ssh failed logins

To get the list the of failed ssh logins

grep sshd.\*Failed /var/log/auth.log 


To extract only the ip address and get a unique list of ips

grep sshd.\*Failed /var/log/auth.log | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | sort | uniq

To block the ip's that have failed the ssh logins using iptables

grep sshd.\*Failed /var/log/auth.log | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | sort | uniq | while read ip ; do sudo iptables -A INPUT -s $ip -j DROP; done

running this command twice will create duplicates. Working on it to create it as a cron job,