Create firewall.user

block any IP address who has made more than 3 ssh connections or attempted connections within the past 3 minutes.