pure-ftpd isn't designed to work with TCP wrappers, which is unfortunate, because then I can't simply add an ip address to /etc/hosts.deny to block the hackers when they guess passwords.  But, since the hackers have tried to login to my servers thirty thousand times this month, and occasionally get good usernames, and theoretically might guess a right password eventually, I needed to figure out a solution.The solution is to use the external authentication method before checking the "real" authentication methods, and simply check the IP address.  The only down-side of this method is that instead of blocking the connection at the start, it blocks it at authentication time, which means there are more entries in the log files.  Another side-effect is that the hacker doesn't know he is being blocked by ip address, so he continues trying to login, rather than going on to the next unsuspecting server, so I suppose you can say I am doing the world some good by being a honeypot.

My external "authentication" script is the following:

#!/bin/sh

checkedIP=$(echo $AUTHD_REMOTE_IP | sed -ne "s~^\([0-9]\{1,3\}\)\.\([0-9]\{1,3\}\)\.\([0-9]\{1,3\}\)\.\([0-9]\{1,3\}\)$~\1.\2.\3.\4~p")

if test "x$checkedIP" = "x"; then
   checkedIP="Unknown"
fi

if test "$checkedIP" = "Unknown"; then
  # unknown will be allowed for now.  Probably should output the ip to see when this happens
  echo 'auth_ok:0'
else
  # note, this is checking for all services, rather than just a particular one
  grep $checkedIP /etc/hosts.deny

  if [ "$?" = 0 ]; then
    echo 'auth_ok:-1'
  else
    echo 'auth_ok:0'
  fi
fi
echo 'end'

Then you need to start the authd: 

pure-authd -B -s /var/run/ftpd.sock -r /etc/pure-ftpd/denyhosts

Then make a file called /etc/pure-ftpd/conf/ExtAuth  (I use pure-ftpd-wrapper, since I am on Debian) with the following line:

/var/run/ftpd.sock 

And then make a symlink named /etc/pure-ftpd/auth/20extauth that points to /etc/pure-ftpd/conf/ExtAuth

That's it!  As you might guess based on the name of the script, I will eventually get this to work automatically with the denyhosts project, which is an excellent program for ssh, and I want to extend it to pure-ftpd as well; just need to get the regular expressions correct.