How to react to "authentication failures" in log file

Is it possible to run a script when the server logs one of this message?

Feb 28 05:25:18 www sshd(pam_unix)[27446]: authentication failure; logname=
uid=0 euid=0 tty=ssh ruser= rhost=222.90.234.68 user=root
Feb 28 05:25:23 www sshd(pam_unix)[27450]: authentication failure; logname=
uid=0 euid=0 tty=ssh ruser= rhost=222.90.234.68 user=root
Feb 28 05:25:29 www sshd(pam_unix)[27452]: authentication failure; logname=
uid=0 euid=0 tty=ssh ruser= rhost=222.90.234.68 user=root

I'm getting several of this every night. It seem that someone finds some
break-in script an try to run it against my server. Currently I'm just
reacting to it. When logwatch report comes in the morning, I use Iptables
to block the remote IP. I like to automate that process.

I'm thinking that either sshd can launch a script in reaction to this event
or one can run a script periodically to scan the logfile and determine which
IP to add to iptables. Maybe even flush iptables periodically to keep the
reject list short.

Before I start to re-invent the wheel, any suggestions about this? Maybe
there are tools already available for this purposes?

PS. Any options in sshd to throttle down this logon events?

Saludos,
Orlando


.

Relevant Pages

  • Re: Sourceforge Statistics
    ... The download stats for all ... a "quiet time" during the night when the servers aren't being used. ... So finding a time to run that script will be tricky ... Of course, on a sufficiently large site, the server logs can be ...
    (comp.os.linux.misc)
  • Re: How to react to "authentication failures" in log file
    ... reacting to it. ... When logwatch report comes in the morning, I use Iptables ... I'm thinking that either sshd can launch a script in reaction to this event ... Any options in sshd to throttle down this logon events? ...
    (comp.security.ssh)
  • Re: [PHP] CURL questions
    ... execute that script using cURL. ... This is a basic scenario and I assume ... What do the server logs say? ...
    (php.general)
  • Re: Sourceforge Statistics
    ... The download stats for all ... > really be so hard for a script to go through the server logs each ... I guess they must have other priorities. ... Maybe you could write the script for them? ...
    (comp.os.linux.misc)
  • Re: Help with Iptables on with RH linux
    ... iptables -P OUTPUT DROP ... INPUT only when packets have a destination IP of your firewall. ... the FORWARD chain contains rules that affect packets passing through ... Yes I flushed the rules before calling the script... ...
    (RedHat)