Fail2ban watches login attempts and, when an IP fails too many times, blocks it for a while in the firewall. Against password-guessing bots it is very effective and uses almost nothing.
Install it
# Ubuntu / Debian
apt install -y fail2ban python3-systemd
# Rocky Linux
dnf install -y epel-release && dnf install -y fail2banConfigure it
Create /etc/fail2ban/jail.local (do not edit jail.conf: updates overwrite it):
[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5
# Put your home IP here so you never ban yourself
ignoreip = 127.0.0.1/8 ::1
[sshd]
enabled = true
backend = systemdWith this, an IP that fails 5 times in 10 minutes is blocked for an hour. The backend = systemd line makes it work on Debian 12 too, which no longer writes the classic auth.log file.
systemctl enable --now fail2ban
systemctl restart fail2banSee what it is doing
fail2ban-client status sshdIt shows how many attempts it has seen and which IPs are blocked right now.
If you block yourself
Wait for the ban to expire, or use the VNC console and unban yourself:
fail2ban-client set sshd unbanip 198.51.100.7Fail2ban is a good extra layer, but the real protection is having no passwords to guess: log in with an SSH key and disable passwords.