#!/bin/sh
# Desenvolvido por Jos� Roberto da Silva
# Testado no slackware 9 e 10.
#
####

tempip="/etc/rc.d/scripts/temp/blocked-ips.tmp";
blockip="/etc/rc.d/scripts/temp/blocked-ips";
script="/etc/rc.d/scripts/temp/fir_blocked";

# take all the IP that tried to bruteforce the users: guest/teste/admin (edit for your needs)

cat -n /var/log/messages | grep -P "(guest|test|admin|user)" | grep -i sshd | awk -F" " '{ print $11}' > $tempip;

# make a backupfaz of the blocked ips
if [ -f $blockip ]; then
� cat $blockip >> $tempip;� � � � � �
fi

# remove double ips
sort -u $tempip | grep -v ^$ | grep -v user > $blockip;

# generates a script that blocks the IP trhough iptables
ips=$(cat $blockip);
echo "iptables -F INPUT" > $script;
for ip in $ips; do
 blocked=("iptables -A INPUT -s $ip -j DROP")
 echo $blocked >> $script
done
chmod +x $script
$script