/etc/profile 记录登录IP

USER_IP=`who -u am i 2>/dev/null| awk '{print $NF}'|sed -e 's/[()]//g'`

if [ "$USER_IP" = "" ]

then

USER_IP=`hostname`

fi

if [ ! -d /tmp/history ]

then

mkdir /tmp/history

chmod 777 /tmp/history

fi

if [ ! -d /tmp/history/${LOGNAME} ]

then

mkdir /tmp/history/${LOGNAME}

chmod 300 /tmp/history/${LOGNAME}

fi

if [ ! -d /tmp/history/${LOGNAME}/${USER_IP} ]

then

mkdir -p /tmp/history/${LOGNAME}/${USER_IP}

fi

export HISTSIZE=4096

DT=`date +"%Y%m%d_%H%M%S"`

export HISTFILE="/tmp/history/${LOGNAME}/${USER_IP}-history.$DT"

chmod 600 /tmp/history/${LOGNAME}/*history* 2>/dev/null

[ -f /tmp/history/${LOGNAME}/${USER_IP}-history* ] && mv /tmp/history/${LOGNAME}/${USER_IP}-history* /tmp/history/${LOGNAME}/${USER_IP}/

添加以上到/etc/profile

pkill -kill -t pts/3

cat /etc/hosts.deny

sshd:ALL

cat /etc/hosts.allow

sshd:172.x.x.:allow

sshd:10.200.:allow

非法ip通过ssh成功登录，自动结束会话

在root用户下添加编辑 ~/.bashrc

userlogin=`echo $SSH_CONNECTION | awk '{print $1}'`   #获取登录用户的ip地址
nodenyuser=192.168.10.111   #允许登录的ip地址
nodenyuser1=192.168.10.123
if [ $userlogin != $nodenyuser  ] ; then  #判断是否为禁止的ip地址
if [ $userlogin != $nodenyuser1  ] ; then
       echo "deny"
       userclient=`w | grep -v grep | grep $userlogin | awk '{print $2}'`
       echo $userclient
       ps -ef | grep $userclient | grep -v grep | grep sshd | awk '{print $2}' | xargs -I {} kill -9 {}   # 如果是禁止的ip地址直接结束会话
fi
fi