#!/bin/bash #该脚本作用是检测是否有恶意IP登陆服务器并邮件报警 #可以结合139邮箱以达到短信及时通知到手机的功能 #适用系统centos5   Ldate=`which date` Lawk=`which awk` Llast=`which last` Lgrep=`which grep` Lsendmail=`which sendmail` Lifconfig=`which ifconfig` serverip=`$Lifconfig eth0|$Lgrep inet|$Lawk -F : '{print $2}'|$Lawk '{print $1}'` cutdate=`$Ldate |$Lawk '{print $1" "$2" "$3}'`   hackerip=`$Llast|$Lgrep "$cutdate"|$Lawk '{print $3}'|$Lgrep -v 192.168.1x.xx`   if [ -z $hackerip ] then exit else   for logip in $hackerip do echo "hacker ip is  $logip already login  $serverip"|mail -s "SOS" rocdk890@139.com   done fi