Python 3 script to update an ipset blacklist from postfix's log

blacklist.py

#!/usr/bin/python3

import os
import ipaddress
import sys


DRY_RUN = "--dry-run" in sys.argv


def is_valid_ip(address):
    try:
        ipaddress.ip_address(address)
        return True
    except:
        pass
    return False


ips = [ a for a in os.popen("grep warning /var/log/mail.info | grep 'authentication failed' | cut -d '[' -f 3 | cut -d ']' -f 1").read().split("\n") if is_valid_ip(a) ]
send_to_blacklist = []

for ip in ips:
    if ip not in send_to_blacklist:
        # Check if the ip occurs more than tree times
        if ips.count(ip) >= 3:
            # Send to blacklist
            send_to_blacklist.append(ip)


# Parse actual blacklist from ipset
blacklisted_ips = [ a for a in os.popen("ipset list blacklist").read().split("\n") if is_valid_ip(a) ]

# Send to blacklist unblacklisted ips
for ip in send_to_blacklist:
    if ip not in blacklisted_ips:
        if not DRY_RUN:
            os.popen("ipset add blacklist %s" % ip)
        print("Added to blacklist", ip)

if DRY_RUN:
    sys.exit(0)

# Send the new complete blacklist to the file
blacklisted_ips = [ a for a in os.popen("ipset list blacklist").read().split("\n") if is_valid_ip(a) ]

a = open("/etc/blacklist.ip", "w")

for ip in blacklisted_ips:
    a.write(ip)
    a.write("\n")

a.close()