I really need to be able to have SSH access from my WAN, and while I use an insane password I really would like to have something like DenyHosts running. When I install it now it installs fine, but no matter what I do I can't get the service started. I've tried following some threads on the forums to get it working, but so far nothing has worked.
Rather than mess around with add-on packages, I'd be tempted to just tick "Disable Password login for Secure Shell (KEY only)" and completely disable password-based authentication.
The fact that pfSense's standard SSH port is 222 helps A LOT to start with.
Rate-limiting connections on port 222 will help if you're feeling really paranoid.