Shulou(Shulou.com)06/01 Report--

Mailbox server is placed in the intranet mapping company IP, after opening the port, has been constantly violently cracked, depressed to death. One of the IP has 6W multiple times; thus using scripts to block IP access.

1. The script is as follows:

#! / bin/bash# author: kuangl# mial: kuangl@orient-media.com# date: 2013-05-04source / etc/profileawk-F "['/ disconnect from unknown/ {print $NF}'/ var/log/maillog | grep-v" 189.154.4.22 "| sed" s /] / / g "| sort-nr | uniq-c | sort | awk'{print $1" = "$2}'> / root/bad_ip_tmp.txtawk-F": "'/ verification failed/ {print" $5}'/ var/log/maillog | grep-v "189.154.22" | grep-v "SASL" | sort-nr | uniq-c | awk'{print $1 "=" $2}'> > / root/bad_ip_tmp.txtawk-F "-"'/\ / phpmyadmin\ / scripts\ / setup\ .php / {print $1}'/ var/log/httpd/access_log | grep-v "189.154.22" | sort-nr | uniq-c | sort-n | awk'{print $1 "= "$2}'> / root/bad_ip_tmp.txtawk-F"-"'/ ZmEu/ {print $1}'/ var/log/httpd/access_log | grep-v" 189.154.4.22 "| sort-nr | uniq-c | sort-n | awk'{print $1" = "$2}'> > / root/bad_ip_tmp.txtsort / root/bad_ip_tmp.txt | uniq > / root/bad_ip.txtDEFINE=" 2 "for i in $(cat / root/bad_ip) .txt) doNUM= `echo $I | awk-F "='{print $1} '`IP= `echo $I | awk-F" =' {print $2} '`if [$NUM-ge $DEFINE] Theniptables-L-n | grep $IP > / dev/nullif [$?-gt 0]; theniptables-I RH-Firewall-1-INPUT 4-s $IP-j DROPfifidone

2. If the task is scheduled to run every 5 minutes

* / 5 * / home/kuangl/deny_bad_ip_for_smtp.sh0 1 * / etc/init.d/iptables restart

3. Check the firewall

DROP all-192.241.206.14 0.0.0.0/0DROP all-198.50.251.242 0.0.0.0/0DROP all-198.23.245.154 0.0.0.0/0DROP all-217.139.66.140 0.0.0.0/0DROP all-134.0 .27.102 0.0.0.0/0DROP all-- 218.22.226.6 0.0.0.0/0DROP all-- 218.22.226.5 0.0.0.0/0DROP all-- 202.158.163.158 0.0.0.0/0DROP all-- 109.169.86.193 0.0.0.0

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.