[问题求助]白金 哥哥 救命啊 ！ 我被攻击了！！！ [复制链接]

[root@mail .log]# .netstat -ant | grep TIME | wc -l服务器
10195
在看 日志  那在 猜我的端口.。            杀毒
Sep  9 10:08:53 mail .sshd[2.8332]: pam_unix(sshd:auth): au.thentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip243.133.adsl.wplus.r.u  user=root          婚庆
Sep  9 10:08:55 mail sshd[28332]: Fail.ed .password for root from 195.131.133..243 port 3696 ssh2服务器
Sep . 9 10:0.8:56 mail sshd[28333]: Received. disconnect from 195.131.133.243: 11: Bye Bye健康
Sep  9 10:08:59 mai.l sshd[28335]:. pam_unix(sshd:auth): authentication failure; logname= uid=.0 euid=0 tty=ssh ruser= rhost=ip243.133.adsl..wplus.ru  user=root.
Sep  9 1.0:09:01 mail ss.hd[28335]: Failed password for root from 195.131.133.243 port 375.0 ssh2           建材
Sep  9 10:09:.01 mail sshd[28336]: Re.ceived disconnect from 195..131.133.243: 11: Bye Bye           女人
Sep  9 10:09:04 mail sshd[28337]: pam_unix(sshd:auth).: authenticati.on failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip243..133.adsl.wplus.ru  user=ro.ot             汽车
Sep  9. 10:09:07 mail ssh.d[28337]: Failed password for root from 195.131.133.243 port 3800 ssh2.虚拟主机
Sep . 9 10:09:07 mail ss.hd[28338]: Received disconnect f.rom 195.131.133.243: 11: Bye Bye.
Sep . 9 10:09:10 mail s.shd[28339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip243.133..adsl.wplus.r.u  user=root              乙肝
Sep . 9 10:09:12 mail sshd[28339]: Faile.d password for root from 195.13.1.133.243 port 3857 ssh2             电子
Sep  9 10:09:12 mail sshd[28340.]: R.eceived disconnect from 195..131.133.243: 11: Bye Bye健康
Sep  9 10:09:15 mail ss.hd[28341]: pam_unix(sshd:.auth): authentication failure; logname..= uid=0 euid=0 tty=ssh ruser= rhost=ip243.133.adsl.wplus.ru  user=root(广告)
Sep  9 10:09:18 mail sshd[28341.]: Failed password for root fr.om 195.131.133.243 po.rt 3909 ssh2教育
Sep  9 10:09:18 mail sshd[28342]: Received dis.connect from 195.131.133.243.: 11.: Bye Bye健康
Sep  9 10..:09:21 mail sshd[28343]: pam_unix(sshd:a.uth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip243.133.adsl.wplus..ru  user=root学习
Sep . 9 10:09:23 mail sshd[28343]: Failed password for root .fr.om 195.131.133.243 port 3964 ssh2服务器
Sep  9.. 10:09:23 mail sshd[28344]: Received disconnect from 195.131.133.243: 11:. Bye Bye电影
Sep  9 10:09:.26 mail sshd[28345]: pam_u.nix(sshd:auth): authentication failure; logname.= uid=0 euid=0 tty=ssh ruser= rhost=ip243.133.adsl.wplus.ru  user=roo.t电脑
Sep  9 10:09:28 mail sshd[28345]: Failed password for root fr.om 195.131..133.243 port 4.006 ssh2.
Sep  9 10:09:29 mail sshd[28346]: Received disconnect fr.om 195.131.133..243:. 11: Bye Bye电脑
Se.p  9 10:09:31 mail sshd[28347]: pam_unix(sshd:auth): authen.tication failure; .logname= uid=0 euid=0 tty=ss.h ruser= rhost=ip243.133.adsl.wplus.ru  user=root学习
Sep  9 10:09:33 mail sshd[28.347]: Failed passwo.rd for root from 195.131.133.243 po.rt 4063 ssh2    美容
Sep  9 10:09:3.4 mail sshd[28348]: Rec.eived disconnect from 195.131.133.243: 11: Bye B.ye外贸
Sep  9 10:41:49 mail sshd[2.8403]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r.host=.222.171.126.5 . user=root--------------彩票
Sep  9. 10:41:50 mail sshd[28403]: Fai.led password for root from 222.171.126.5 port 39048 .ssh2服务器
Sep  9 10:41:51 mail sshd[28404]: Received disconnect from 222.171.126.5: 1.1: Bye B.ye.             电子
Sep  .9 .10:41:52 mail sshd[28405]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=s.sh ruser= rhost=222.171..126.5  user=root.
Sep  9 10:41:54 mail sshd[28405]: Failed password. for root from. 222.171..126.5 port 39093 ssh2             电子
Sep  9 10:41:54 mai.l sshd[28406.]: Received disconnect from 22.2.171.126.5: 11: Bye Bye.
Sep  9 10:41:55 m.ail sshd[28407]: pam_unix(sshd:auth): authentication failure; l.ogn.ame= uid=0 euid=0 tty=ssh ruser= rhost=222.171..126.5  user=root--- 印刷
Sep  9 10:41:57 m.ail sshd[28407]: Fa.iled password for root. from 222.171.126.5 port 39143 ssh2电影
Sep  9 10:41:57 mail sshd[28408]: Received disconnect from 222.171.126.5: 1.1: B..ye Bye学习
Sep  9 10:41:.59 mail sshd[28409]: pam_unix(sshd:auth).: authentication failure; logna.m.e= uid=0 euid=0 tty=ssh ruser= rhost=222.171.126.5  user=root.
Sep  9 10:42:01 mail sshd[28409.]: Failed pa.ssword for roo.t from 222.171.126.5 port 39185 ssh2投资
Sep  9 10:42:01 mail. sshd[28410]: Received disconnect f.ro.m 222.171.126.5: 11: Bye Bye<性病>
Sep  9 10:42:03 mail sshd[28411]: p.am_unix(ss.hd:auth): authentication failure; logname= uid=0 euid=0 tt.y=ssh. ruser= rhost=222.171.126.5  user=root             电子
Sep  9 10:42:04 mail sshd[28411.]: Failed pa.ssword fo.r root from 222.171.126.5 port 39241 ssh2<性病>
Sep  9 10:42:04 mail sshd[28412]: Received disconnect f.rom. 222..171.126.5: 11: Bye Bye(广告)
Sep  9 10:42:06 mail s.shd[28413]: p.am_unix.(sshd:auth): authentication fa.ilure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.171.126.5  user=root    外汇
Sep  9 10:.4.2:07 mail .sshd[28413]: Failed password for root from 222.171.126.5 port 39284 ssh2虚拟主机
Sep  9 10:42:07 mail sshd[28414]: Received disconnect from 222.171.1.26.5:. .11: Bye Bye.
Sep  9 10:42:08 mail sshd[2.8415]: pa.m_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= .rhost=222.171..126.5  user=root.
Sep  9. 10:42:10 mail sshd[28415]: Fa.iled pass.word for root from 222.171.126.5 port 39322 ssh2--------------彩票
Sep  9 10:42:10 m.ail. sshd[28416]: Re.ceived disconnect from 222.171.126.5: 11: Bye Bye.

再看 负载  load average: 2.58, 2..74, 3.3.0  虚拟主机

经过我的 .改动  已经好多了   最好的 时候 到达  5. 点多电脑
  PID USER      PR  N.I  VIRT  RES  S.HR S %CPU %MEM    TIME+  COMMAND教育
6163 edison    15   0  2312 1320  408 S    1  0.1   1:04..78 ssh.d.
6164 edison    15   0  .2312 1320  408 S    1 . 0.1   1:04.79 sshd           女人
6170 edison   . 15   0  2312 1364  456 S    1  0.1   0:39.85 ssh.d[成人用品]
6181 edison    15   0  .2312 1364  456. S    1  0.1   0:34.70 sshd           建材
62.04 edison    15   0 . 2312 1320  408 S    1  0.1   1:01.45 sshd--------------彩票
6245 edison .   1.5   0  2312 1320  408 S    1  0.1   0:59.62 sshd(        游戏          )
4117 edison    15   0  2308 1328  408 S    1  0..1  . 1:30.65 sshd           鲜花
4131 edison    15   0  2308 1328  408 S    1.  0.1   1:29..00 sshd外贸
4327 edi.son    15   0  2320 1364  456 S    1  0.1.   0:47.44 sshd           女人
4606 ediso.n    15   0  2316. 1364  456 S    1  0.1   0:50.01 sshd域名
4841 edison    15   0  2320 1360  456 S   .. 1  0.1   0:46.97 sshd健康
6168 ediso.n    15   0  2312 1364  456 S    .1  0.1   0:40.04 sshd[成人用品]
6169 edison    15   0  2312 1364.  456 S    1  0.1   0:39..94 sshd域名
6171 edison    15   0  2312 1364  456 S    1  0.1   0:39..82 sshd.    美容
6186 edison    15   0  231.2 1364  45.6 S    1  0.1   0:34.98 sshd.
6231 edi.son    15   0  2312 1.320  408 S    1  0.1   0:46.48 sshd(        游戏          )
6234 edison    15   0  231.2 1320  408 S    1  0.1   0:45..97 sshd[成人用品]
6242 edison    15   0  2312 1364  456. S  .  1  0.1   0:25.96 sshd           建材
8680 .root      15   0  2432 1256  78.4 R    1  0.1   0:00.43 top.
3756 edison    15   0  2308 1364  456 S  .  1  .0.1   0:22.43 sshd--- 印刷
4290 edison    15   0  2320 .1364  456 S   . 1  0.1   0:45.16 sshd           女人
4756 edison    15   0  2320 .1360  456 S .   1  0.1   0:51.06 sshd电脑
4.845 edison    15 .  0  2320 1360  456 S    1  0.1   0:38.93 sshd教育
4849 .edison    15   0  2320 1360  456 S  .  1  0.1   0:41.04 sshd[成人用品]
6001 edison    15   0  2320 1324  408 S    1  0.1   0.:23.30 ssh.d<性病>
6130 .edison    15   0  2312 1364  456 S    1  0.1   0:21..97 sshd             汽车
6134 edison    15   0.  2312 1364  456 S   . 1  0.1   0:29.99 sshd学习
6147 edison    15   0  2312 .1364  456 S    1  0.1   0:36..27 sshd            杀毒
6150 edison    15 .  0  23.12 1364  456 S    1  0.1   0:29.55 sshd电影
6177 edi.son    15   0  2312 1364  456 S    1  0.1   0:2.5.77 sshd--------------彩票
6179 edison    15   0  .2312 1364  456 S    1  0.1   0:.32.04 sshd.



我已经 改成  公钥验证了  去.掉了 密.码验证 。  我还如何做 ？[成人用品]

拨网线  

改sshd端口，临时逃避一下
如果是单点发起的探测，直接iptables踢他IP

经过一番 整顿     OK

在/etc/hosts.deny中加入他的IP

这不是攻击，只是在猜你的密码而已
我针对这个写过一个 blockscanner 你可以看一下
#! /bin/bash

# Name: blockscanner.sh by Platinum

SCANNER=`grep "\`date \"+ %d %H:%M\" -d \"-1min\"\`" /var/log/secure|awk '/Failed/{print $(NF-3)}'|sort|uniq -c|awk '{print $1"="$2;}'`

for i in $SCANNER
do
        NUM=`echo $i|awk -F= '{print $1}'`
        IP=`echo $i|awk -F= '{print $2}'`
        echo $NUM
        echo $IP
        if [ $NUM -gt 10 ] && [ -z "`iptables -vnL INPUT|grep $IP`" ]
        then
                iptables -I INPUT -s $IP -m state --state NEW,RELATED,ESTABLISHED -j DROP
                echo "`date` $IP($NUM)" >> /var/log/scanner.log
        fi
done

QUOTE:原帖由 platinum 于 2007-9-19 19:07 发表
这不是攻击，只是在猜你的密码而已
我针对这个写过一个 blockscanner 你可以看一下
#! /bin/bash

# Name: blockscanner.sh by Platinum

SCANNER=`grep "\`date \"+ %d %H:%M\" -d \"-1min\"\`" /var/lo ...

真的很同情白金.
我觉得有必要把这类demon脚本都集成到一个程序里面,做为Security Center,模块化,慢慢加模块会很强大的.

可以试试fail2ban。fail2ban作为daemon运行监测各种服务的logfile，当在logfile中连续出现多次错误信息时，自动调用iptables规则封锁源IP。

http://fail2ban.sourceforge.net/

要先学会使用而不是重复发明轮子

[ 本帖最后由 pangty 于 2007-9-19 21:53 编辑 ]

QUOTE:原帖由 pangty 于 2007-9-19 21:51 发表
可以试试fail2ban。fail2ban作为daemon运行监测各种服务的logfile，当在logfile中连续出现多次错误信息时，自动调用iptables规则封锁源IP。

http://fail2ban.sourceforge.net/

要先学会使用而不是重复发明轮子

呵呵，我看了一下我的脚本的编写日期，他的轮子发明日期只比我早一个月  
               __      _ _ ___ _

              / _|__ _(_) |_  ) |__  __ _ _ _

             |  _/ _` | | |/ /| '_ \/ _` | ' \

             |_| \__,_|_|_/___|_.__/\__,_|_||_|



=============================================================

Fail2Ban (version 0.8.1)                           2007/08/14

=============================================================



ver. 0.8.1 (2007/08/14) - stable

----------

- Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid

- Expand <HOST> in ignoreregex. Thanks to Yaroslav Halchenko

- Improved regular expressions. Thanks to Yaroslav Halchenko

  and others

- Added sendmail actions. The action started with "mail" are

  now deprecated. Thanks to Rapha?l Marichez

- Added "ignoreregex" support to fail2ban-regex

- Updated suse-initd and added it to MANIFEST. Thanks to

  Christian Rauch

- Tightening up the pid check in redhat-initd. Thanks to

  David Nutter

- Added webmin authentication filter. Thanks to Guillaume

  Delvit

- Removed textToDns() which is not required anymore. Thanks

  to Yaroslav Halchenko

- Added new action iptables-allports. Thanks to Yaroslav

  Halchenko

- Added "named" date format to date detector. Thanks to

  Yaroslav Halchenko

- Added filter file for named (bind9). Thanks to Yaroslav

  Halchenko

- Fixed vsftpd filter. Thanks to Yaroslav Halchenko



ver. 0.8.0 (2007/05/03) - stable

----------

- Fixed RedHat init script. Thanks to Jonathan Underwood

- Added Solaris 10 files. Thanks to Hanno 'Rince' Wagner



ver. 0.7.9 (2007/04/19) - release candidate

----------

- Close opened handlers. Thanks to Yaroslav Halchenko

- Fixed "reload" bug. Many many thanks to Yaroslav Halchenko

- Added date format for asctime without year

- Modified filters config. Thanks to Michael C. Haller

- Fixed a small bug in mail-buffered.conf



ver. 0.7.8 (2007/03/21) - release candidate

----------

- Fixed asctime pattern in datedetector.py

- Added new filters/actions. Thanks to Yaroslav Halchenko

- Added Suse init script and modified gentoo-initd. Thanks to

  Christian Rauch

- Moved every locking statements in a try..finally block



ver. 0.7.7 (2007/02/08) - release candidate

----------

- Added signal handling in fail2ban-client

- Added a wonderful visual effect when waiting on the server

- fail2ban-client returns an error code if configuration is

  not valid

- Added new filters/actions. Thanks to Yaroslav Halchenko

- Call Python interpreter directly (instead of using "env")

- Added file support to fail2ban-regex. Benchmark feature has

  been removed

- Added cacti script and template.

- Added IP list in "status <JAIL>". Thanks to Eric Gerbier



ver. 0.7.6 (2007/01/04) - beta

----------

- Added a "sleep 1" in redhat-initd. Thanks to Jim Wight

- Use /dev/log for SYSLOG output. Thanks to Joerg Sommrey

- Use numeric output for iptables in "actioncheck"

- Fixed removal of host in hosts.deny. Thanks to René Berber

- Added new date format (2006-12-21 06:43:20) and Exim4

  filter. Thanks to mEDI

- Several "failregex" and "ignoreregex" are now accepted.

  Creation of rules should be easier now.

- Added license in COPYING. Thanks to Axel Thimm

- Allow comma in action options. The value of the option must

  be escaped with " or '. Thanks to Yaroslav Halchenko

- Now Fail2ban goes in /usr/share/fail2ban instead of

  /usr/lib/fail2ban. This is more compliant with FHS. Thanks

  to Axel Thimm and Yaroslav Halchenko



ver. 0.7.5 (2006/12/07) - beta

----------

- Do not ban a host that is currently banned. Thanks to

  Yaroslav Halchenko

- The supported tags in "action(un)ban" are <ip>, <failures>

  and <time>

- Fixed refactoring bug (getLastcommand -> getLastAction)

- Added option "ignoreregex" in filter scripts and jail.conf.

  Feature Request #1283304

- Fixed a bug in user defined time regex/pattern

- Improved documentation

- Moved version.py and protocol.py to common/

- Merged "maxtime" option with "findtime"

- Added "<HOST>" tag support in failregex which matches

  default IP address/hostname. "(?P<host>\S)" is still valid

  and supported

- Fixed exception when calling fail2ban-server with unknown

  option

- Fixed Debian bug 400162. The "socket" option is now handled

  correctly by fail2ban-client

- Fixed RedHat init script. Thanks to Justin Shore

- Changed timeout to 30 secondes before assuming the server

  cannot be started. Thanks to Jo?l Bertrand



ver. 0.7.4 (2006/11/01) - beta

----------

- Improved configuration files. Thanks to Yaroslav Halchenko

- Added man page for "fail2ban-regex"

- Moved ban/unban messages from "info" level to "warn"

- Added "-s" option to specify the socket path and "socket"

  option in "fail2ban.conf"

- Added "backend" option in "jail.conf"

- Added more filters/actions and jail samples. Thanks to Nick

  Munger, Christoph Haas

- Improved testing framework

- Fixed a bug in the return code handling of the executed

  commands. Thanks to Yaroslav Halchenko

- Signal handling. There is a bug with join() and signal in

  Python

- Better debugging output for "fail2ban-regex"

- Added support for more date format

- cPickle does not work with Python 2.5. Use pickle instead

  (performance is not a problem in our case)



ver. 0.7.3 (2006/09/28) - beta

----------

- Added man pages. Thanks to Yaroslav Halchenko

- Added wildcard support for "logpath"

- Added Gamin (file and directory monitoring system) support

- (Re)added "ignoreip" option

- Added more concurrency protection

- First attempt at solving bug #1457620 (locale issue)

- Performance improvements

- (Re)added permanent banning with banTime < 0

- Added DNS support to "ignoreip". Feature Request #1285859



ver. 0.7.2 (2006/09/10) - beta

----------

- Refactoring and code cleanup

- Improved client output

- Added more get/set commands

- Added more configuration templates

- Removed "logpath" and "maxretry" from filter templates.

  They must be defined in jail.conf now

- Added interactive mode. Use "-i"

- Added a date detector. "timeregex" and "timepattern" are no

  more needed

- Added "fail2ban-regex". This is a tool to help finding

  "failregex"

- Improved server communication. Start a new thread for each

  incoming request. Fail2ban is not really thread-safe yet



ver. 0.7.1 (2006/08/23) - alpha

----------

- Fixed daemon mode bug

- Added Gentoo init.d script

- Fixed path bug when trying to start "fail2ban-server"

- Fixed reload command



ver. 0.7.0 (2006/08/23) - alpha

----------

- Almost a complete rewrite :) Fail2ban design is really

  better (IMHO). There is a lot of new features

- Client/Server architecture

- Multithreading. Each jail has its own threads: one for the

  log reading and another for the actions

- Execute several actions

- Split configuration files. They are more readable and easy

  to use

- failregex uses group (<host>) now. This feature was already

  present in the Debian package

- lots of things...



ver. 0.6.2 (2006/12/11) - stable

----------

- Fixed UTF-8 log file parsing

- Propagated patches introduced by Debian maintainer

  (Yaroslav Halchenko):

  * Made locale configurable

  * Fixed warning if ignoreip is empty

- Added named group "host" for "failregex". Fixed security

  vulnerability CVE-2006-6302



ver. 0.6.1 (2006/03/16) - stable

----------

- Added permanent banning. Set banTime to a negative value to

  enable this feature (-1 is perfect). Thanks to Mannone

- Fixed locale bug. Thanks to Fernando Jos??

- Fixed crash when time format does not match data

- Propagated patch from Debian to fix fail2ban search path

  addition to the path search list: now it is added first.

  Thanks to Nick Craig-Wood

- Added SMTP authentification for mail notification. Thanks

  to Markus Hoffmann

- Removed debug mode as it is confusing for people

- Added parsing of timestamp in TAI64N format (#1275325).

  Thanks to Mark Edgington

- Added patch #1382936 (Default formatted syslog logging).

  Thanks to Patrick B?rjesson

- Removed 192.168.0.0/16 from ignoreip. Attacks could also

  come from the local network.

- Robust startup: if iptables module does not get fully

  initialized after startup of fail2ban, fail2ban will do

  "maxreinit" attempts to initialize its own firewall. It

  will sleep between attempts for "polltime" number of

  seconds (closes Debian: #334272). Thanks to Yaroslav

  Halchenko

- Added "interpolations" in fail2ban.conf. This is provided

  by the ConfigParser module. Old configuration files still

  work. Thanks to Yaroslav Halchenko

- Added initial support for hosts.deny and shorewall. Need

  more testing. Please test. Thanks to kojiro from Gentoo

  forum for hosts.deny support

- Added support for vsftpd. Thanks to zugeschmiert



ver. 0.6.0 (2005/11/20) - stable

----------

- Propagated patches introduced by Debian maintainer

  (Yaroslav Halchenko):

  * Added an option to report local time (including timezone)

    or GMT in mail notification.



ver. 0.5.5 (2005/10/26) - beta

----------

- Propagated patches introduced by Debian maintainer

  (Yaroslav Halchenko):

  * Introduced fwcheck option to verify consistency of the

    chains. Implemented automatic restart of fail2ban main

    function in case check of fwban or fwunban command failed

    (closes: #329163, #331695). (Introduced patch was further

    adjusted by upstream author).

  * Added -f command line parameter for [findtime].

  * Added a cleanup of firewall rules on emergency shutdown

    when unknown exception is catched.

  * Fail2ban should not crash now if a wrong file name is

    specified in config.

  * reordered code a bit so that log targets are setup right

    after background and then only loglevel (verbose, debug)

    is processed, so the warning could be seen in the logs

  * Added a keyword <section> in parsing of the subject and

    the body of an email sent out by fail2ban (closes:

    #330311)



ver. 0.5.4 (2005/09/13) - beta

----------

- Fixed bug #1286222.

- Propagated patches introduced by Debian maintainer

  (Yaroslav Halchenko):

  * Fixed handling of SYSLOG logging target. Now it can log

    to any SYSLOG target and facility as directed by the

    config

  * Format of SYSLOG entries fixed to look closer to standard

  * Fixed errata in config/gentoo-confd

  * Introduced findtime configuration variable to control the

    lifetime of caught "failed" log entries



ver. 0.5.3 (2005/09/08) - beta

----------

- Fixed a bug when overriding "maxfailures" or "bantime".

  Thanks to Yaroslav Halchenko

- Added more debug output if an error occurs when sending

  mail. Thanks to Stephen Gildea

- Renamed "maxretry" to "maxfailures" and changed default

  value to 5. Thanks to Stephen Gildea

- Hopefully fixed bug #1256075

- Fixed bug #1262345

- Fixed exception handling in PIDLock

- Removed warning when using "-V" or "-h" with no config

  file. Thanks to Yaroslav Halchenko

- Removed "-i eth0" from config file. Thanks to Yaroslav

  Halchenko



ver. 0.5.2 (2005/08/06) - beta

----------

- Better PID lock file handling. Should close #1239562

- Added man pages

- Removed log4py dependency. Use logging module instead

- "maxretry" and "bantime" can be overridden in each section

- Fixed bug #1246278 (excessive memory usage)

- Fixed crash on wrong option value in configuration file

- Changed custom chains to lowercase



ver. 0.5.1 (2005/07/23) - beta

----------

- Fixed bugs #1241756, #1239557

- Added log targets in configuration file. Removed -l option

- Changed iptables rules in order to create a separated chain

  for each section

- Fixed static banList in firewall.py

- Added an initd script for Debian. Thanks to Yaroslav

  Halchenko

- Check for obsolete files after install



ver. 0.5.0 (2005/07/12) - beta

----------

- Added support for CIDR mask in ignoreip

- Added mail notification support

- Fixed bug #1234699

- Added tags replacement in rules definition. Should allow a

  clean solution for Feature Request #1229479

- Removed "interface" and "firewall" options

- Added start and end commands in the configuration file.

  Thanks to Yaroslav Halchenko

- Added firewall rules definition in the configuration file

- Cleaned fail2ban.py

- Added an initd script for RedHat/Fedora. Thanks to Andrey

  G. Grozin



ver. 0.4.1 (2005/06/30) - stable

----------

- Fixed textToDNS method which generated wrong matches for

  "rhost=12-xyz...". Thanks to Tom Pike

- fail2ban.conf modified for readability. Thanks to Iain Lea

- Added an initd script for Gentoo

- Changed default PID lock file location from /tmp to

  /var/run



ver. 0.4.0 (2005/04/24) - stable

----------

- Fixed textToDNS which did not recognize strings like

  "12-345-67-890.abcd.mnopqr.xyz"



ver. 0.3.1 (2005/03/31) - beta

----------

- Corrected level of messages

- Added DNS lookup support

- Improved parsing speed. Only parse the new log messages

- Added a second verbose level (-vv)



ver. 0.3.0 (2005/02/24) - beta

----------

- Re-writting of parts of the code in order to handle several

  log files with different rules

- Removed sshd.py because it is no more needed

- Fixed a bug when exiting with IP in the ban list

- Added PID lock file

- Improved some parts of the code

- Added ipfw-start-rule option (thanks to Robert Edeker)

- Added -k option which kills a currently running Fail2Ban



ver. 0.1.2 (2004/11/21) - beta

----------

- Add ipfw and ipfwadm support. The rules are taken from

  BlockIt. Thanks to Robert Edeker

- Add -e option which allows to set the interface. Thanks to

  Robert Edeker who reminded me this

- Small code cleaning



ver. 0.1.1 (2004/10/23) - beta

----------

- Add SIGTERM handler in order to exit nicely when in daemon

  mode

- Add -r option which allows to set the maximum number of

  login failures

- Remove the Metalog class as the log file are not so syslog

  daemon specific

- Rewrite log reader to be service centered. Sshd support

  added. Match "Failed password" and "Illegal user"

- Add /etc/fail2ban.conf configuration support

- Code documentation





ver. 0.1.0 (2004/10/12) - alpha

----------

- Initial release
复制代码

QUOTE:原帖由 pangty 于 2007-9-19 21:51 发表
可以试试fail2ban。fail2ban作为daemon运行监测各种服务的logfile，当在logfile中连续出现多次错误信息时，自动调用iptables规则封锁源IP。

http://fail2ban.sourceforge.net/

要先学会使用而不是重复发明 ...

很好,很强大.