Would this be best done through PAM?
You can do this in many ways. You can limit how many times a user can connect via SSH by using the pam_tally (better pam_tally2) module with something like
auth required pam_tally.so deny=10 unlock_time=60 per_user
which limits every user to 10 logins / minute.
This is of course not blocking the connection to the SSH daemon in any way. To do that you should use netfilter and the recent module
iptables -A INPUT -tcp --dport 22 -m state --state NEW -m recent --set iptables -A INPUT -tcp --dport 22 -m state --state NEW -m recent --update --hitcount 10 --seconds 20 -j DROP
Which limits every host (regardless of a succesful or unsuccesful login) to 10 connections every 20 seconds.
You can make PAM reset the iptables counter by writing a script (executed by pam_exec.so) which does echo "-IPaddress" > /proc/net/xt_recent/nameoftherecentlist or add an untrusted host doing the same but with echo "+IPaddress" > ...
More information can be found at: http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-pam_tally.html and http://www.debian-administration.org/articles/187 and of course with the man command.
I think PAM is the answer here, that's typically where you put any kind of system-wide authentication hooks.
I don't know of any existing PAM module that does what you want, but there is a module called pam_exec which lets you use an external script. You could write a script that accepts / rejects users on whatever criteria. This is definitely far easier than trying to implement your own module in C.
For this particular case your script can parse the output of
last and count how many times the user has logged in today.
Open-SSH sshd_config provides a variable to limit the number of concurrent unauthenticated connections alive... (MaxStartups) http://unixhelp.ed.ac.uk/CGI/man-cgi?sshd_config
But I assume you mean max number of open connections??
Ok assuming it is just the no of connections in a day you could do this in a cron job
grep 'Accepted password' /var/log/secure | grep sshd |wc -l
if [ $ssh_sess_count -gt 10]
service ssh stop
Of course this assumes your settings for logrotate are to keep a logfile per day basis. And you will have to change the count and service name(depending on your box)
Now that should get me the 50 points huh??