> an ssh server exposed to the Internet. I... still allow password authentication in case of trouble

You gotta get over that eventually and really, the sooner the better.

sshguard is exactly this - single C binary, no interpreter needed. It tails your logs (journalctl/syslog) and bans offenders via iptables/nftables/pf. No Python, no dependencies beyond the firewall backend: https://www.sshguard.net/

• BlueRoguesDevel

  last Saturday at 2:27 PM

  How did I miss this? I have a stack begging to try this out, and for the same reasons as OP. Thank you.

• jech

  last Friday at 9:25 PM

  One hour later, it appears that sshguard is working fine. It's structured as a dozen binaries or so, but it has no dependencies. I haven't done any CPU usage measurements, but I haven't seen it appear in top's output.

• jech

  last Friday at 8:12 PM

  > sshguard is exactly this

  Thanks. I've replaced fail2ban with sshguard on one machine, we'll see how it goes.

This isn't for everyone and it will block old ssh libraries (libssh, go ssh, etc...), windows and others but if you only have OpenSSH 10+ and that's all you connect with then this method [1] has worked well for me. It gets botters to exclude my nodes that expose SSH on purpose (such as public anonymous SFTP). If trying it out test from an out of band console first.

Edit: I should add, there will still be some syslog entries, but that can be filtered out using regex filters in rsyslog one so desired. Only do so once it is confirmed most of the brute forcing has stopped.

[1] - https://nochan.net/b/Internet-Crap/20260108-Confuse-Some-SSH...

Disable password authentication and ignore the noise.

there is fail2zig seems to be exactly what you looking for

https://fail2zig.com

[dead]

[dead]