#!/bin/bash

#  LOGFILES  #
LOGFILE="/var/log/auth.log"
BANFILE="/etc/banlist"
MYLAN="192.168.1"

IPT=/sbin/iptables

if [[ $UID !=if [[ $UID != 0 ]]
	then echo "you must become root to continue"
	exit 0;
fi 0 ]]
	then echo "you must become root to continue"
	exit 0;
fi

if [[ ! -f "/etc/banlist" ]]
	then echo -e "There is no ban list file..\nShall i make one? y|n"
	read Answer
	case "$Answer" in 
		y|Y)
		echo "" > $BANFILE
		sed -i '/^ *$/d' $BANFILE
		echo "Made /etc/banlist"
		;;
		n|N)
		echo "ok Exiting.. "
		exit 0;
		;;
		*)
		echo "Wrong input.. rerun script and give right input please. "
		;;
	esac
fi

while :
do sleep 6

#bad users. sort them out..
Busr=`grep sshd  $LOGFILE |grep "Failed password for invalid user" |awk '{print $13}' |grep -v "127.0.0.1" |grep -v $MYLAN |sort -u`

for (( i = 1 ; i <= `echo $Busr |tr ' ' '\n' |wc -l` ; i++ ))
do var[$i]=$(echo $Busr |tr ' ' '\n' |sed -n ""$i"p")
   ATTEMPTS=`grep "Failed password for invalid user" $LOGFILE  |grep -c ${var[$i]}`

	if [[ $ATTEMPTS -ge "2" ]]
		then echo "${var[$i]}" >> $BANFILE 
		sort -u -o $BANFILE $BANFILE 
	fi  
done

### NOW LETS MAKE IPTABLES DROP ALL THIS IPS THAT TRYED TO BRUTE FORCE ON MY SSH
for (( x = 1 ; x <= `wc -l $BANFILE |awk '{print $1}'` ; x++ ))
	do ips[$x]=$(echo `sed -n ""$x"p" $BANFILE`)
	IPTIPS=$(echo `$IPT -L -n |grep DROP | awk '{print $4}' | grep -v "0.0.0.0" |sort -u -n | grep -v DROP |sed -n ''$x'p'` )
	if [[ "${ips[$x]}" == "$IPTIPS" ]]
		then echo "address" `sed -n ""$x"p" $BANFILE` "already added to iptables" > /dev/null
		else echo "droped ip" `sed -n ""$x"p" $BANFILE` "with iptables:: $(date)" 
		gxmessage --center "droped ip" `sed -n ""$x"p" $BANFILE` "with iptables:: $(date)"  &
		## THIS ADDS THE IP'S RO BE DROPED
		$IPT -I INPUT -s ${ips[$x]} -j DROP &
	fi
done
done