[aexaey]

fail2ban [1] would take care of this by automatically firewalling off IPs that fail to authenticate too frequently.

[1] https://www.fail2ban.org/

[lvh]

Would it? My understanding is the authentication worked just fine, it’s just spawning a shell that doesn’t. That could be intentional: eg for SFTP hosts or jump hosts.