I already run fail2ban on my home server, and it does its job well: it watches the mail and SSH logs, and it bans brute-forcers within a second or two. But fail2ban has two structural limits. It’s reactive — an attacker has to hit my server, and fail long enough to trip a jail, before anything happens. And it’s local — every server learns about every attacker from scratch, on its own.
[Read More]