#!/usr/bin/perl 
use warnings; 
use strict; 
use 5.010; 
 
my %hash; 
my @list; 
my @banned;   
 
if ( !open MESSEGES, "/var/log/messages" ) { 
    die "didnt open? ($!)"; 
} 
 
while (<MESSEGES>) { 
 
    if (/Failed password/) { 
 
        @list = split; 
        if ( $list[12] =~ /^(\d+\.){3}\d+/ ) { 
            $hash{ $list[12] } += 1; 
        } 
        else { 
            if ( $list[10] =~ /^(\d+\.){3}\d+/ ) { 
                $hash{ $list[10] } += 1; 
            } 
        } 
    } 
} 
close MESSEGES; 
 
if ( !open FIREWALL, "firewall" ) { 
    die "didnt open? ($!)"; 
} 
 
while (<FIREWALL>) { 
    push @banned, $_ if /(\d+\.){3}\d+/; 
} 
chomp @banned; 
 
close FIREWALL; 
 
for my $key ( sort keys %hash ) { 
    delete $hash{$key} if $hash{$key} < 3; 
} 
 
for (@banned) { 
    delete $hash{$_}; 
} 
 
if ( !open FIREWALL, ">>firewall" ) { 
    die "didnt open? ($!)"; 
} 
 
select FIREWALL; 
for my $key ( sort keys %hash ) { 
 
    print "$key\n"; 
} 
 
close FIREWALL