Linux
What is fail2ban?
A daemon that watches logs for repeated failed logins and bans the source IP, blunting brute-force attacks.
How it works
It's not a substitute for key auth, but it stops the log noise and opportunistic scanners. On Ubuntu it's a quick install with a sensible SSH jail.
Example
In practiceInstall fail2ban, enable the sshd jail, and repeated failed passwords get the IP temporarily banned.
Is fail2ban enough on its own?
No. Use it alongside SSH key auth and a firewall, not instead of them.
Go deeper: Build a Hardened Linux Workstation
The complete, step-by-step guide — every command, config, and the reasoning behind it.
Get the guide