SECURITY_TASK.SH
This is a Linux bash script which loops continusely checking if logged on with the wrong password, once failed a message and email will be sent with the ip address. It worked perfectly and to good when I opened the port 22. When I did so I got full of email alerts.install fail2ban and "apt-get install rsyslog" before.
security_task.sh
#!/bin/bash
count=0
while true; do
if [ -t 0 ]; then stty -echo -icanon time 0 min 0; fi
keypress=''
while [ "x$keypress" = "x" ]; do
#do something... in your case:
d=`date +%H:%M`
#echo $d
a=$(awk '/Failed/{ print $1, $2, $3,$6,$11,$12,$13}' /var/log/auth.log | awk "BEGIN {p=0}; /$d/")
if [ ! -z "$a" ]; then
count=$((++count));
fi
if [ $count -eq 1 ]; then
echo $a
mail.sh "You have an intuder at richard@richard-Thinkcentre-M77" "$a"
fi
#echo $count
if [ -z "$a" ]; then
count=0;
fi
#end of do something
read keypress
done
if [ -t 0 ]; then stty sane; fi
echo "You pressed '$keypress' for pause."
read -p 'Press [Enter] key to continue or [Ctrl+C] to finish...'
done