#!/bin/bash
# 登陆失败次数过多，拒绝登陆，最多3次

#set -e
lastb|awk '{print $3}'|sort|grep [0-9]|uniq -c|awk '{print $2"="$1}' >/tmp/failed.list

for i in `cat /tmp/failed.list`
do
   IP=`echo $i |awk -F= '{print $1}'`
   NUM=`echo $i |awk -F= '{print $2}'`
   if [ $NUM -gt 3 ];then
      grep $IP /etc/hosts.deny > /dev/null
      if [ $? -gt 0 ];then
         echo "sshd:$IP:deny" >> /etc/hosts.deny
      fi
   fi
done