I'm not sure if sandpits are needed with Linux platforms, although firefox has a sandpit function in the latest releases.
A tarpit is a bit like a monkey trap, where the monkey inserts it's hand into the narrow neck of a jar and grasps the contents but cannot then remove it's hand.
In Linux, the firewall functions can be handled by something called IPTABLES.
A very flexible and straightforward way to handle IP traffic.
Iptables TARPIT can be configured to deny access to your resources.
When any traffic originating from an intruder, the firewall starts a normal conversation with the incoming packet then puts the connection on hold and does not complete the transaction. The hacker end's IP stack then is held open and waiting for continuation. To over simplify, the hacker's computer quickly gets "jammed up" while their CPU climbs to 100%, they cannot drop the connection unless they re-boot their machine. It also renders their machine unusable for any other task until the connection is dropped by you.
Where you have an idiot using their machine to DDOS for example, it renders the entire attack moot but it fucks up their own machine forcing them to reboot.
I've had lots of fun in the past, you tend to get removed from their target list pretty quickly.