suc2ban

#!/bin/bash
filez="/var/log/auth.log*"
for line in  \
$( (zgrep -P 'Their offer' $filez)                      |awk '{print $10}' \
|sort -n |uniq -c |sort -n |awk ' $1>=2{print $2}'      |grep -P '^(?:[0-9]{1,3}\.){3}[0-9]{1,3}'|grep -vP '^192.168.'|grep -vP '^10.')  \
\
$( (zgrep -P 'failure' $filez ) |grep -P ^rhost\=       |awk '{print $14}' \
|cut -d "=" -f 2        |sort -n |uniq -c |sort -n      |awk ' $1>=2{print $2}'\
| grep -P '^(?:[0-9]{1,3}\.){3}[0-9]{1,3}'|grep -vP '^192.168.'|grep -vP '^10.')  \
\
$( (zgrep -P 'Failed password for invalid' $filez )     |awk '{print $13}' \
|sort -n |uniq -c |sort -n  |awk ' $1>=2{print $2}'     | grep -P '^(?:[0-9]{1,3}\.){3}[0-9]{1,3}'|grep -vP '^192.168.'|grep -vP '^10.') \
\
$( (zgrep -P 'Failed password for' $filez ) |grep -v invalid \
|awk '{print $11}'  |sort -n |uniq -c |sort -n  |awk ' $1>=2{print $2}' | grep -P '^(?:[0-9]{1,3}\.){3}[0-9]{1,3}'|grep -vP '^192.168.'|grep -vP '^10.')

do
/sbin/ipset test estolista "$line"  2>/dev/null || ( echo "blokataan: " "$line" ; /sbin/ipset -A estolista "$line" ;  echo "$line" >> /root/scripts/murtautujat.txt )
done
sort -n /root/scripts/murtautujat.txt > /root/scripts/data.tmp
uniq /root/scripts/data.tmp > /root/scripts/murtautujat.txt