I've had a lot of success with denyhosts. As a bonus, all of my machines with publicly facing SSH synchronize the generated ruleset.