#!/bin/sh
#
# Alert on high SSH failed login count.
#

LOG=$(journalctl -u ssh --since "1 hour ago" --no-pager \
    | grep "Failed password")

COUNT=$(echo "$LOG" | grep -c "Failed password")

THRESHOLD=4

if [ "$COUNT" -gt "$THRESHOLD" ]; then
    {
        echo "SSH failed login alert"
        echo "Host: $(hostname)"
        echo "Count: $COUNT"
        echo "Time: $(date)"
        echo
        echo "$LOG"
    } | s-nail -s "SSH attack on $(hostname)" root
fi