#!/usr/bin/perl
# 及時封鎖使用 "暴入法" 入侵的使用者(SSH)
# 技術支援: http://www.vixual.net/
# 原著者是 vixual (應該是吧!)
# chmod 755 block_ssh.pl
# 編輯 /etc/hosts.allow，加入
# sshd : ALL : spawn (/root/bin/block_ssh.pl %c %d)
# 這樣就完成了，如有必要，請自行修改 block_ssh.pl 裡相關的參數。
# 以上取自原作者的網站
# ==相關參數==
#記錄 ssh 連線的 LOG 檔，預設: /var/log/secure
$log_file = "/var/log/secure";
#於多久的時間內嘗試登入(秒)，預設: 1 小小時
$time_range = 1 * 60 * 60;
#於 $time_range 所設定的時間內，嘗試登入失敗多少次立即封鎖 IP，預設: 10 次
$drop_count = 10;
#寄件通知，預設收件者: root@localhost
$mail = 'cmd@www.lapom.no-ip.org';
#寄件程式的位置
$sendmail = "/usr/sbin/sendmail";
#====
use Time::Local;
$ip = $ARGV[0];
$daemon = $ARGV[1];
$count = 0;
$ip =~ s/::ffff://;
%month = (
Jan => 0,
Feb => 1,
Mar => 2,
Apr => 3,
May => 4,
Jun => 5,
Jul => 6,
Aug => 7,
Sep => 8,
Oct => 9,
Nov => 10,
Dec => 11
);
$time = time();
($second,$minute,$hour,$day,$month,$year) = localtime($time);
#取得登入失敗的 logg
@list = `cat $log_file | grep "sshd.*Failed password.*$ip "`;
for(my $i = $#list; $i >= 0; $i--){
#取得 log 的時間
my($log_month,$log_day,$log_time) = split(/ +/,$list[$i]);
my($log_hour,$log_minute,$log_second) = split(/:/,$log_time);
#前一年的記錄
if($log_month > $month){
$log_year = $year - 1;
}else{
$log_year = $year;
}
#將時間轉為秒數
$log_time = timelocal($log_second,$log_minute,$log_hour,$log_day,$month{$log_month},$log_year);
if($time < $log_time + $time_range ){
$count++;
}else{
last;
}
}
if($count > $drop_count){
#封鎖 IP
`iptables -I INPUT -p tcp -s $ip --dport 22 -j DROP`;
if($mail){
#寄件通知
$hostname = `hostname`;
$month++;
$year += 1900;
chomp($hostname);
open(MAIL, "| $sendmail -t") || die "Can't open $sendmail !\n";
print MAIL qq|To: $mail\n|;
print MAIL qq|Subject: [$hostname]封鎖 $ip\n|;
print MAIL qq|Content-Transfer-Encoding: 8bit\n|;
print MAIL qq|Content-type: text/plain\; charset=Big5\n\n|;
print MAIL "\n時間: $year-$month-$day $hour:$minute:$second\n----\n使用者 \"$ip\" 嘗試以 SSH 登入伺服器，共失敗 $count 次，已於防火牆封鎖該 IP。\n\n";
print MAIL @list;
close(MAIL);
}
}
exit;
#******************************
#ssh client menu script by CMD
# 2010.02.25
#******************************
# specify PC's IP address here
# 把常用的電腦IP加在這裏
PC[1]="192.168.69.247"
PC[2]="192.168.69..243"
PC[3]="192.168.69..122"
PC[4]="192.168.69..141"
#***********************************
# do not need to be changed from here
REPEAT_LOOP=1
while [ "$REPEAT_LOOP" = 1 ]; do
clear
echo " Lazy ssh....."
I=0
for Spc in "${PC[@]}";do
I=`expr $I + 1`
echo " $I. ssh to $Spc."
done
I=0
for Spc in "${PC[@]}";do
I=`expr $I + 1`
echo " X$I. ssh -X to $Spc."
done
echo " X|x. EXIT."
echo " "
echo -n "Please type a selection: "
read usr_choice &> /dev/null
if (( $usr_choice > 0 && $usr_choice <= $I )) ; then
echo "ssh ${PC[$usr_choice]}..."
ssh ${PC[$usr_choice]}
elif ([ $usr_choice = "X" ] || [ $usr_choice = "x" ]) ; then
echo "Exiting ......"
exit
else
tmp=`echo "$usr_choice" | sed s/X// | sed s/x// `
if (( $tmp > 0 && $tmp <= $I )) ; then
echo "ssh -X ${PC[$tmp]}..."
ssh -X ${PC[$tmp]}
else
echo "Invalid Choice. Please try again."
REPEAT_LOOP=1
fi
fi
done
ulimit -s unlimited
-bash: ulimit: stack size: cannot modify limit: Operation not permitted
/etc/security/limits.conf 加一行： * hard stack unlimited
gawk '{print $1, $2, $5, $6}' file
gawk '{print $1, $2, $5*10, $6*10}' file
SCALE=10
gawk '{print $1, $2, $5*$SCALE, $6*$SCALE}' file
SCALE=10
gawk '{print $1, $2, $5*sca, $6*sca}' sca=$SCALE file
gawk 'sum=sum+$1 {print $1, sum}' sca=$SCALE file
gawk 'sum=sum+$1; ss=ss+$2 {print $1, sum, $2, ss}' sca=$SCALE file
