#!/bin/sh
SCANIP=`grep "Failed" /var/log/secure | awk '{print $(NF-3)}' | sort | uniq -c | awk '{print $1"="$2;}'`
for i in $SCANIP
do
    NUMBER=`echo $i | awk -F= '{print $1}'`
    SCANIP=`echo $i | awk -F= '{print $2}'`
    echo "$SCANIP:$NUMBER"
    if [ $NUMBER -gt 10 ]
    then
        grep $SCANIP /etc/hosts.deny >/dev/null 2>&1 || echo "sshd:$SCANIP" >> /etc/hosts.deny
    echo "`date` $SCANIP $NUMBER" >> /var/log/scanip.log
    fi
done