authfail is a tool for adding IP addresses to an ACL when entities from those addresses attempt to log into a system, but cause authentication failures in auth.log. It reads data from auth.log in real time and adds the IP into netfilter with a DROP/REJECT policy.
78ac44c1e15704e0789d28dde32b9ad20f09e62b54a2fa747e8aca5d06229a17