1、编写脚本/root/bin/checkip.sh，每5分钟检查一次，如果发现通过ssh登录失败 次数超过10次，自动将此远程IP放入Tcp Wrapper的黑名单中予以禁止防问
[root@laowei03 ~]#vim /bin/checkip.sh
#!/bin/bash
lastb | awk '/ssh/{print $3}'| sort | uniq -c | sort -nr > /data/TCP_Wrappers.txt
while read count ip;do
if [ $count -gt 10 ];then
echo "sshd:$ip:deny" > /etc/hosts.allow
fi
done < /data/TCP_Wrappers.txt
[root@laowei03 ~]#crontab -e
*/5 * * * * /bin/bash /bin/checkip.sh
#用两个客户端分别向13主机发起多次ssh失败连接，如下
[root@laowei03 ~]#lastb
root ssh:notty 192.168.7.12 Fri Apr 24 17:18 - 17:18 (00:00)
root ssh:notty 192.168.7.12 Fri Apr 24 17:17 - 17:17 (00:00)
root ssh:notty 192.168.7.12 Fri Apr 24 17:13 - 17:13 (00:00)
root ssh:notty 192.168.7.11 Fri Apr 24 17:13 - 17:13 (00:00)
root ssh:notty 192.168.7.12 Fri Apr 24 17:13 - 17:13 (00:00)
root ssh:notty 192.168.7.12 Fri Apr 24 17:13 - 17:13 (00:00)
root ssh:notty 192.168.7.12 Fri Apr 24 17:13 - 17:13 (00:00)
root ssh:notty 192.168.7.12 Fri Apr 24 17:13 - 17:13 (00:00)
root ssh:notty 192.168.7.12 Fri Apr 24 17:13 - 17:13 (00:00)
root ssh:notty 192.168.7.12 Fri Apr 24 17:13 - 17:13 (00:00)
root ssh:notty 192.168.7.12 Fri Apr 24 17:13 - 17:13 (00:00)
root ssh:notty 192.168.7.11 Fri Apr 24 17:13 - 17:13 (00:00)
root ssh:notty 192.168.7.11 Fri Apr 24 17:13 - 17:13 (00:00)
root ssh:notty 192.168.7.11 Fri Apr 24 17:13 - 17:13 (00:00)
#当定时任务执行后，再用12尝试ssh连接13主机
[root@laowei02 ~]#ssh 192.168.7.13
ssh_exchange_identification: read: Connection reset by peer
可以看出已经被拒绝，无法连接
2、配置magedu用户的sudo权限，允许magedu用户拥有root权限
[root@laowei03 ~]#touch f1.txt
[root@laowei03 ~]#ll f1.txt
-rw-r--r-- 1 root root 0 Apr 24 16:29 f1.txt
#切换到magedu用户，尝试查看文件目录
[magedu@laowei03 ~]$ll /root/
ls: cannot open directory /root/: Permission denied
显示权限被拒绝
#然后添加magedu权限
[root@laowei03 etc]#visudo -f sudoers
magedu ALL=(root) ALL
#检查配置是否成功
[root@laowei03 etc]#visudo -c
/etc/sudoers: parsed OK
#切换到magedu用户，再次访问并用root账号验证
[magedu@laowei03 ~]$sudo vim /root/f1.txt
[sudo] password for magedu:
[root@laowei03 ~]#ll f1.txt
-rw-r--r-- 1 root root 7 Apr 24 16:57 f1.txt
[root@laowei03 ~]#cat f1.txt
hehehe
可以看到f1.txt成功添加了文本，证实magedu获得了root权限
