How to ban IPs trying to login as root with ssh

Solution 1:

I setup two different Fail2Ban rules:

1. If they try an invalid username they get banned on the first try, permanently. I don't have many people getting in that way and none of them have ever got banned that way; but it may be a support issue if you've got lots of people signing in. Root isn't a valid ssh login on my systems.

   I'm on a FreeBSD system, so you might have to modify this rule a touch. Create a ssh-invaliduser.local file in the filter.d directory:

   failregex = ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
   

   Set the options for this rule as usual in the jail.local file.

2. The second rule locks out attempts that have got the password wrong 10 times for 10 minutes. Nobody's going to break in at 1 password per minute average speed.