look at auth.log and add dodgy-looking addresses to a file
delete old tarsnap backups