d?@> zuCaQNXoxP@py_((s9yiJ-Vj=^hde!cwH^ssdfO>I`fbq~*JIz&>q9eoOXvx`G4zlg zxm|DEr$?UB!yvEUuScE%n}M3ZRe=CZ1H@$K(+n!p$uKWx94+K6W(*wUgXKfY!#ltiM#7B3@UUxn<#Zauj%7KPYhXgSficJSETiawx#6st zanWBU=YbyY9x4qRL#7Mv!ON)a6!Of-na&Z*ae2REnQ897Y#B6|$Rn?c{F{#eERPgQ z4o)bBpEf75c4ow5*+M=O=U*7PVW74ca<-5<0>oTNE|e-cFmKsX4&s5th*9uBA!nm7 z?rd6)y_9$DOx{YzQzNE>!y5y848&59r8ylr7+ocpvK~5|1JI*L0yB8Z`IvJ?4h?%p z^JWh6RmzuKE4=}yQBD>nlh0Mon6Mz0WG?R|Q^`RWvYE`=rHK+eWSQh{%RK@MGnuyX z6L<)98IL??+A!ELJ8eNiJQGJUfesBE=*BLbZKG(WFUF1>h=R9a3$o4E#GLr|9vF=8 zTE8jYowz8mF5a2*N_lHr#)3sa|>&r zBE_EtF6DdbG5_#~NpYVXwk#p1kVuJ$Oen_T|8?#@gTp4Ma$5 zeg&$qbN%h?{2thCs@^D(haIa*3DP}6?Fuq@aa1Wm#;*wTdVprw+myv04d=)8V|Xpg0K4;W3gHUw-6!506azj5$Y|u{8_us}|rB3-DbF z@LLw(_btF*u>gN)0sguLczkJA8*lj~AU2Y{`w#BivEMkjXU`RVR~lFD*tx&YfM-2r zW^w;z#X`}_<4X|!;PJKHLaL|7aNU%dA4WQ#D#9k}6>L^4!45SH?^2f)Q`rK%D?~Yu zYIqCtcs_yqJC+STz8Tt*A0QrIt++ZRk5?`%l1F=321UhJI39VWe2I7|FZr7k{#wGf zQH^%}b{{4$b<_X97|{%^_ttqPwc{!WE|lK2w}-$MNN6du{xo)MME{dl| zk^c+X-=pvyWd90qu_zmE9tEBtDT=ZwN1C;Xbi-%N47 zrSN!u#4@Y!za;xL_~L~k^V~%7#1#HhA;wlH{BtDVq44s2(53J{BRjnczl7r1M?9J( zifarh@)r4Z6n;DLcPsqGC*fcK`Yp;E@M^TP#@;cath$gxI243&v; z%zOrZr1EocSGS}J9+DHOLM~^)Zv}~b!Lt%@$?kMLxZ;wMH3C18;4cIJZ;68e%#A;n zXtNi;pvZfVKtfiwv0e@zoT^^<_)ClqdiT@(<5?J+@}`PsODq?_2YGrNkm6;G^dy$G zO0R_uwE4g4uLoVUIcE(39w$d{K-*tr{F2)a4K*h0yOa!`rFAUjRoNcssFuISFkw)N zw^|-~&ph0$CPhtNHII|1wYLAAWS7=YJA7v?=3+CNBfH0YjNl7MAoc>*F9( zP5&+WY2tI-O65!H$$EzLD-xphQT3lT=H=>9(pT5-Ea`VEhGqUGeG(eg@^`pO{&0_# z`ZBLL4%Ii>UPmuF{0}7-yxStB>f@SFQVb0IBNLrLxj|IrZ<#kq;5JiDf1Kh!B?YNg G_5TH17f50N