Laurie Brown laurie@brownowl.com
What I'd like to do is monitor the logs for such a line (or maybe three on the trot), and immediately [...] lock them out until a restart.
Try Adam Rosi-Kessel's ssh_login_blocker from http://adam.rosi-kessel.org/weblog/free_software/code/ssh_login_blocker.html
Hope that helps,