#!/bin/sh# Little script to block IP addresses doing ssh brute force dictionary attacks# Launch from /etc/rc.local: /usr/local/sbin/ssh-ids.sh </dev/null >/dev/null 2>&1 &LOGGER=/usr/bin/loggerIPTABLES=/sbin/iptablesTAIL=/usr/bin/tailEGREP=/bin/egrepAWK=/usr/bin/awk# Do not block these (space separated):NOBLOCK='127.0.0.1'drop(){ for ipaddr in $NOBLOCK; do if [ "$ipaddr" = "$1" ]; then return fi done $LOGGER -i -t ssh-ids.sh -p auth.notice "Dropping $1" $IPTABLES -D INPUT -s $1 -j DROP >/dev/null 2>&1 $IPTABLES -A INPUT -s $1 -j DROP >/dev/null 2>&1}# Since awk(1) can't use line-buffering we have to invoke it for each entry$TAIL -F /var/log/auth.log | $EGREP --line-buffered 'Invalid\ user|Did\ not\ receive\ identification\ string\ from' | ( while read l; do drop $(echo "$l" | $AWK '{print $NF}') done)