GO IT WORLD | IT TECH | IT NEWS

Modify crontab

* * * * * root /home/cnscn/sh/ssh_scan_crontab.sh >/dev/null 2>&1

ssh_scan_crontab.sh script

$ cat /home/cnscn/sh/ssh_scan_crontab.sh

#!/bin/bash

# Author http://jabin.cublog.cn

# Modify cnscn http://cnscn2008.cublog.cn

# Modify xinyv

#set timezone

export LC_ALL=UTC

# gather 1 minutes log from secure，count and drop it by iptables

SCANNER=$(awk 'BEGIN{ tm=strftime("%b %e %H:%M",systime()-60);}  $0 ~ tm && /Failed password/ && /ssh2/ {print $(NF-3)}' /var/log/secure |sort|uniq -c |awk '{print $1"="$2;}')

for i in $SCANNER

do

echo $i

       # get fialure number

       NUM=`echo $i|awk -F= '{print $1}'`

       # get ip address

       IP=`echo $i|awk -F= '{print $2}'`

       # drop and log

       if [ $NUM -gt 5 ] && [ -z "`/sbin/iptables -vnL INPUT|grep $IP`" ]

       then

               /sbin/iptables -I INPUT -s $IP -j DROP

               echo "/sbin/iptables -I INPUT -s $IP -j DROP" >> /home/cnscn/sh/ssh_scan_iptables.sh

               logger -i -t "ssh_scan_crontab" -f /var/log/messages "$IP($NUM)..."

       fi

done

#End of Script

.start it when system up

$ cat myiptables.sh

#!/bin/bash

#chkconfig: 345 85 15

#description: my iptables rules, which can auto run when system start

# This is a script

# Edit by liwei, cnscn

# establish a static firewall

#network interface

interdevice="eth0"

#port

#21       ftp

#15022    sshd

#25       smtp

#53       named

#80       http

#110      pop3

#Allow Access port

Open_ports="21 20 22 80"

#

Allow_ports="21 20 80 "

#clean old rules

iptables -F

iptables -X

iptables -t nat -F

iptables -t nat -X

#Add rule for drop bad ip

/home/cnscn/sh/ssh_scan_iptables.sh

#Allow My ip

/sbin/iptables -I INPUT -s 111.127.xxx.xxx -j ACCEPT

for eths in $interdevice ; do

  #

  #iptables -A INPUT -i ! $eths -j ACCEPT

  #Allow all access’s port(--dport)

  for Port in $Open_ports ; do

    iptables -A INPUT -i $eths -p tcp --dport $Port -j ACCEPT

    iptables -A INPUT -i $eths -p udp --dport $Port -j ACCEPT

  done

  #Deny spoof

  iptables -A INPUT -i $eths -p tcp -j REJECT --reject-with tcp-reset

  iptables -A INPUT -i $eths -p udp -j REJECT --reject-with icmp-port-unreachable

done

#forbidden ping

echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all

#End of Script