=============================
#! /bin/bash
cat /var/log/secure|awk '/Failed/{print $(NF-3)}'|sort|uniq -c|awk '{print $2"="$1;}' > /root/black.txt
awk '/no such user/' /var/log/secure|awk '{print $7}'|cut -d ":" -f4|sed "s/\[//g"|sort|uniq -c|awk '{print $2"="$1;}' >> /root/black.txt
DEFINE="5"
for i in `cat /root/black.txt`
do
IP=`echo $i |awk -F= '{print $1}'`
NUM=`echo $i|awk -F= '{print $2}'`
if [ $NUM -gt $DEFINE ];
then
/sbin/iptables -L -n|awk '{print $4}'|grep [0-9]|sort|uniq>/root/ipbad.list
# grep $IP /etc/hosts.deny > /dev