Fischglas Software Archive / authfilter

Authfilter is a mechanism to block ssh login after some failed attempts. It does so by listening on syslog output, setting a null route to the given source ip address for some time, entering the address to an DNSRBL (which is consulted first of all, of course) and sending mail to the admin. This mail can be further processed for complaints to the isp being responsible for the source ip using whois, mutt and further scripting. The whole thing is optimized to protect your systems and reduce admin complaints to some few keystrokes.