登录服务器失败 IP 统计和处理方法

#
# hosts.deny    This file contains access rules which are used to
#               deny connections to network services that either use
#               the tcp_wrappers library or that have been
#               started through a tcp_wrappers-enabled xinetd.
#
#               The rules in this file can also be set up in
#               /etc/hosts.allow with a ‘deny‘ option instead.
#
#               See ‘man 5 hosts_options‘ and ‘man 5 hosts_access‘
#               for information on rule syntax.
#               See ‘man tcpd‘ for information on tcp_wrappers
#
sshd:192.168.2.41:deny

def ip_index():
    #读取文件获取到已经有被限制的IP
    ip_list = set()
    with open(‘hosts.deny‘,mode=‘r‘,encoding=‘utf-8‘) as f_log:
        for line in f_log:
            line = line.split(‘\n‘)[0].split(‘ ‘)[0]
            if len(line) !=0 and not line[0].startswith("#"):
                line = line.split(":")
                ip_list.add(line[1])
    return ip_list

def write():
    # 写入失败的IP到配置文件中
    with open(‘ip_fail.txt‘,mode=‘r‘,encoding=‘utf-8‘) as f:
        for line in f:
            line = line.split(‘\n‘)[0].split(‘ ‘)
            if int(line[6]) > 2:
                print(‘登录失败次数大于2的IP‘,line[7])
                with open(‘hosts.deny‘,mode=‘a‘,encoding=‘utf-8‘) as f:
                    if line[7] not in ip_list:
                        f.write(‘sshd:%s:deny\n‘%line[7])

if __name__ == ‘__main__‘:
    ip_list = ip_index()
    write()

import subprocess
command = "awk ‘/Failed password/ {print $(NF-3)}‘ /var/log/secure |sort -n |uniq -c|sort -n"
def result(command):
    # 获取命令结果
    obj=subprocess.Popen(command,
                     shell=True,
                     stdout=subprocess.PIPE,
                     stderr=subprocess.PIPE
                     )
    return obj.stdout

def ip_list(result):
    # 根据命令结果获取到失败IP的字典
    ip_set={}
    for line in result:
        line=str(line)
        ip = line.split(‘ ‘)[-1].split(‘\\n‘)[0]
        count = line.split(‘ ‘)[-2]
        # 失败次数大于3的
        if int(count) > 3:
            ip_set[count]=ip
    return ip_set

def ip_index():
    #读取文件获取到已经有被限制的IP
    out_ip = set()
    with open(‘/etc/hosts.deny‘,mode=‘r‘,encoding=‘utf-8‘) as f_log:
        for line in f_log:
            line = line.split(‘\n‘)[0].split(‘ ‘)[0]
            if len(line) !=0 and not line[0].startswith("#"):
                line = line.split(":")
                out_ip.add(line[1])
    return out_ip


def write(out_ip,in_ip):
    with open(‘/etc/hosts.deny‘,mode=‘a‘,encoding=‘utf-8‘) as f:
        for ip in out_ip:
            if out_ip[ip] not in in_ip:
                f.write(‘sshd:%s:deny\n‘%out_ip[ip])


if __name__ == ‘__main__‘:
    in_ip = ip_index()  # 获取已有被限制的IP
    result = result(command)    # 得到命令结果
    out_ip=ip_list(result)     # 根据命令结果获取IP列表
    write(out_ip,in_ip)

import subprocess
command = "awk ‘/Failed password/ {print $(NF-3)}‘ /var/log/secure |sort -n |uniq -c|sort -n"
def result(command):
    obj=subprocess.Popen(command,
                     shell=True,
                     stdout=subprocess.PIPE,
                     stderr=subprocess.PIPE
                     )
    return obj.stdout

def ip_list(result):
    ip_set={}
    for line in result:
        line=str(line)
        ip = line.split(‘ ‘)[-1].split(‘\\n‘)[0]
        count = line.split(‘ ‘)[-2]
        if int(count) > 3:
            ip_set[count]=ip
    return ip_set

def ip_index():
    out_ip = set()
    with open(‘/etc/hosts.deny‘,mode=‘r‘) as f_log:
        for line in f_log:
            line = line.split(‘\n‘)[0].split(‘ ‘)[0]
            if len(line) !=0 and not line[0].startswith("#"):
                line = line.split(":")
                out_ip.add(line[1])
    return out_ip


def write(out_ip,in_ip):
    with open(‘/etc/hosts.deny‘,mode=‘a‘) as f:
        for ip in out_ip:
            if out_ip[ip] not in in_ip:
                f.write(‘sshd:%s:deny\n‘%out_ip[ip])


if __name__ == ‘__main__‘:
    in_ip = ip_index()
    result = result(command)
    out_ip=ip_list(result)
    write(out_ip,in_ip)