1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
| cat /var/log/secure |grep failure|awk '{for (i=1;i<=NF;i++){if ($i ~/rhost/) {print $i}}}'| sort | uniq|awk -F"=" '{print $2}' >> black.list
cat black.list|sort|uniq > black.list.tmp rm -rf black.list mv black.list.tmp black.list
firewall-cmd --list-rich-rules > blackiprule.list all=`cat blackiprule.list`
for ip in `cat black.list|sort|uniq` do if [[ $all =~ $ip ]] then : else echo "不包含" firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='$ip' reject" fi done
cat blackiprule.list|wc -l firewall-cmd --reload
|