Linux 服务器Centos7 SSH 防止暴力破解

1.所有 SSH 相关日志

grep sshd /var/log/secure

2.SSH 登录成功记录

grep "Accepted" /var/log/secure

3.SSH 登录失败记录

grep "Failed" /var/log/secure

或者更精确：

grep "Failed password" /var/log/secure

4.尝试使用不存在的用户名登录

grep "Invalid user" /var/log/secure

5.爆破IP提取

grep "Failed" /var/log/secure | \
awk '{for(i=1;i<=NF;i++) if($i=="from") print $(i+1)}' | \
sort | uniq > cdban.txt

6.创建CDBAN链

iptables -N CDBAN
iptables -I INPUT -j CDBAN

7.爆破IP加入到CDBAN链

while read ip; do
  # 跳过空行和注释行
  [[ -z "$ip" || "$ip" =~ ^# ]] && continue
  iptables -A CDBAN -s "$ip" -j DROP
done < cdban.txt

或手动增加IP到 CDBAN 链

iptables -A CDBAN -s 123.45.67.89 -j DROP

8.查看CDBAN链

iptables -L CDBAN -n --line-numbers

9.首次保存 iptables 配置使用

sudo service iptables save
sudo yum install iptables-services
sudo systemctl stop firewalld
sudo systemctl disable firewalld
sudo systemctl enable iptables
sudo systemctl start iptables