I do something similar with firehol lists and iptables/ipfw scripts and it cut my auth log spam down to almost nothing - single digit auth attempts per day per

I do something similar with firehol lists and iptables/ipfw scripts and it cut my auth log spam down to almost nothing - single digit auth attempts per day per server now usually. My first pass of blocking .cn network space on its own cut my log spam by probably 90% (thousands of attempts per day down to dozens).