阻止ssh暴力破解

阻止ssh暴力破解

说明：
今天无意间看了下/var/log/secure日志，吓了一跳，如下：

Sep 15 14:25:12 localhost sshd[5914]: Failed password for root from 221.203.142.70 port 49476 ssh2
Sep 15 14:25:12 localhost sshd[5934]: Failed password for root from 115.182.88.152 port 28712 ssh2
Sep 15 14:25:13 localhost sshd[5918]: Failed password for root from 221.203.142.72 port 44212 ssh2
Sep 15 14:25:13 localhost sshd[5930]: Failed password for root from 218.65.30.92 port 42513 ssh2
Sep 15 14:25:15 localhost sshd[5946]: Failed password for root from 115.182.88.152 port 29380 ssh2
Sep 15 14:25:16 localhost sshd[5930]: Failed password for root from 218.65.30.92 port 42513 ssh2
Sep 15 14:25:16 localhost sshd[5952]: Failed password for root from 221.203.142.72 port 57263 ssh2
Sep 15 14:25:16 localhost sshd[5949]: Failed password for root from 221.203.142.70 port 33909 ssh2
Sep 15 14:25:17 localhost sshd[5957]: Failed password for root from 115.182.88.152 port 30023 ssh2
Sep 15 14:25:18 localhost sshd[5952]: Failed password for root from 221.203.142.72 port 57263 ssh2
Sep 15 14:25:19 localhost sshd[5949]: Failed password for root from 221.203.142.70 port 33909 ssh2
Sep 15 14:25:19 localhost sshd[5961]: Failed password for root from 218.65.30.92 port 56454 ssh2
Sep 15 14:25:19 localhost sshd[5967]: Failed password for root from 115.182.88.152 port 30601 ssh2
Sep 15 14:25:21 localhost sshd[5952]: Failed password for root from 221.203.142.72 port 57263 ssh2
Sep 15 14:25:21 localhost sshd[5949]: Failed password for root from 221.203.142.70 port 33909 ssh2
Sep 15 14:25:21 localhost sshd[5961]: Failed password for root from 218.65.30.92 port 56454 ssh2
Sep 15 14:25:23 localhost sshd[5991]: Failed password for root from 115.182.88.152 port 31030 ssh2
Sep 15 14:25:24 localhost sshd[5961]: Failed password for root from 218.65.30.92 port 56454 ssh2
Sep 15 14:25:24 localhost sshd[5996]: Failed password for root from 221.203.142.72 port 41459 ssh2
Sep 15 14:25:25 localhost sshd[5998]: Failed password for root from 221.203.142.70 port 48277 ssh2
Sep 15 14:25:25 localhost sshd[6001]: Failed password for root from 115.182.88.152 port 31725 ssh2

有人试图去破解服务器的root密码

解决方法：
方法一：禁止root用户直接登录：

由于线上有些程序里采用了root密码，所以此方法无法使用

方法二：把恶意ip直接禁掉

写一个shell脚本，如下：

vi /root/scripts/denyRootSsh/denyRootSsh.sh
#!/bin/bash

#过滤Failed password for root,写入failIP.txt文件
grep 'Failed password for root from' /var/log/secure | awk '{print $11}' | sort | uniq -c | sort -rn > /root/scripts/denyRootSsh/failIP.txt

#失败次数大于100的，将其ip写入/etc/hosts.deny文件
while read failStatus
do
failTimes=`echo $failStatus | awk '{print $1}'`
failIP=`echo $failStatus | awk '{print $2}'`
if [ $failTimes -gt 100 ];then
denyIP=`grep $failIP /etc/hosts.deny`
if [ -z $denyIP ];then
echo "sshd:$failIP" >> /etc/hosts.deny
fi
fi
done < /root/scripts/denyRootSsh/failIP.tx

脚本解读：
/etc/hosts.deny文件
sshd:43.229.53.55 ##禁止ip43.229.53.55再次访问root

写个计划任务，每天凌晨1点执行一次