监视 SSH 登陆入侵者

最新推荐文章于 2024-07-15 08:45:03 发布

转载最新推荐文章于 2024-07-15 08:45:03 发布 · 176 阅读

0 ·

CC 4.0 BY-SA版权

原文链接：https://my.oschina.net/lvyi/blog/532849

文章标签：

#运维 #php #awk

为什么80%的码农都做不了架构师？>>>

有很多黑客扫描 ssh 端口进而来控制机器，可以写一个分析脚本找出非法入侵的 IP 地址等信息。

##实现

#!/bin/bash

AUTHLOG=/var/log/auth.log

if [[ -n $1 ]];
then
	AUTHLOG=$1
	echo Using Log file : $AUTHLOG
fi

LOG=/tmp/valid.$$.log
grep -v "invalid" $AUTHLOG > $LOG

users=$(grep "Failed password" $LOG | awk '{ print $(NF-5) }' | sort | uniq)
echo $users

printf "%-5s|%-10s|%-10s|%-13s|%-33s|%s\n" "Sr#" "User" "Attempts" "IP Address" "Host_Mapping" "Time range"

ucount=0;

ip_list="$(egrep -o "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" $LOG | sort | uniq)"

for ip in $ip_list;
do
	grep $ip $LOG > /tmp/temp.$$.log #某个 IP 地址的 log
	for user in $users;
		do
			grep $user /tmp/temp.$$.log > /tmp/$$.log #某个 user 在这个 IP 登陆的 log
			cut -c-16 /tmp/$$.log > $$.time 
			tstart=$(head -1 $$.time);          #开始时间
			start=$(date -d "$tstart" "+%s");   #开始时间戳
			tend=$(tail -1 $$.time);            #结束时间
			end=$(date -d "$tend" "+%s")        #结束时间戳

			limit=$(( $end - $start )) 

			if [ $limit -gt 120 ];
				then
					let ucount++;

					IP=$(egrep -o "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" /tmp/$$.log | head -1 );

					TIME_RANGE="$tstart-->$tend"

					ATTEMPTS=$(cat /tmp/$$.log|wc -l);

					HOST=$(host $IP | awk '{ print $NF }')

				printf "%-5s|%-10s|%-10s|%-13s|%-33s|%s\n" "$ucount" "$user" "$ATTEMPTS" "$IP" "$HOST" "$TIME_RANGE";
			fi
	done
done

rm /tmp/valid.$$.log /tmp/$$.log ./$$.time /tmp/temp.$$.log  2> /dev/null

结果

在本地运行脚本，发现有这么多的扫描次数。

bin mysql root sshd
Sr#  |User      |Attempts  |IP Address   |Host_Mapping                     |Time range
1    |sshd      |5         |0.0.0.0      |3(NXDOMAIN)                      |Nov 17 09:26:17 -->Nov 19 17:12:18 
2    |sshd      |10        |103.226.143.91|3(NXDOMAIN)                      |Nov 16 13:16:24 -->Nov 16 15:08:27 
3    |sshd      |4         |123.151.42.61|3(NXDOMAIN)                      |Nov 18 10:07:30 -->Nov 19 10:07:40 
4    |root      |9         |127.0.0.1    |3(NXDOMAIN)                      |Nov 19 17:02:04 -->Nov 19 17:12:41 
5    |sshd      |26        |127.0.0.1    |3(NXDOMAIN)                      |Nov 19 17:01:21 -->Nov 19 17:12:41 
6    |sshd      |621       |128.134.178.74|3(NXDOMAIN)                      |Nov 17 12:59:03 -->Nov 17 13:15:39 
7    |sshd      |207       |175.100.191.72|3(NXDOMAIN)                      |Nov 17 17:18:14 -->Nov 17 17:20:21 
8    |sshd      |10        |182.243.87.252|3(NXDOMAIN)                      |Nov 19 10:21:55 -->Nov 19 11:49:30 
9    |root      |30        |211.90.87.193|3(NXDOMAIN)                      |Nov 19 11:03:07 -->Nov 19 11:27:40 
10   |sshd      |2140      |211.90.87.193|3(NXDOMAIN)                      |Nov 19 10:55:32 -->Nov 19 11:30:12 
11   |root      |76        |218.1.121.46 |3(NXDOMAIN)                      |Nov 16 20:39:38 -->Nov 16 20:43:02 
12   |sshd      |144       |218.1.121.46 |3(NXDOMAIN)                      |Nov 16 20:39:23 -->Nov 16 20:43:14 
13   |root      |45        |218.87.194.83|3(NXDOMAIN)                      |Nov 17 21:48:26 -->Nov 17 21:57:15 
14   |sshd      |238       |218.87.194.83|3(NXDOMAIN)                      |Nov 17 21:43:18 -->Nov 17 21:57:15 
15   |root      |40        |222.186.15.203|3(NXDOMAIN)                      |Nov 18 12:14:19 -->Nov 18 12:17:58 
16   |sshd      |41        |222.186.15.203|3(NXDOMAIN)                      |Nov 18 12:14:19 -->Nov 18 12:17:58 
17   |sshd      |10        |222.186.15.30|3(NXDOMAIN)                      |Nov 18 16:21:49 -->Nov 18 20:59:28 
18   |root      |164       |222.186.58.134|3(NXDOMAIN)                      |Nov 17 18:52:29 -->Nov 17 19:11:25 
19   |sshd      |164       |222.186.58.134|3(NXDOMAIN)                      |Nov 17 18:52:29 -->Nov 17 19:11:25 
20   |root      |406       |223.194.199.9|3(NXDOMAIN)                      |Nov 17 21:45:36 -->Nov 17 22:04:30 
21   |sshd      |639       |223.194.199.9|3(NXDOMAIN)                      |Nov 17 21:45:25 -->Nov 17 22:04:30 
22   |sshd      |10        |27.200.213.105|3(NXDOMAIN)                      |Nov 16 10:47:42 -->Nov 16 11:04:52 
23   |sshd      |10        |31.180.227.4 |3(NXDOMAIN)                      |Nov 17 22:03:16 -->Nov 17 23:32:16 
24   |bin       |11        |43.248.10.92 |3(NXDOMAIN)                      |Nov 16 17:06:48 -->Nov 18 16:28:58 
25   |root      |1662      |61.147.103.71|3(NXDOMAIN)                      |Nov 17 10:24:37 -->Nov 17 11:13:47 
26   |sshd      |2493      |61.147.103.71|3(NXDOMAIN)                      |Nov 17 10:24:37 -->Nov 17 11:13:47