1 files changed, 26 insertions, 0 deletions
diff --git a/ssh.txr b/ssh.txr
new file mode 100644
index 0000000..13cd77b
--- /dev/null
+++ b/ssh.txr
@@ -0,0 +1,26 @@
+@(load "txrban")
+@(set *short-period* 15)
+@(set *short-limit* 15)
+@(set *short-ban* @(* 24 3600))
+@(set *long-period* 300)
+@(set *long-limit* 10)
+@(set *long-ban* @(* 24 3600))
+@(next @(open-tail "/var/log/auth.log" "r" nil))
+@(repeat)
+@  (all)
+@(m month) @(n day) @(n year) @(n hour):@(n min):@(n sec) @(skip)
+@    (bind time @(make-time year month day hour min sec :auto))
+@  (and)
+@    (cases)
+@nil @nil @nil @nil localhost sshd[@nil]: Failed password for @user from @ip port @(skip)
+@      (do
+         (let ((users (get-info ip))
+               (level 0))
+           (if (> (length users) 3)
+             (set level 9))
+           (report ip time level user)))
+@    (or)
+@      (do (do-expiry time))
+@    (end)
+@  (end)
+@(end)