Blacklist SSH Bruteforce Fools

If you run OpenBSD. Add this to your pf.conf

#table of bad-guys
table <fsckers> persist file "/var/db/fsckers.txt"
#Block Blacklisted IPs
block in on $external from <fsckers> to any

/var/db/fsckers.txt is a plaintext file with each blacklisted ip / ip-block on a seperate line. Lines starting with # are considered comments.

Then I wrote this little script that I run hourly via cron to update my blacklist table based on failed password attempts.

#!/bin/sh
echo "Started on: $(date)"
for each in $(grep 'Failed password' /var/log/authlog |               sed 's/^.*from //;s/port.*$//' | uniq)
do
   echo -n "$each\t\t--->"
   pfctl -t fsckers -T add $each 2>&1
done

I guess I also need to extend this so that it also adds it to /var/db/fsckers.txt, but that is trivial. The text file in only needed when initially loading the list.

To view the current list of blacklisted ip, type:

pfctl -t fsckers -T show

EDIT: here is my script to dump the current blacklist to fsckers.txt

#!/bin/sh
pfctl -t fsckers -T show | sed 's/^   //' > /var/db/fsckers.txt