denyhosts, fail2ban, or something else?

[Arthur Chance]

On 11/27/12 22:25, Aleksandr Miroslav wrote:
> Finally got sick of seeing tons of ssh break-in attempts in my logs. Am
> considering using denyhosts, or fail2ban. Anyone have any experience
> with these?
>
> I'm already using the AllowUsers facility of ssh to only allow specific
> users in, so I'm not overly concerned about the attempts.
>
> This is for a FreeBSD 8.x box running pf, btw.

It's probably major overkill and may not fit your needs but this article 
by Colin Percival is an interesting enhancement to the non-standard port 
solution.

http://www.daemonology.net/blog/2012-08-30-protecting-sshd-using-spiped.html