最近、sshポートに対してブルートフォースアタック するのが流行らしく
いっぱいログが溜まるようになってきた。
で、パスワード間違えたら一定時間ポートを閉じてしまう
スクリプトを見つけたので導入してみた。
参考は、「SSHの大量不正アクセスログ」
iptablesが必要なので
apt-get install iptables
しておく
/etc/hosts.allowに
sshd : ALL : spawn ( /usr/local/bin/block_ssh_attack.sh %c 5 ) : allow
を追加
#!/bin/sh
# arg1 : ip addr ( can be given by tcpd )
# arg2 : suspend time in minutes
export NUMLOGBACK=10
export LOGFILE=/var/log/secure
export SSHPORT=22
export WHITELIST="hosta.example.org hostb.example.org"
export MAILCMD=mail
export IPADDR=$1
export SUSPENDMIN=$2
whitelist()
{
#echo "checking white list ${IPADDR?}"
for i in $WHITELIST;do
host $i | awk ‘{ print "x" $13 "x" }’ | grep "x${IPADDR?}x" >\
/dev/null && return 0;
done
#echo "not in white list"
return 1;
}
tail -${NUMLOGBACK?} ${LOGFILE?} | \
egrep -i "sshd.*(Illegal user [-a-zA-Z0-9\.]+|Failed password for (root|invalid user [-a-zA-Z0-9\.]+)|Did not receive identification string) from ${IPADDR?} " > \
/dev/null && export MATCH=TRUE
[ x$MATCH = xTRUE ] && whitelist && export MATCH=TRUE
if [ x$MATCH = xTRUE ]; then
echo "match"
/sbin/iptables -L -n | grep "REJECT.*${IPADDR?}" > /dev/null
if [ $? != 0 ]; then
echo "not in the list"
/sbin/iptables -I INPUT 1 -s ${IPADDR?} -p tcp –dport ${SSHPORT?}:${SSHPORT?} -j REJECT
echo "/sbin/iptables -D INPUT -s ${IPADDR?} -p tcp –dport ${SSHPORT?}:${SSHPORT?} -j REJECT" | \
at "now + ${SUSPENDMIN?} min" > /dev/null
logger -p authpriv.info -t SSHBLOCK "blocking ip ${IPADDR?} for ${SUSPENDMIN?} minutes"
#echo "blocking ssh from ip `host ${IPADDR?}`" | $MAILCMD -s sshd-block-${IPADDR?} root
echo "blocking ssh from ip ${IPADDR?}" | $MAILCMD -s sshd-block-${IPADDR?} root
else
echo "in the list"
fi
else
echo "No match"
#echo `host ${IPADDR?}` | $MAILCMD -s sshd-${IPADDR?} root
logger -p authpriv.info -t SSHBLOCK "ip ${IPADDR?} allowed"
fi
ってな感じ
うまく行くかな？？