From c68ed1bb24f238fdc72e4df650a05a705d81ab83 Mon Sep 17 00:00:00 2001
From: midoks <midoks@163.com>
Date: Tue, 9 Mar 2021 22:49:59 +0800
Subject: [PATCH] Create check-ssh.sh

---
 plugins/ssh-no-login/check-ssh.sh | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100755 plugins/ssh-no-login/check-ssh.sh

diff --git a/plugins/ssh-no-login/check-ssh.sh b/plugins/ssh-no-login/check-ssh.sh
new file mode 100755
index 000000000..8a648ef10
--- /dev/null
+++ b/plugins/ssh-no-login/check-ssh.sh
@@ -0,0 +1,21 @@
+#! /bin/bash
+#禁止弱口令登录改良版
+
+cat /var/log/secure|awk '/Failed/{print $(NF-3)}'|sort|uniq -c|awk '{print $2"="$1;}' > black.txt #尝试登录的次数和ip
+
+DEFINE="5"  #单个ip尝试登录最大值
+
+for i in `cat /root/black.txt`
+do
+
+    IP=`echo $i |awk -F= '{print $1}'`
+    NUM=`echo $i|awk -F= '{print $2}'`
+
+    if [ $NUM -gt $DEFINE ]; then
+        grep $IP /etc/hosts.deny > /dev/null
+
+        if [ $? -gt 0 ]; then
+            echo "sshd:$IP" >> /etc/hosts.deny  #扔到hosts文件中
+        fi
+    fi
+done
\ No newline at end of file