IP_ADDR=`tail -n 100 /var/log/secure |grep "Failed password"| egrep -o "([0-9]{1,3}.){3}[0-9]{1,3}"|sort -nr|uniq -C|awk '$1>=10 {print $2}'`
IPTABLE_CONF=/etc/sysconfig/iptables
echo
cat <<EOF
++++++++welcome to use ssh login DROP failed
ip ++++++++
EOF
for i in `echo $IP_ADDR`
do
cat $IPTABLE_CONF|grep $i>/dev/null
if[$? -ne 0];then
sed -i "/lo/a -A INPUT -s $i -m state --state NEW -m tcp -p tcp --dport 22 -j DROP" $IPTABLE_CONF
#匹配lo后面一行添加-A INPUT -s $i -m state --state NEW -m tcp -p tcp --dport 22 -j DROP" $IPTABLE_CONF
else
echo "这个$i 是不存在的"
exit
fi
done
/etc/init.d/iptables restart