#!/bin/bash
IP_LST='/tmp/postfix_ban_ip.txt'

cat /var/log/maillog|egrep "(Connection lost to authentication server)"|awk '{print $(NF-9)}'|awk -F '[' '{print $2}'|cut -f1 -d]|sort|uniq -c|awk '{print $2"="$1;}' > ${IP_LST}

DEFINE="5"
for i in `cat  ${IP_LST}`
do
IP=`echo $i |awk -F= '{print $1}'`
NUM=`echo $i|awk -F= '{print $2}'`
	if [ $NUM -gt $DEFINE ];
	then
		echo "ALL:$IP" >> /etc/hosts.deny
	fi
done 