Block SSH Brute Force Attacks

#!/bin/bash

# Dont block Portuguese IPs
DNP='netvisao|netcabo|optimus|novis|telepac|vodafone|tvtel'

# Number of failed SSH log-in attempts
aTaks=40

BLKlist=/etc/network/blacklist.ips
IPrules=/etc/network/iptables.rules
LOGauth=/var/log/auth.log

# List of failed SSH log-in attempts
logFAIL=`grep "unix.sshd:auth.*fail" $LOGauth`


while read badIP; do

    grep -q "$badIP" $BLKlist && continue

    failN=$(echo "$logFAIL" | grep -c "$badIP")

    ((failN<aTaks)) && echo "$failN  $badIP" && continue

    DNpointer=$(host "$badIP" | sed -n 's/.*domain name pointer //p' | sed 's/\.$//')

    echo "$DNpointer" | egrep "($DNP).pt" && continue

    echo "$failN  $badIP  $DNpointer" | tee -a $BLKlist

    iptables -A INPUT -s $badIP -j DROP

    iptables-save > $IPrules

done < <(echo "$logFAIL" | sed 's/.* rhost=// ; s/ .*//' | awk '!x[$0]++')


# /etc/network/interfaces
# pre-up iptables-restore < /etc/network/iptables.rules
# post-down iptables-save > /etc/network/iptables.rules

# CHECK FOR DROPPED PACKETS
# iptables -L -vn