apt-get update
apt-get install denyhosts

vi /etc/denyhosts.conf
SYNC_SERVER = http://xmlrpc.denyhosts.net:9911

sudo service denyhosts restart

sudo tail -f /var/log/denyhosts
2018-09-29 11:11:42,383 - denyhosts : INFO Processing log file (/var/log/auth.log) from offset (102619)
2018-09-29 11:11:42,391 - denyhosts : INFO launching DenyHosts daemon (version 2.10)...
2018-09-29 11:11:42,398 - denyhosts : INFO DenyHost daemon is now running, pid: 13773
2018-09-29 11:11:42,401 - denyhosts : INFO send daemon process a TERM signal to terminate cleanly
2018-09-29 11:11:42,403 - denyhosts : INFO eg. kill -TERM 13773
2018-09-29 11:11:42,404 - denyhosts : INFO monitoring log: /var/log/auth.log
2018-09-29 11:11:42,406 - denyhosts : INFO sync_time: 3600
2018-09-29 11:11:42,407 - denyhosts : INFO purging of /etc/hosts.deny is disabled
2018-09-29 11:11:42,408 - denyhosts : INFO sync_time: : 3600
2018-09-29 11:11:42,409 - denyhosts : INFO sync_sleep_ratio: 120

参考）

【DenyHosts】自動で攻撃者の IP アドレスを拒否リストに登録する設定を試しましたの♪★シンクロナイゼーション・モード★