block fucking script kiddies

gistfile1.txt

for ip in `sudo cat /var/log/auth.log | grep "invalid user .* from" | sed 's/^.*invalid user \([0-9a-zA-Z_\-]\+\) from \([0-9.]\+\).*$/\1\t\2/' | cut -f2 | sort -u`; do echo iptables -A INPUT -s $ip/32 -p tcp -j REJECT; done | xargs sudo

Interesting approach. Although, what if they are just on a dsl connection like me? You block that IP permanently? Tomorrow when my router locks up and I get a new IP, someone gets assigned my old one and is blocked automatically, for doing nothing.

collateral damage ? :P

other alternaitve is to,

flush tables, read log, block ips, truncate log, sleep n minutes, repeat. you can make it more sophisticated by used memcached. but all that would be overkill.