[spc476]

I have a script (easy when one embeds Lua inside syslogd) that checks for failed ssh logins and after a few failed attempts, blocks the address via iptables (and another script to remove such blocks after a few hours to keep iptables entries from piling up).

[icebraining]

That's essentially what DenyHosts[1] and fail2ban[2] do, except they're more complex (the former has blacklist sharing, while the later supports more than ssh).

[1]: http://denyhosts.sourceforge.net/index.html

[2]: http://www.fail2ban.org/wiki/index.php/Main_Page