SSH-Failed

ssh-failed.sh

#!/bin/sh  
SCANIP=`grep "Failed" /var/log/secure | awk '{print $(NF-3)}' | sort | uniq -c | awk '{print $1"="$2;}'`  
for i in $SCANIP  
do 
    NUMBER=`echo $i | awk -F= '{print $1}'`  
    SCANIP=`echo $i | awk -F= '{print $2}'`  
    echo "$SCANIP:$NUMBER" 
    if [ $NUMBER -gt 10 ]  
    then 
        grep $SCANIP /etc/hosts.deny >/dev/null 2>&1 || echo "sshd:$SCANIP" >> /etc/hosts.deny
    echo "`date` $SCANIP $NUMBER" >> /var/log/scanip.log  
    fi 
done