### /etc/pam.d/sshd
auth sufficient pam_unix.so nullok try_first_pass
auth sufficient pam_exec.so /sbin/log_and_deny.sh

### /sbin/log_and_deny.sh
#!/bin/sh
x=/var/run/sshd-blacklist-$PAM_USER-$PAM_RHOST
if [ -f $x ] ; then
shutdown now $x
else
touch $x
fi
exit 1