Having a quite smooth way to avoid some brute-force SSH attempts is relatively easy using fail2ban. On Debian, after the “apt install fail2ban” command, ssh is already protected but a little more can be done to improve the efficiency of this filter.
First, override the “dbpurgeage” setting to allow the data to remain up to 7.5 days. Add the file /etc/fail2ban/fail2ban.d/local.conf with:
[Definition]
dbpurgeage = 648000
Then add another config file to enable the “recidive” jail, for instance in /etc/fail2ban/jail.d/local.conf add:
[recidive]
enabled = true
maxretry = 2
bantime = 604800 ; 1 week
findtime = 86400 ; 1 day
Restart the fail2ban service et voilà, fail2ban has now the ability to keep away some brute-force IP a bit longer. You can of course change the desired value to extend the ban or limit the findtime.
