Example of iptables script that drops new connections after 7 attempts in 30 seconds(this is off memory, sorry if it doesn’t work…look @ manpage for more info):
iptables -A INPUT -p tcp -m tcp –dport 22 -m state –state NEW -m recent –set –name DEFAULT –rsource
iptables -A INPUT -p tcp -m tcp –dport 22 -m state –state NEW -m recent –update –seconds 30 –hitcount 7 –name DEFAULT –rsource -j DROP

Some articles on port knocking:
http://www.ducea.com/2006/07/05/how-to-safely-connect-from-anywhere-to-your-closed-linux-firewall/
http://gentoo-wiki.com/HOWTO_autossh_and_knockd

Works out-of-the-box for most distributions.

zegrep refused auth.log*

cat(1) is for concatenating text files:

cat file1 file2 file3 > file4

and etc.

Most of the standard unix text processing utilities will open and read from one or more files passed on the command line (just like cat does), iterating over their lines as if they were a single file.

What’s the point? Even though the time and energy I’ve just devoted to this post may suggest otherwise, I hate unnecessary typing, and one less cat process means slightly lower resource usage.

http://lizer.syslinx.org/temporary/failog
http://lizer.syslinx.org/temporary/lognames

Usage:
zcat /var/log/authlog*gz | cat - /var/log/authlog | ./failog [date|host]
Counts the failed logins grouped by date/attacker ip.

zcat /var/log/authlog*gz | cat - /var/log/authlog | ./lognames
Lists the login names and how often each has tried.

I’ve used this on a few hosts, it’s relatively easy to install, although you sometimes have to change the detection a bit (find another word, ip address being just another word…). But it runs very well ;).

Furthermore you can also change your SSH port if you hate receiving large logwatch e-mails, or you can deinstall logwatch…