1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
| cat /var/log/secure |grep failure|awk '{for (i=1;i<=NF;i++){if ($i ~/rhost/) {print $i}}}'| sort | uniq|awk -F"=" '{print $2}' >> black.list
cat black.list|sort|uniq > black.list.tmp
rm -rf black.list
mv black.list.tmp black.list
firewall-cmd --list-rich-rules > blackiprule.list
all=`cat blackiprule.list`
for ip in `cat black.list|sort|uniq`
do
if [[ $all =~ $ip ]]
then
:
else
echo "不包含"
firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='$ip' reject"
fi
done
cat blackiprule.list|wc -l
firewall-cmd --reload
|