#!/bin/bash

#auther: 51clocker
#blog: http://www.51clocker.com
#email: admin@51clocker.com
#desc: a simple script to add Failed login ip to iptables.

num=10
for i in `awk '/Failed/{print $(NF-3)}' /var/log/secure|sort|uniq -c|sort -nr|awk '{if($1>$num){print $2}}'`
do
	iptables -I INPUT -p tcp -s $i --dport 22 -j DROP
done