Free tool
Fail2ban jail generator
Pick the service and generate the block ready to paste into /etc/fail2ban/jail.local.
Time window (findtime)
[sshd]
enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
findtime = 600
bantime = 3600- maxretry / findtime — if these failed attempts happen within this time window, the IP gets banned. Setting maxretry too high lets slow attacks through; setting it too low can ban someone who just mistyped a password.
- bantime — how long the ban lasts. -1 means permanent until removed by hand with fail2ban-client.
- After saving the file: sudo systemctl restart fail2ban, and confirm it loaded with sudo fail2ban-client status [jail].
FerroSentry checks fail2ban for you
It checks whether it's installed and running on your server and, if it's missing, offers to install it from the panel. You confirm; then it keeps watching.