#!/bin/ksh

exclude[0]=192.0.2.99
exclude[1]=$(dig +short host.example.org)
dump=/tmp/ipdump.txt
list=/tmp/iplist.txt

sed -nE '/sshd.*Invalid user/{
s/.* from //
s/ port .*//w /tmp/ipdump.txt
}
/sshd.*Failed password for root/{
s/.* from //
s/ port .*//w /tmp/ipdump.txt
}
/sshd.*Unable to negotiate with/{
s/.* with //
s/ port .*//w /tmp/ipdump.txt
}' /var/log/authlog

cat $dump | sort | uniq > $list
rm -rf $dump

for ip in ${exclude[@]} ; do sed -Ei "/$ip/d" $list ; done

pfctl -q -f $list -t bruteforce -T add
for ip in $(cat $list) ; do pfctl -q -k $ip ; done

rm -rf $list
exit 0
