blockbruteforce.sh

#!/bin/bash                                   
#http://tuxopia.net/security_ssh_probe_block_script
AWK=/bin/awk                                  
SORT=/bin/sort                                
GREP=/bin/grep                                
UNIQ=/bin/uniq
SED=/bin/sed
LOGFILE=/var/log/messages
BADCOUNT="5"

$GREP 'Failed password' $LOGFILE | $AWK '{ a=NF-3; print $a}' | $UNIQ -c| $SED 's/^ *//'| $SORT -n  | while read i
do
        COUNT=`echo $i | cut -d " " -f1`
        IP=`echo $i | cut -d " " -f2`
        INLIST=`$GREP $IP /etc/hosts.deny | $GREP sshd`
        if [ -z "$INLIST" ]
        then
                if [ "$COUNT" -ge "$BADCOUNT" ]
                then
                        echo "sshd: $IP" >> /etc/hosts.deny
                fi
        fi
done