#!/bin/bash

deny='/etc/hosts.deny'
tmpfil='/tmp/fail.txt'

isdup() {
   while read ln
   do
      if echo "$ln" | grep "$1"
      then
        return 0
      fi
   done < "$deny"
   return 1
}

while true
do
   if tail /var/log/auth.log | grep failures | tee "$tmpfil"
   then
     ip=$(cat "$tmpfil" | cut -d ' ' -f 17 | grep 'rhost=' | sed s/rhost=//g)
     if isdup "$ip"
     then
            echo "ring polisen banditer på $ip som redan borde vara blockerad"
     else
            echo "ring polisen banditer på $ip"
	    echo "ALL: $ip" >> "$deny"
     fi
   fi
   sleep 2m
done