I would probably use something like pam_tally or pam_shield, since it's taking counts directly from the login flow and not via log files. Mentioned in other co

I would probably use something like pam_tally or pam_shield, since it's taking counts directly from the login flow and not via log files. Mentioned in other comments, protecting from brute force isn't really the big benefit. The benefit is reducing noise in logs so that you can see more serious activity.