Fail2ban watches log files for repeated failed login attempts and automatically bans the offending IP at the firewall level — a simple, effective defense against brute-force attacks that requires almost no ongoing maintenance.
sudo apt install fail2ban # Never edit jail.conf directly - it gets overwritten on updates sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
[sshd] enabled = true port = ssh maxretry = 5 bantime = 3600 # ban for 1 hour findtime = 600 # within a 10-minute window [nginx-http-auth] enabled = true port = http,https logpath = /var/log/nginx/error.log
sudo systemctl restart fail2ban sudo fail2ban-client status sshd sudo fail2ban-client unban 203.0.113.5 # manually unban an IP
Fail2ban ships with jails for many common services beyond SSH — Nginx, Apache, Postfix, WordPress login pages — worth enabling for anything internet-facing that has a login prompt, not just SSH.