Limiting ssh scans

[Bill Wohler <wohler@newt.com>]

What sort of precautions have folks taken against ssh scanners?

I think I'd like to deny an IP address access to my ssh daemon (or my
entire network for that matter) for 24 hours if upon the third incorrect
login, or something like that. a scumbag at a particular IP address
fails 3.

Are there ssh, PAM, or shorewall settings I could leverage? Other tools?

A Google search was unfulfilling and not relevant with my Debian system. 

-- 
Bill Wohler <wohler@newt.com>  http://www.newt.com/wohler/  GnuPG ID:610BD9AD
Maintainer of comp.mail.mh FAQ and MH-E. Vote Libertarian!
If you're passed on the right, you're in the wrong lane.