A simple vsftpd guard script for preventing bad guys from brute guessing your ftp account. The original version is created by @hugozhu for blocking ssh account guessing. http://hugozhu.myalert.info/2013/03/08/block_failed_ssh_attempts_with_iptable.html

guard.sh

#!/bin/bash
last_ip=""
tail -f /var/log/vsftpd.log | while read LINE; do
{
    if [[ "${LINE}" =~ "FAIL LOGIN" ]]; then            
        ip="$(echo ${LINE} | awk '{ip=$NF;gsub(/\"/,"",ip);print ip}')"
        if [[ "$last_ip" == "$ip" ]]; then
             echo "block $ip"           
             iptables -A INPUT -s "$ip" -j DROP
        fi
        last_ip=$ip
        echo $LINE
    fi
}
done

# nohup /root/bin/guard.sh > /var/log/guard.log 2>&1 &