TMPFILE=/tmp/toy.$(basename $0)expand /var/log/auth.log | tr -s ' ' | tee >(grep "Invalid user" | cut -d' ' -f8 -f10 >$TMPFILE.e1) | grep "authentication error" | cut -d' ' -f13 -f15 >$TMPFILE.e2
exec 4> >(sort | uniq -c | sort -n > $TMPFILE.usr)
exec 5> >(sort | uniq -c | sort -n > $TMPFILE.ip)
while read f1 f2 rest
do
echo $f1 >&4
echo $f2 >&5
done < <(cat $TMPFILE.e{1,2})
4>&-
5>&-
exec 5> >(sort | uniq > /tmp/block.lst)
grep -f <(while read n data ; do [ $n -lt 3 ] && continue ; echo $data ; done < $TMPFILE.usr) $TMPFILE.e{1,2} | while read f1 f2 rest
do
echo $f2 >&5
done
while read n data
do
[ $n -lt 3 ] && continue
echo $data >&5
done < $TMPFILE.ip
5>&-
rm $TMPFILE.*
cat /tmp/block.lst