超过十次，就添加到hosts.deny里面去
#!/bin/bash
date=`date +%Y%m%d`
file="/var/log/secure"
max=10
if [[ -f $file ]]
thengrep Failed $file | awk '{print $(NF-3)}' | sort -rn | uniq -c | awk '{print $2 "=" $1}'>/shell/ip.txt
fi
for a in `cat /shell/ip.txt`
doif [[ `echo $a| awk -F"=" '{print $2}'` -gt $max ]]thenb=`echo $a | awk -F"=" '{print $1}'`grep $b /etc/hosts.deny >/dev/nullif [[ $? != 0 ]]thenecho "sshd:$b" >> /etc/hosts.denyfifi
done