#!/usr/bin/env python

import os
import time,sys

def getIP(theString):
        bla = theString.replace("(?@","^")
        bla2 = bla.replace(")","^")
        finalstring = bla2.split("^")
        return finalstring[1]

def blockIP(ipAddr):
        os.system("route add -host " + str(ipAddr) + " reject")

def logIT(ipAddr):
        flog = open('/var/log/ftp-firewall.log','a')
        flog.write('Blocked : ' + str(ipAddr) + '[' + time.ctime() + ']' + '\n' )
        flog.close()

f=open("/var/log/messages.log")
readBuffer = ''
while True:
        readBuffer += f.read()
        lastNewline = readBuffer.rfind('\n')
        outputbuffer = readBuffer[:lastNewline].split('\n')
        for line in outputbuffer:
                if len(line)>0:
                        if line.find("Authentication failed") !=-1:
                                OffenderIP = getIP(line)
                                blockIP(OffenderIP)
                                logIT(OffenderIP)
                readBuffer = readBuffer[lastNewline+1:]
                time.sleep(1)