linux自动ip拉黑

#!/bin/bash

# 定义日志文件路径
LOG_FILE="/var/log/auth.log"

# 定义拉黑阈值（每分钟超过10次失败的登录尝试）
THRESHOLD=10

# 定义时间窗口（1分钟）
TIME_WINDOW=60

# 获取当前时间戳
CURRENT_TIMESTAMP=$(date +%s)

# 清空之前的记录
echo "" > /tmp/ssh_attempts.log

# 解析日志文件，统计每个IP的失败登录尝试次数
awk '/Failed/{print $11}' $LOG_FILE | sort | uniq -c | while read count ip; do
    if [ "$count" -gt "$THRESHOLD" ]; then
        echo "$CURRENT_TIMESTAMP $ip $count" >> /tmp/ssh_attempts.log
    fi
done

# 检查并拉黑超过阈值的IP
while read timestamp ip count; do
    if [ $(($(date +%s) - $timestamp)) -lt $TIME_WINDOW ]; then
        iptables -A INPUT -s $ip -j DROP
        echo "Blocked IP: $ip" >> /var/log/blocked_ips.log
    fi
done < /tmp/ssh_attempts.log