xXx

Hexid M1n1 5h3ll MobiLe

opt/cpinst/jacky_script/_[ Not.Writable ]

File://opt/cpinst/jacky_script/check_sshd_ubuntu.sh

#!/bin/bash
# 
# Ex.2022-5-23

# 取得前一小時時間
date=`date +"%b %_d %k" -d '-1 hours'`

# 統計前一小時內sshd服務登入失敗次數 (不包含辦公室IP)
fail_sum=`cat /var/log/auth.log | grep 'sshd' | grep 'Failed password' | grep "$date" | grep -v '210.59.165.80' | grep -v '122.146.90.137' | wc -l`

# 如果次數超過十次
if (("$fail_sum" > "10")); then

# csf daemon restart
csf -ra

# try sshd ip list to csf.deny
deny_list=`cat /var/log/auth.log | grep 'sshd' | grep 'Failed password' | grep "$date" | grep -v '210.59.165.80' | grep -v '122.146.90.137' | grep -v invalid | awk '{print $11}' | uniq -c | awk '{print $2}'`

for ip in ${deny_list}; do
csf -d $ip
done

# send mail
sshd_fail_log=`cat /var/log/auth.log | grep 'sshd' | grep 'Failed password' | grep "$date" | grep -v '210.59.165.80' | grep -v '122.146.90.137'`
echo "$sshd_fail_log" | mutt -s `hostname`' SSH 被try，目前CSF已重啟，並封鎖惡意IP，請登入主機確認CSF服務是否正常' support@twnoc.net,jacky@host.com.tw

fi

Your Access Expired	Date. in : 15-09-2025
Regist : 09-12-2024	Expired : 01-12-2027