The pam_tally.so PAM module is intended to denying further authentication attempts after a given count of failed authentications. pam_tally is the maintenance program for pam_tally.so: it can list and reset the accumulated counts.
The pam_tally project homepage is here:
http://www.baverstock.org.uk/tim/pam/
Note that this only uses a local file (defaults to /var/adm/faillog) and has no facility to use LDAP or similar systems to combine results from several machines (or a cluster).
pam_tally provides a subset of the functionality of pam_abl (http://www.hexten.net/pam_abl/), but where pam_tally simply counts failing usernames, pam_abl allows for:
On the other hand, pam_abl seems to have 2 issues at the moment:
1. some users (including me) report failures not being recorded in database (fixed in current CVS from sourceforge)
2. an issue with OpenSSH where failures don't seem to be recorded (more details here: http://sourceforge.net/tracker/?group_id=148927&atid=773100)
One page links to pam_tally(8):