[CentOS] protecting multiuser systems from bruteforce ssh attacks

Hello,

What is the best way to protect multiuser systems from brute force
attacks?  I am setting up a relatively loose DenyHosts policy, but I
like the idea of locking an account for a time if too many attempts
are made, but to balance this with keeping the user from making a
helpdesk call.

What are some policies/techniques that have worked for this list with
minimal hassle?

Thanks!

-Eugene