I am only indirectly familiar with denyhosts (and only just discovered fail2ban) and they certainly seem like worthwhile tools. However, after looking through the options for sshd_config I am trying to determine if there may be some similar functionality within sshd itself.
In particular, MaxAuthTries seems relevant. From the man page for sshd_config:
MaxAuthTries Specifies the maximum number of authentication attempts permit‐ ted per connection. Once the number of failures reaches half this value, additional failures are logged. The default is 6.
However, this seems less like it will block the IP and more like it will simply close the connection which wouldn't do much for security if it allows further connections and thus authorization attempts. That said, I'd be surprised to find that it doesn't support some level of IP blocking, even if it's level of logging or configuration isn't as desirable as some of the other tools.
I have password authentication turned off and I'm considering changing my ssh port, if only to avoid completely blind attempts to connect, so I'm not super concerned about brute-force attacks. But blocking the IPs from potential attacks seems like it might be a nice additional level of security.
Is there a way to set up this up without a secondary tool or, if not, is there a reason this functionality isn't included?