first

getSSHfails

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+IPSFILE="/tmp/lastIPs.txt"
+
+if [[ $1 == 'count' ]] ; then
+    # pick the last 10 mins of the auth.log (2000 lines should cover that) and count the auth failures for ssh
+    rm -f ${IPSFILE}
+    NOW=$(date +"%s")
+    tail -2000 /var/log/auth.log | grep sshd | grep -e "failure" -e "invalid" | ./last10mins | while read LINE; do
+        # send the ip-address to a temp file
+        echo "$LINE" | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" >>${IPSFILE}
+    done
+    # count the number of lines found
+    cat ${IPSFILE} | wc -l
+fi
+
+if [[ $1 == 'block' ]] ; then
+    cat ${IPSFILE} | sort -u | while read LINE; do
+        IP=$(echo ${LINE} | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b")
+        addEvent.sh "BLOCK,${IP},0,0,Unauthorized authorization attempt in SSH"
+	# ufw deny from $LINE
+    done
+    cat ${IPSFILE} | sort -u | wc -l
+fi