Ban people trying to login to your server as root

root_ssh_ban.sh

#!/bin/bash

#run to setup
#iptables -N root-ban
#iptables -A root-ban -j RETURN
#iptables -A INPUT -j root-ban

#uncomment if cron
#export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

if [ ! -f /var/log/root_banned ]; then
	touch /var/log/root_banned;
fi

ipsToBan=$(cat /var/log/auth.log | perl -lne '/root from ([^ ]*)/ && print $1' | sort| uniq | comm -3 - /var/log/root_banned | tee -a /var/log/root_banned)

for ip in $ipsToBan; do
	if [[ $ip != "127.0.0.1" ]]; then
		iptables -I root-ban -s $ip -j DROP;
	fi
done