1壮韭、編寫腳本/root/bin/checkip.sh北发，每5分鐘檢查一次，如果發(fā)現(xiàn)通過ssh登錄失敗 次數(shù)超過10次喷屋，自動將此遠程IP放入Tcp Wrapper的黑名單中予以禁止防問
編寫簡本
#bin/bash
source /etc/profile 初始化環(huán)境變量
lastb |awk '{ip[$3]++}END{for(i in ip){if(ip[i]>10)print i }}' > /data/shell/ip.txt
while read ip
do
iptables -A INPUT -s $ip -j REJECT
echo $ip
done < /data/shell/ip.txt
設置定時任務
[root@centos7 shell]#crontab -e
*/5 * * * * /bin/bash /data/shell/checkip.sh
[root@centos7 shell]# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:67
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:67
REJECT all -- 172.16.100.62 0.0.0.0/0 reject-with icmp-port-unreachable 被攔截ip
[root@et-server-62 ~]# ssh 172.16.100.43
ssh: connect to host 172.16.100.43 port 22: Connection refused 已無法訪問
2琳拨、配置magedu用戶的sudo權限，允許magedu用戶擁有root權限
[root@centos7 ~]#su magedu 未授權時
[magedu@centos7 root]$sudo ls
[sudo] password for magedu:
magedu is not in the sudoers file. This incident will be reported
[root@centos7 ~]#visudo 更改配置文件
## Next comes the main part: which users can run what software on
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:
##
## user MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere
root ALL=(ALL) ALL
magedu ALL=(root) ALL 賦予root權限
[root@centos7 ~]#su magedu
[magedu@centos7 root]$sudo ls
[sudo] password for magedu: 可查看
anaconda-ks.cfg Documents id_rsa_2048.pub Music Public sudoers Videos
Desktop Downloads ip.txt Pictures root@172.16.100.46 Templates
