e -0
nobody    5899  0.0  0.2   3716  1060 ?        SN   06:25   0:00 su nobody -s /bin/sh -c /usr/bin/find / -ignore_readdir_race      \( -fstype NFS -o -fstype nfs -o -fstype nfs4 -o -fstype
nobody    5900  8.2  0.2   3088  1224 ?        RN   06:25   0:09 /usr/bin/find / -ignore_readdir_race ( -fstype NFS -o -fstype nfs -o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o

#### 
# (adapted from an example I found on the net (http://www.burngreave.net/node/319 9-11-2006)
# ... didn't work for me)
LOGFILE="/var/log/auth.log"
HOSTSDENY="/etc/hosts.deny"
BADCOUNT="10"
grep -i "invalid user" $LOGFILE | grep -v Fail | cut -d : -f 4 | cut -d " " -f 6 | sort | uniq -c | while read i

# this does the following:
# look for invalid user entries|
# filter out 'Failed' lines |
# remove everyting before the third ':' (needed because for instance "nov 6" has three spaces and "nov 10" only two) |
# cut out the ip number (field six)
# sort ipnumbers
# count the number of instances and display only only single instances
do
count=`echo ${i} | cut -d " " -f 1`
ip=`echo $i | cut -d " " -f 2`
# echo "count="$count
# echo "ip="$ip
already=`grep $ip $HOSTSDENY | grep sshd`
if [ -z "$already" ]
then
if [ "$count" -ge "$BADCOUNT" ]
then
echo "banned from sshd: "$ip
echo "sshd: "$ip >> $HOSTSDENY
echo "sshd: $ip  $HOSTSDENY " >> /root/hostdenys.log
echo "sshd: $ip  $HOSTSDENY " >> /dev/tty3
fi
fi
done

#Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no