Blockera IP efter x ggr fel inlog

import os

# Variable definition.
pfctl = "/sbin/pfctl"
pf_conf = "/etc/pf.conf"
pf_table = "sshscan"
authlog_path = "/var/log/sshd"
infected_ips = []


# Read authlog, searching for infected ip addreses
print 'Reading the log - ', authlog_path, '\n'
authlog = file(authlog_path, 'r')
authlog_line = '-'

while authlog_line != '':
    if 'Failed password for invalid user' in authlog_line:
        ip = authlog_line.split('from')[1].split('port')[0].strip(' ')
        if ip not in infected_ips: 
            print 'Infected host detected - ', ip
            infected_ips.append(ip)
    if 'Failed password for root from' in authlog_line:
        ip = authlog_line.split('from')[1].split('port')[0].strip(' ')
        if ip not in infected_ips:
            print 'Infected host detected - ', ip
            infected_ips.append(ip)
            


    authlog_line = authlog.readline()
 
authlog.close()

# Use pfctl to get the ip addreses already blocked
print '\nReading the table of blocked hosts - %s -t %s -T show\n' % (pfctl, pf_table)
pipe = os.popen('%s -t %s -T show' % (pfctl, pf_table))
blocked_ips = pipe.read().split('\n')
pipe.close()

# clean the list, removing unneeded blank spaces
for i in range(len(blocked_ips)):
    blocked_ips[i] = blocked_ips[i].strip(' ')


# go through the list of infected ips, checking if the ip address is already blocked
# or not. If not, add the ip address to the table.
for ip in infected_ips:
    if ip in blocked_ips:
        print ip,' - IP Address already blocked'
    else:
        print ip, ' - Adding IP Address to the blocked table'
        os.popen('%s -t%s -T add %s' % (pfctl, pf_table, ip))