(1) 借助iptables的recent模块限制IP连接数
可以限制瞬间连接数过大的恶意IP（比如web应用防护，但不适用于LVS+Keepalived集群环境）
防护指令如下
# 允许一个客户端60秒内可以发起20个对web服务器的连接
iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m recent --name web --set
# iptables默认将日志输出到/var/log/messages
iptables -A INPUT -m recent --update --name web --seconds 60 --hitcount 20 -j LOG --log-prefix 'HTTP attack: '
iptables -A INPUT -m recent --update --name web --seconds 60 --hitcount 20 -j DROP
效率的产生是因为netfilter在网络应用的低层级上就实现了封堵，调用资源少。这如同硬件防火墙在转发面就实现封堵，而不会上升到控制面。
(2) 防SSH暴力破解
使用工具DenyHosts，原理为：
python2写成，分析/var/log/secure日志文件，当发现同一IP在进行多次SSH登陆尝试时，就会将IP记录到tcpwrappers配置文件/etc/hosts.deny中。
- 环境确认
ldd /sbin/sshd | grep libwrap
回显
libwrap.so.0 => /lib64/libwrap.so.0 (0x00007f2844d53000)
说明你所使用的sshd支持TCP Wrappers。
python -V 查看版本是不是2.x.x
可以用如下命令统计一下可疑IPv4地址的数量
cat /var/log/secure | grep -o '[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}' | uniq -c
可以结合iptables再限制：
#每分钟对ssh的新连接只允许两个，已建立的连接不限制
iptables -P INPUT DROP
iptables -A INPUT -m state –state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp –dport 22 -m limit –limit 2/minute –limit-burst 2 -m state –state NEW -j ACCEPT
- 安装
方式一：
# Debian/Ubuntu
$ sudo apt-get install denyhosts
# RedHat/CentOS
$ yum update
$ yum install denyhosts
或者
$ wget http://ftp.tu-chemnitz.de/pub/linux/dag/redhat/el7/en/x86_64/rpmforge/RPMS/rpmforge-release-0.5.3-1.el7.rf.x86_64.rpm
$ rpm -Uvh rpmforge-release*rpm
$ yum install denyhosts
$ systemctl status denyhosts
或者
$ service denyhosts status
$ chkconfig denyhosts on
# Archlinux
$ yaourt denyhosts
# Gentoo
$ emerge -av denyhosts
//白名单配置
$ vim /etc/hosts.allow
//添加你的IP到白名单
$ sshd: Your_IP
//黑名单配置
$ vim /etc/hosts.deny
//如果要禁止所有连接，那就
$ sshd: ALL **
//查看denyhosts收集到的恶意ip
$ cat /etc/hosts.deny
denyhosts配置详解
配置文件/etc/denyhosts.conf
或者
/etc/denyhosts/denyhosts.cfg
具体可以使用如下命令查看：
rpm -ql denyhosts
PURGE_DENY: removed HOSTS_DENY entries that are older than this time
when DenyHosts is invoked with the --purge flag
format is: i[dhwmy]
Where 'i' is an integer (eg. 7)
'm' = minutes
'h' = hours
'd' = days
'w' = weeks
'y' = years
# yum install denyhosts -y
# cp denyhosts.cfg denyhosts.cfg.bak
# vim denyhosts.cfg
############ THESE SETTINGS ARE REQUIRED ############
SECURE_LOG = /var/log/secure #sshd的登陆日志文件
HOSTS_DENY = /etc/hosts.deny #将需要阻止的IP写入到hosts.deny,所以这个工具只支持调用TCP Wrapper的协议
PURGE_DENY = 1h #过多久后清除已阻止的IP,即阻断恶意IP的时长（1小时）
BLOCK_SERVICE = sshd #作用的服务名
DENY_THRESHOLD_INVALID = 1 #允许无效用户（不在/etc/passwd中）登录失败的次数
DENY_THRESHOLD_VALID = 5 #允许普通有效用户登录失败的次数
DENY_THRESHOLD_ROOT = 3 #允许root登录失败的次数
DENY_THRESHOLD_RESTRICTED = 1 #设定 deny host 写入到该文件夹
WORK_DIR = /var/lib/denyhosts #将deny的host或ip记录到work_dir中
SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES
HOSTNAME_LOOKUP=NO #是否做域名反解
LOCK_FILE = /var/lock/subsys/denyhosts #将DenyHost启动的pid记录到LOCK_FILE中，已确保服务正确启动，防止同时启动多个服务
############ THESE SETTINGS ARE OPTIONAL ############
ADMIN_EMAIL = wawa@163.com #设置管理员邮件地址
SMTP_HOST = localhost
SMTP_PORT = 25
SMTP_FROM = DenyHosts <nobody@localhost>
SMTP_SUBJECT = DenyHosts Report from $[HOSTNAME]
AGE_RESET_VALID=5d
AGE_RESET_ROOT=25d
AGE_RESET_RESTRICTED=25d
AGE_RESET_INVALID=10d
######### THESE SETTINGS ARE SPECIFIC TO DAEMON MODE ##########
DAEMON_LOG = /var/log/denyhosts #denyhost服务日志文件
DAEMON_SLEEP = 30s
DAEMON_PURGE = 1h #该项与PURGE_DENY 设置成一样，也是清除hosts.deniedssh 用户的时间
方式二：
cd /usr/local/src
tar zxvf DenyHosts-2.6.tar.gz
cd DenyHosts-2.6
python setup.py install
程序脚本自动安装到/usr/share/denyhosts
库文件安装到/usr/lib/python2.3/site-packages/DenyHosts
denyhosts.py 自动安装到/usr/bin
设置启动脚本
cd /usr/share/denyhosts
cp daemon-control-dist daemon-control
chown root daemon-control
chmod 700 daemon-control
grep -v "^#" denyhosts.cfg-dist > denyhosts.cfg
echo "/usr/share/denyhosts/daemon-control start" >> /etc/rc.local
cd ln -s /usr/share/denyhosts/daemon-control denyhosts
chkconfig --add denyhosts
chkconfig --level 35 denyhosts on
service denyhosts start
注意CentOS7的开启
/etc/rc.local -> rc.d/rc.local
#!/bin/bash
# THIS FILE IS ADDED FOR COMPATIBILITY PURPOSES
#
# It is highly advisable to create own systemd services or udev rules
# to run scripts during boot instead of using this file.
#
# In contrast to previous versions due to parallel execution during boot
# this script will NOT be run after all other services.
#
# Please note that you must run 'chmod +x /etc/rc.d/rc.local' to ensure
# that this script will be executed during boot.
touch /var/lock/subsys/local
/usr/share/denyhosts/daemon-control start
在登陆过程中如果出现如下信息，表示/etc/hosts.deny已经生效：
Permission denied (publickey,gssapi-with-mic,password)
或者
ssh_exchange_identification: read: Connection reset
查看/etc/hosts.deny，发现有
sshd: 192.168.30.1
(3) 作为应用程序执行者的用户
一定要将其Shell设定为 nologin
(4) 查看登陆记录
命令：last
涉及的log文件 /var/log/wtmp
chmod 640 /var/log/wtmp
(5) 不定期检查硬件损害情况
grep error /var/log/messages
(6) 使用chkrootkit检查rootkit
chkrootkit -n| grep 'INFECTED'
或者使用脚本加入cron
# cat chkrootkit.sh
#!/bin/bash
PATH=/usr/bin:/bin
TMPLOG=`mktemp`
# Run the chkrootkit
/usr/bin/chkrootkit > $TMPLOG
# Output the log
cat $TMPLOG | logger -t chkrootkit
# bindshe of SMTPSllHow to do some wrongs
if [ ! -z "$(grep 465 $TMPLOG)" ] &&
[ -z $(/usr/sbin/lsof -i:465|grep bindshell) ]; then
sed -i '/465/d' $TMPLOG
fi
# If the rootkit have been found,mail root
[ ! -z "$(grep INFECTED $TMPLOG)" ] &&
grep INFECTED $TMPLOG | mail -s "chkrootkit report in `hostname`" root