Grep TarSSH log for ips and add to fail2ban list

banips.sh

#!/bin/bash

set -euo pipefail


if [ "$EUID" -ne 0 ]
  then echo "Please run as root"
  exit
fi


log_file="/tmp/tarssh.log"

# Use grep with regular expression to extract IP addresses
ip_addresses=$(grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}" "$log_file")

# Use sort and uniq to get unique IP addresses
unique_ip_addresses=$(echo "$ip_addresses" | sort | uniq)

# Print the unique IP addresses
echo "$unique_ip_addresses"


# Loop through each unique IP address
for ip_address in $unique_ip_addresses; do
    # Check if the IP address is already in the fail2ban ban list
    status=$(fail2ban-client status sshd | grep -c $ip_address)

    # If IP address is not in the ban list, add it to fail2ban
    if [[ $status -eq 0 ]]; then
        echo "Adding $ip_address to fail2ban"
        fail2ban-client set sshd banip $ip_address
    else
        echo "$ip_address is already banned in fail2ban"
    fi
done