{"id":96,"date":"2007-08-10T01:24:51","date_gmt":"2007-08-10T01:24:51","guid":{"rendered":"http:\/\/apollo89.com\/wordpress\/?p=96"},"modified":"2013-02-16T16:18:12","modified_gmt":"2013-02-16T07:18:12","slug":"ssh-%eb%ac%b4%ec%9e%91%ec%9c%84-%eb%a1%9c%ea%b7%b8%ec%9d%b8-scan%ec%8b%9c%eb%8f%84-%ec%b0%a8%eb%8b%a8-%ec%8a%a4%ed%81%ac%eb%a6%bd%ed%8a%b8","status":"publish","type":"post","link":"https:\/\/apollo89.com\/wordpress\/?p=96","title":{"rendered":"SSH \ubb34\uc791\uc704 \ub85c\uadf8\uc778 scan\uc2dc\ub3c4 \ucc28\ub2e8 \uc2a4\ud06c\ub9bd\ud2b8"},"content":{"rendered":"

 <\/p>\n

\uc9c0\uaca8\uc6b4\ub188\ub4e4.. \uacc4\uc18d \uacf5\uaca9 \uc2dc\ub3c4\uc911…<\/p>\n

\uacbd\ub85c \uc704\uce58\ub294 \/usr\/local\/service\/<\/p>\n

]# vi denyip.sh\r\n#!\/bin\/bash\r\n# Script by Yunkiman\r\n# Modified by icworld\r\n# Second Modified by dksniper(http:\/\/blog.naver.com\/dksniper)\r\n# Convert oops-firewall to hosts.deny\r\ndays=`date +%d`\r\nnowdir=`pwd`\r\nsavedir=\"$nowdir\/denylist\"\r\ncleanfile=\"$nowdir\/hosts.dat\"\r\ncnt=0\r\nif [ -e \/var\/log\/secure ]\r\nthen\r\n        for i in $( tail -n50 \/var\/log\/secure | grep \"^[A-Za-z ]\\{4,\\}$days\" | grep \"Failed password\" | awk -F \"from\" '{print $2}' | awk '{prin\r\nt $1}' | sort | uniq -c | awk '$1 > 8 {print $2}'); do\r\n                denyip=${i#::ffff:}  #ip format ::ffff:0.0.0.0\r\n                echo \"ALL : $denyip\" >> $savedir\r\n                cnt=$(($cnt+1))\r\n        done\r\nfi\r\n#If not found then exit\r\nif [ $cnt = 0 ]\r\nthen\r\n        exit\r\nfi\r\nfor a in $( cat \/etc\/hosts.deny | grep \"ALL : \" | awk '{print $3}' | sort | uniq -c | awk '{print $2}'); do\r\necho \"ALL : $a\" >> $savedir\r\ndone\r\n#cp $cleanfile \/etc\/hosts.deny\r\necho \"#\r\n# hosts.deny    This file describes the names of the hosts which are\r\n#               *not* allowed to use the local INET services, as decided\r\n#               by the '\/usr\/sbin\/tcpd' server.\r\n#\r\n# The portmap line is redundant, but it is left to remind you that\r\n# the new secure portmap uses hosts.deny and hosts.allow.  In particular\r\n# you should know that NFS uses portmap!\r\n\" > \/etc\/hosts.deny\r\n \r\nfor b in $( cat $savedir | grep \"ALL : \" | awk '{print $3}' | sort | uniq -c | awk '{print $2}'); do\r\necho \"ALL : $b\" >> \/etc\/hosts.deny\r\ndone\r\nrm -rf $savedir\r\n\/etc\/init.d\/xinetd reload<\/pre>\n
\uc704\uc758 \ud30c\uc77c\uc744 \uc2a4\ud06c\ub9bd\ud2b8\ub97c \uc2e4\ud589\ud560 \ub514\ub809\ud1a0\ub9ac(\uc800\uc758 \uacbd\uc6b0\ub294 \/usr\/local\/service\/)\uc5d0 \ub9cc\ub4e4\uc5b4 \ub123\uc740 \ud6c4
\ncrontab\uc5d0 \ub2e4\uc74c\uacfc \uac19\uc774 \ub4f1\ub85d.<\/p>\n
1-60\/5 * * * * \/usr\/local\/service\/denyip.sh > \/dev\/null 2>&1<\/pre>\n
\uc774\ub807\uac8c \ud558\uba74 5\ubd84\ub9c8\ub2e4 \ud55c\ubc88\uc529 \uac80\uc0ac\ud558\uc5ec  5\ubc88\uc774\uc0c1 \ud2c0\ub9b0\uc0ac\ub78c\uc740 \uac70\ubd80\ub97c \ud558\uac8c\ud568.<\/p>\n
\ucc38\uace0 :
\nhttp:\/\/www.oops.org\/SERVICE\/jsboard\/read.php?table=jsboard_oopsFAQ&no=426&page=2<\/a>
\nhttp:\/\/www.oops.org\/SERVICE\/jsboard\/read.php?table=jsboard_oopsFAQ&no=503&page=2<\/a><\/p>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
  \uc9c0\uaca8\uc6b4\ub188\ub4e4.. \uacc4\uc18d \uacf5\uaca9 \uc2dc\ub3c4\uc911… \uacbd\ub85c \uc704\uce58\ub294 \/usr\/local\/service\/ ]# vi denyip.sh #!\/bin\/bash # Script by Yunkiman # Modified by icworld # Second Modified by dksniper(http:\/\/blog.naver.com\/dksniper) # Convert oops-firewall to hosts.deny days=`date +%d` nowdir=`pwd` savedir=”$nowdir\/denylist” cleanfile=”$nowdir\/hosts.dat” cnt=0 if [ -e \/var\/log\/secure … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[703,661],"tags":[1031,191],"class_list":["post-96","post","type-post","status-publish","format-standard","hentry","category-securityhacking","category-system","tag-scan","tag-ssh"],"yoast_head":"\nSSH \ubb34\uc791\uc704 \ub85c\uadf8\uc778 scan\uc2dc\ub3c4 \ucc28\ub2e8 \uc2a4\ud06c\ub9bd\ud2b8 - Apollo89.com<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/apollo89.com\/wordpress\/?p=96\" \/>\n<meta property=\"og:locale\" content=\"ko_KR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SSH \ubb34\uc791\uc704 \ub85c\uadf8\uc778 scan\uc2dc\ub3c4 \ucc28\ub2e8 \uc2a4\ud06c\ub9bd\ud2b8 - Apollo89.com\" \/>\n<meta property=\"og:description\" content=\"  \uc9c0\uaca8\uc6b4\ub188\ub4e4.. \uacc4\uc18d \uacf5\uaca9 \uc2dc\ub3c4\uc911… \uacbd\ub85c \uc704\uce58\ub294 \/usr\/local\/service\/ ]# vi denyip.sh #!\/bin\/bash # Script by Yunkiman # Modified by icworld # Second Modified by dksniper(http:\/\/blog.naver.com\/dksniper) # Convert oops-firewall to hosts.deny days=`date +%d` nowdir=`pwd` savedir="$nowdir\/denylist" cleanfile="$nowdir\/hosts.dat" cnt=0 if [ -e \/var\/log\/secure … Continue reading →\" \/>\n<meta property=\"og:url\" content=\"https:\/\/apollo89.com\/wordpress\/?p=96\" \/>\n<meta property=\"og:site_name\" content=\"Apollo89.com\" \/>\n<meta property=\"article:published_time\" content=\"2007-08-10T01:24:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2013-02-16T07:18:12+00:00\" \/>\n<meta name=\"author\" content=\"apollo89\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\uae00\uc4f4\uc774\" \/>\n\t<meta name=\"twitter:data1\" content=\"apollo89\" \/>\n\t<meta name=\"twitter:label2\" content=\"\uc608\uc0c1 \ub418\ub294 \ud310\ub3c5 \uc2dc\uac04\" \/>\n\t<meta name=\"twitter:data2\" content=\"1\ubd84\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/?p=96#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/?p=96\"},\"author\":{\"name\":\"apollo89\",\"@id\":\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/#\\\/schema\\\/person\\\/93f56825cac3b2f18e5f107995066c82\"},\"headline\":\"SSH \ubb34\uc791\uc704 \ub85c\uadf8\uc778 scan\uc2dc\ub3c4 \ucc28\ub2e8 \uc2a4\ud06c\ub9bd\ud2b8\",\"datePublished\":\"2007-08-10T01:24:51+00:00\",\"dateModified\":\"2013-02-16T07:18:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/?p=96\"},\"wordCount\":37,\"commentCount\":0,\"keywords\":[\"scan\",\"ssh\"],\"articleSection\":[\"Security\\\/Hacking\",\"System\"],\"inLanguage\":\"ko-KR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/?p=96#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/?p=96\",\"url\":\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/?p=96\",\"name\":\"SSH \ubb34\uc791\uc704 \ub85c\uadf8\uc778 scan\uc2dc\ub3c4 \ucc28\ub2e8 \uc2a4\ud06c\ub9bd\ud2b8 - Apollo89.com\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/#website\"},\"datePublished\":\"2007-08-10T01:24:51+00:00\",\"dateModified\":\"2013-02-16T07:18:12+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/#\\\/schema\\\/person\\\/93f56825cac3b2f18e5f107995066c82\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/?p=96#breadcrumb\"},\"inLanguage\":\"ko-KR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/?p=96\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/?p=96#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\ud648\",\"item\":\"https:\\\/\\\/apollo89.com\\\/wordpress\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SSH \ubb34\uc791\uc704 \ub85c\uadf8\uc778 scan\uc2dc\ub3c4 \ucc28\ub2e8 \uc2a4\ud06c\ub9bd\ud2b8\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/#website\",\"url\":\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/\",\"name\":\"Apollo89.com\",\"description\":\"\uc544\ud3f4\ub85c\uc528\uc758 \uc7a1\ub2e4\ud55c \uacbd\ud5d8\ub4e4..\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"ko-KR\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/#\\\/schema\\\/person\\\/93f56825cac3b2f18e5f107995066c82\",\"name\":\"apollo89\",\"description\":\"\uc544\ud3f4\ub85c89 \uc785\ub2c8\ub2e4.\",\"url\":\"https:\\\/\\\/apollo89.com\\\/wordpress\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SSH \ubb34\uc791\uc704 \ub85c\uadf8\uc778 scan\uc2dc\ub3c4 \ucc28\ub2e8 \uc2a4\ud06c\ub9bd\ud2b8 - Apollo89.com","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/apollo89.com\/wordpress\/?p=96","og_locale":"ko_KR","og_type":"article","og_title":"SSH \ubb34\uc791\uc704 \ub85c\uadf8\uc778 scan\uc2dc\ub3c4 \ucc28\ub2e8 \uc2a4\ud06c\ub9bd\ud2b8 - Apollo89.com","og_description":"  \uc9c0\uaca8\uc6b4\ub188\ub4e4.. \uacc4\uc18d \uacf5\uaca9 \uc2dc\ub3c4\uc911… \uacbd\ub85c \uc704\uce58\ub294 \/usr\/local\/service\/ ]# vi denyip.sh #!\/bin\/bash # Script by Yunkiman # Modified by icworld # Second Modified by dksniper(http:\/\/blog.naver.com\/dksniper) # Convert oops-firewall to hosts.deny days=`date +%d` nowdir=`pwd` savedir=\"$nowdir\/denylist\" cleanfile=\"$nowdir\/hosts.dat\" cnt=0 if [ -e \/var\/log\/secure … Continue reading →","og_url":"https:\/\/apollo89.com\/wordpress\/?p=96","og_site_name":"Apollo89.com","article_published_time":"2007-08-10T01:24:51+00:00","article_modified_time":"2013-02-16T07:18:12+00:00","author":"apollo89","twitter_card":"summary_large_image","twitter_misc":{"\uae00\uc4f4\uc774":"apollo89","\uc608\uc0c1 \ub418\ub294 \ud310\ub3c5 \uc2dc\uac04":"1\ubd84"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/apollo89.com\/wordpress\/?p=96#article","isPartOf":{"@id":"https:\/\/apollo89.com\/wordpress\/?p=96"},"author":{"name":"apollo89","@id":"https:\/\/apollo89.com\/wordpress\/#\/schema\/person\/93f56825cac3b2f18e5f107995066c82"},"headline":"SSH \ubb34\uc791\uc704 \ub85c\uadf8\uc778 scan\uc2dc\ub3c4 \ucc28\ub2e8 \uc2a4\ud06c\ub9bd\ud2b8","datePublished":"2007-08-10T01:24:51+00:00","dateModified":"2013-02-16T07:18:12+00:00","mainEntityOfPage":{"@id":"https:\/\/apollo89.com\/wordpress\/?p=96"},"wordCount":37,"commentCount":0,"keywords":["scan","ssh"],"articleSection":["Security\/Hacking","System"],"inLanguage":"ko-KR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/apollo89.com\/wordpress\/?p=96#respond"]}]},{"@type":"WebPage","@id":"https:\/\/apollo89.com\/wordpress\/?p=96","url":"https:\/\/apollo89.com\/wordpress\/?p=96","name":"SSH \ubb34\uc791\uc704 \ub85c\uadf8\uc778 scan\uc2dc\ub3c4 \ucc28\ub2e8 \uc2a4\ud06c\ub9bd\ud2b8 - Apollo89.com","isPartOf":{"@id":"https:\/\/apollo89.com\/wordpress\/#website"},"datePublished":"2007-08-10T01:24:51+00:00","dateModified":"2013-02-16T07:18:12+00:00","author":{"@id":"https:\/\/apollo89.com\/wordpress\/#\/schema\/person\/93f56825cac3b2f18e5f107995066c82"},"breadcrumb":{"@id":"https:\/\/apollo89.com\/wordpress\/?p=96#breadcrumb"},"inLanguage":"ko-KR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/apollo89.com\/wordpress\/?p=96"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/apollo89.com\/wordpress\/?p=96#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\ud648","item":"https:\/\/apollo89.com\/wordpress"},{"@type":"ListItem","position":2,"name":"SSH \ubb34\uc791\uc704 \ub85c\uadf8\uc778 scan\uc2dc\ub3c4 \ucc28\ub2e8 \uc2a4\ud06c\ub9bd\ud2b8"}]},{"@type":"WebSite","@id":"https:\/\/apollo89.com\/wordpress\/#website","url":"https:\/\/apollo89.com\/wordpress\/","name":"Apollo89.com","description":"\uc544\ud3f4\ub85c\uc528\uc758 \uc7a1\ub2e4\ud55c \uacbd\ud5d8\ub4e4..","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/apollo89.com\/wordpress\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ko-KR"},{"@type":"Person","@id":"https:\/\/apollo89.com\/wordpress\/#\/schema\/person\/93f56825cac3b2f18e5f107995066c82","name":"apollo89","description":"\uc544\ud3f4\ub85c89 \uc785\ub2c8\ub2e4.","url":"https:\/\/apollo89.com\/wordpress\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/apollo89.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/96","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/apollo89.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/apollo89.com\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/apollo89.com\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/apollo89.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=96"}],"version-history":[{"count":0,"href":"https:\/\/apollo89.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/96\/revisions"}],"wp:attachment":[{"href":"https:\/\/apollo89.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=96"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/apollo89.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=96"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/apollo89.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=96"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}