я сделал так:
в sshd.conf записал:
SysLogFacility AUTHPRIV#!/usr/bin/perl
$log="Subject: IP banned\n";
%ban;
open(F, '< /var/log/secure');
while(<F>){
$str = $_;
$str=~/Failed password for .+ (.+) port/;
if(!$ban{$1}){ $ban{$1}=1; } else { $ban{$1}++; }
}
close(F);
open (BL, '>>/etc/rc.d/ban.ip');
foreach $key (keys %ban){
if($ban{$key} > 10 && $key){
print BL $key,"\n";
`iptables -I tcp_new -p tcp -s $key -j DROP`;
$log.="$key\n";
smtp_send('postmaster@inteh.com.ua', $log);
}
}
close(BL);
open(F, '> /var/log/secure');
print F "0";
close(F);
sub smtp_send{
local $m_addr=shift;
local $m_body=shift;
my $ret;
my $p;
use IO::Socket;
my $remote = IO::Socket::INET->new(PeerAddr => '212.40.43.98:25')
or die "Can't create socket";
$p.=<$remote>;
print $remote "helo inteh\n";
$p.=<$remote>;
print $remote "mail from: <krot-s\@mail.ru>\n";
$p.=<$remote>;
print $remote "rcpt to: <$m_addr>\n";
$p=<$remote>;
if($p=~/250/i ){
print $remote "DATA\n";
$p.=<$remote>;
print $remote "$m_body\n.\n";
$p.=<$remote>;
if($p=~/250/i){
$ret=0;
}else{
$ret.="Error:\n$p\n";
}
}else{
$ret.= "Error: \n$p\nCan't sent the mail!\n";
}
print $remote "quit\n";
$p=<$remote>;
return $ret;
}
Тупо конечно, но слепил за 10 мин., и работает
Вариант для распечатки
(??) on 02-Мрт-06, 22:05 
