#! /bin/bash
#
IP=`echo $* | sed ’s/^.* from //’ | awk ‘{print $1}’ | sed ’s/::ffff://’`
ATTEMPTS=`grep $IP /var/log/secure | grep “Failed password for” | wc -l`
if [ $ATTEMPTS -gt 2 ]
then
route add $IP lo
MINUTES=`expr $ATTEMPTS – 2`
echo “route del $IP lo 2> /dev/null” | at now +$MINUTES minutes 2>&1 > /tmp/.bad_user.$$
(hostname ; echo $* ; echo [...]



