shell---登录失败的IP添加到/etc/hosts.deny

#!/bin/bash           //程序开始
#File: hosts_deny.sh
#Date: 2016-01-10

grep 'Failed password' /var/log/secure | awk '{print $11}' | uniq -c | sort | \
//取出日志中登录失败的IP并统计排序

while read a b     //读取统计结果
do
grep -q $b /etc/hosts.deny     //测试IP是否存在，存在为0
if [ $? != 0 ] ; then
if [ $a -ge 5 ] ; then   //统计的次数大于等于5
echo "sshd: $b" >> /etc/hosts.deny    //添加IP到黑名单
fi
fi
done               //程序结束