Archived from groups: comp.security.firewalls (More info?)

Greetings,

Here is my lan :

Router
-> Machine 1 with port 22 open (linux)
-> Machine 2 with port 80 open (linux)

I put snort on Machine 2 to detect hack attempts on the webserver.

Say somone try to hack my apache, Snort fill an entry in the alert
file.
Ok.

Now, How can I take active mesures ?
I thought of doing the following but maybe this was done already :
Snort sends a packet to the a socket to a program listening on the
port.
The program add the ip adress in the /etc/hosts.deny file.

is that enough ?
does a program doing this already exist ?
can snort do it himself (i am currently reading the snort
documentation but din't find anything yet)

thanks for your help