Hi
I used this to automatically block brute force dictionary smtp auth attacks to my smtp server:
tail -f /var/log/exim/rejectlog | grep "535 Incorrect authentication data" | grep "
[email protected]" | awk '{ gsub(/\[/,""); gsub(/\]:/,""); print $8 } ' | xargs -I'{}' /sbin/ipfw...