1、编写脚本/root/bin/checkip.sh，每5分钟检查一次，如果发现通过ssh登录失败 次数超过10次，自动将此远程IP放入Tcp Wrapper的黑名单中予以禁止防问

#!/bin/bash
#Author:ZHS
#Email:****@163.com
#Time:2020-05-19 17:47:20
#Name:checkip.sh
#Version:V1.0
#Description:编写脚本/root/bin/checkip.sh，每5分钟检查一次，如果发现通过ssh登录失败 次数超过10次，自动将此远程IP放入Tcp Wrapper的黑名单中予以禁止防问 script.
while true;do     
   month=$(date +%b)    
   day=$(date +%-d)       
   hour=$(date +%H)       
   minute=$(date +%M)  

   awk '/sshd.*Failed password/{       
     if("'$month'" == $1 && "'$day'" == $2){ 
        split($3,array,":")         
        if("'$hour'" == array[1]){      
           if("'$minute'" - array[2] < 5){  
              ip[$(NF-3)]++;         #统计
           }
        }else{     
           if("'$minute'" + 60 - array[2] < 5){  
              ip[$(NF-3)]++;
           }
        }
     }
   }END{
     for(i in ip){
       if(ip[i]>=10){   
         system("echo sshd:"i" >> /etc/hosts.deny")
       }
     }
   }'   /var/log/secure
   
   sleep 300  

done

[root@VM_0_14_centos soft]# sh checkip.sh 
^C
[root@VM_0_14_centos soft]# cat /etc/hosts.deny 
#
# hosts.deny    This file contains access rules which are used to
#       deny connections to network services that either use
#       the tcp_wrappers library or that have been
#       started through a tcp_wrappers-enabled xinetd.
#
#       The rules in this file can also be set up in
#       /etc/hosts.allow with a 'deny' option instead.
#
#       See 'man 5 hosts_options' and 'man 5 hosts_access'
#       for information on rule syntax.
#       See 'man tcpd' for information on tcp_wrappers
#
sshd:60.173.73.10

2、配置magedu用户的sudo权限，允许magedu用户拥有root权限

echo "magedu    ALL=(root)    ALL">>/etc/sudoers