Block malignant SMTP authentication attempts

#!/usr/bin/perl

use strict;
use warnings;

# The syslogs of the mail transfer agent - either in /var/log/mail.info or even in the central syslog -
# often display many attempts of perpetrators trying to log in with different user / password combinations.
# To make it less apparent, the attacks are stretched over several days, with 5 minutes or more between
# successive attempts

# This script looks for log file entries that match the following pattern:

# Jul 25 13:28:57 smtp_auth: FAILED: user - password incorrect from 193.189.116.49.host.e-ring.pl [193.189.116.49]
# Jul 25 15:42:19 smtp_auth: FAILED: webmaster - password incorrect from 241.nochost.ru [80.82.65.237]

# If it finds IP addresses in this way, they will be blocked and added to a logfile with all the blocked IPs.
# (One could extend the script to check for defined exceptions or for multiple unsuccessful login attempts
# in a short time interval in order to allow for some *own* unsuccessful login attempts due to mistyping!)

# When scheduling it as a cron job, you have to redirect >/dev/null, as the script writes informations to stdout

# On my server, I found thousands of unsuccessful login attempts
# from the following IPs in the last days (starting July 22,2015):
#
#80.82.65.237
#185.40.4.31
#123.56.2.249
#181.65.181.84
#189.222.182.223
#213.4.81.84
#222.124.200.250
#59.38.97.123
#61.224.50.139
#193.189.116.49
#185.40.4.30

my $PATH_TO_BLOCKED_IP_FILE = "....";

my $xip = get_unauth_ip( );
print("unauthorized :\n");
do_print( $xip );
my $yip = read_already_blocked( );
print("already blocked:\n");
do_print( $yip );
remove_already_blocked( $xip, $yip );
print("rest :\n");
do_print( $xip );
my $new_ips = [ keys %$xip ];
if (scalar(@$new_ips) > 0) {
  do_block( $new_ips );
  add_ips_to_file( $new_ips );
}

sub get_unauth_ip {
  my %ip = ();
  open (my $log, "</var/log/mail.info" ) or die "Can't open /var/log/mail.info";
# Jul 25 13:28:57 lvps46-163-114-146 smtp_auth: FAILED: user - password incorrect from 193.189.116.49.host.e-ring.pl [193.189.116.49]
  foreach (<$log>) {
    $ip{$2} = 1 if /FAILED:\s*([@.\w]+)\s*\-\s*password incorrect.*\[([\d.]+)\]/;
  }
  return \%ip;
}

sub do_print {
  my $ip = shift;
  foreach (sort keys %$ip) {
    print "$_\n";
   }
}

sub read_already_blocked {
  my %ip = ();
  open IP_BLOCKED, "<$PATH_TO_BLOCKED_IP_FILE" or die "Can't open logfile for blocked IP's: $!\n";
  foreach (<IP_BLOCKED>) {
    $ip{$1} = 1 if /(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/;
  }
  close IP_BLOCKED;
  return \%ip;
}

sub do_block {
  my $ips = shift;
  foreach my $ip (@$ips) {
    `/sbin/iptables -A INPUT -s $ip -j DROP`;
    `/sbin/iptables -A OUTPUT -d $ip -j DROP`;
  }

}

sub remove_already_blocked {
  my ($xip,$yip) = @_;
  foreach my $ip (keys %$yip) {
    delete $xip->{$ip} if exists $xip->{$ip};
    }
}

sub add_ips_to_file {
  my $ips = shift;
  open IP_BLOCKED, ">>$PATH_TO_BLOCKED_IP_FILE" or die "Can't open ip.blocked: $!\n";
  foreach my $ip (@$ips) {
    print IP_BLOCKED "#$ip\n";
    }
  close IP_BLOCKED;
}