fail2ban is easily the better of those two options. However the best solution is to use SSH keys (disable password authentication) and have a small few IPs whit

fail2ban is easily the better of those two options. However the best solution is to use SSH keys (disable password authentication) and have a small few IPs whitelisted. If password authentication is a must then hopefully you can still go for 2FA (there's a few two factor authentication plugins for PAM). But if you do that then make sure you also stick fail2ban in there as well.