Whenever I see someone trying the break in in the logsentry reports, I add their IP to the deny_hosts.conf file and restart ipkungfu so that the changes will take effect.
maybe you want to have a look at sshdfilter http://www.csc.liv.ac.uk/~greg/sshdfilter/ jakob -- gentoo-user@gentoo.org mailing list
