There are a number of different packages out there to shut out IPs from which brute-force SSH attacks are launched on your system. For example:
What are the pros/cons of these, or any others?
My current solution is to take the email that logwatch generates every day and dump the egregious IP addresses into a text file which I feed into a script that then rebuilds iptables. It's hacky, time-consuming and manual, and I'd like a better way.
(Note that I didn't ask what was the "best" way to solve the problem, because there is no "best" way to do anything.)