Install notes for Debian
sshdfilter should work as is with sarge, however, a user reported sid (testing) needed some changes to the patterns. All occurances of illegal should be changed to invalid. This was the case on 10/02/2006, as testing releases change often, you might not need this change. Look at your sshd log messages to confirm what messages your sshd uses.
Update 12/6/06: The patterns now check for either 'invalid' or 'illegal'.