Matthew Dillon’s added a sshlockout utility, to temporarily block SSH traffic from repeated brute force SSH login attempts.  It’s been mentioned before, but it’s in the system now.  It’s been refashioned to work with pf.