Linux退出时限制ip登陆脚本

在生产环境中,有可能会出现被其他管理员或使用者修改hosts.allow允许更多的ip登陆机器;为了方便统一管理,我们可以在用户退出的时候统一修改allow和deny文件成默认设置。同时也能自动获取机器所配ip的整个ip段为允许登陆

test -f /root/.bash_logout && chattr -i /root/.bash_logout
cat >/root/.bash_logout <<EOF
export TERM=xterm
/usr/bin/chattr -i /etc/hosts.allow /etc/hosts.deny

#for hosts.deny
/bin/awk 'BEGIN{FS="[=.]";RS="\n"};/^IPADDR/{print "sshd:all EXCEPT "\$2"."\$3"."\$4".0/255.255.255.0"}' /etc/sysconfig/network-scripts/ifcfg-* | grep -v 127.0.0 | uniq 1>/etc/hosts.deny

/bin/cat >>/etc/hosts.deny << iEOF
sshd:all EXCEPT ip
iEOF

#for hosts.allow
/bin/awk 'BEGIN{FS="[=.]";RS="\n"};/^IPADDR/{print "sshd:"\$2"."\$3"."\$4".0/255.255.255.0"}' /etc/sysconfig/network-scripts/ifcfg-* | grep -v 127.0.0 | uniq 1>/etc/hosts.allow

/bin/cat >>/etc/hosts.allow << iEOF
sshd:ip
iEOF
/usr/bin/chattr +i /etc/hosts.allow /etc/hosts.deny

clear
EOF

sh /root/.bash_logout 2>&1 >/dev/null

weinxin
聂扬帆博客
一个分享IT运维相关工作经验和实战技巧的个人博客

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: