We have this one in sshd-ddos.conf ... and probably it would be better to keep it there since it is not per se about incorrect credentials and failed login... might need higher maxfailures to operate with low level of false positives on unreliable connections etc