confluence login attacker block

confluence-login-attacker-block.sh

#!/bin/bash

## login.action 을 호출한 IP 중에 차단 제외 ip
MYIP=180.68.199.167

## apache httpd 일 경우 변경 필요
BLACKLIST=$(grep -h login.action /var/log/nginx/*.access.log |awk '{print $1}'|grep -v ${MYIP} |sort |uniq)

## firewall zone
ZONE=dmz

for ip in ${BLACKLIST}; do
    CMD="firewall-cmd --zone=${ZONE} --add-rich-rule='rule family=\"ipv4\" source address=\"${ip}\" drop'"
    echo "${CMD}  --permanent" | bash -x

    echo ""
    RELOAD="firewall-cmd --reload"
    echo "${RELOAD}" | bash -x
done