[LINUX OpenSSH] accès authorisé par mail

#!/bin/sh
#
# [url]www.sub7.be[/url]

VERSION="Version 1.002"

# configuration variables (DEFAULTS)
pfctl="/sbin/pfctl"
pf_table="sshscan"
authlog_path="/var/log/authlog"
white_list=" 127.0.0.1"
verbose=""
log_path=""

function usage
{
cat << USAGE
sub_block for OpenBSD and Pf ($VERSION)

usage: sub_block.sh -h
       sub_block.sh [-t pf_table] [-a authlog_path]
                      [-w IP_for_white_list ] [-v]
                      [-l log_path ]

USAGE
}

while getopts ":ht:a:w:vl:" switch; do
	case $switch in

		h)
			usage
			exit 0
			;;

		t)
			pf_table="$OPTARG"
			;;

		a)
			if [ ! -e "$OPTARG" ]; then
				echo "$OPTARG: no such file"
				exit 1
			fi
			authlog_path="$OPTARG"
			;;

		w)
			white_list="$white_list $OPTARG"
			;;

		v)
			verbose="YES"
			;;

		l)
			if [ ! -e "$OPTARG" ]; then
				echo "$OPTARG: no such file"
				exit 1
			fi
			log_path="$OPTARG"
			;;

		*)
			echo "unknown switch, try -h"
			exit 1
			;;
	esac
done

if [ "X$log_path" = "X" ]; then
	# get the IPs of people trying illegal users from authlog
	infected_list=$(awk '/Failed\ password\ for\ (illegal|invalid)\ user/ { print $13 }' $authlog_path)
else
	if [ "X$verbose" = "XYES" ]; then
		echo "$(date '+%b %d %T'): using sub_block log ($log_path) instead authlog"
	fi
	# else get IPs from log
	infected_list=$(awk '/Infected\ host\ detected/ { print $7 }' $log_path)
fi

# we want unique IPs
infected_list=$(echo "$infected_list" | sort | uniq)

# get already blocked IPs
blocked=$($pfctl -t$pf_table -T show)

for infected in $infected_list; do

	echo $white_list | grep -v $infected > /dev/null
	if [ $? = 0 ]; then

		echo $blocked | grep $infected > /dev/null
		if [ $? = 0 ]; then
			if [ "X$verbose" = "XYES" ]; then
				echo "$(date '+%b %d %T'): Infected host detected $infected - IP Address already blocked"
			fi
		else
			echo -n "$(date '+%b %d %T'): Infected host detected $infected"
			echo -n " - Adding IP Address to the blocked table: "
			$pfctl -t$pf_table -T add $infected 2>&1
		fi
	fi
done

# EOF

0 */5 * * * /home/subnet/sub_blocker.sh >> /var/log/ssh_blocker.log