BlockHosts is a script to record how many times a local system is attacked, based on configurable scanning of system logs for sshd or other services. When a particular IP address exceeds a configured number of failed login attempts, that IP address is blocked using hosts.allow files, or by using null-routing, or by using packet filtering. An email notification facility is also available. License: Public Domain Changes:
iptables is now updated by inserting blockhosts blocking rules at the beginning of the chain instead of at the end. This will allow servers with default policy of both DROP or ACCEPT to make use of blockhosts. Both INPUT and FORWARD chains will now block traffic from rogue IP hosts.

More...