I agree that almost all use cases of fail2ban are little more than feel-good exercises. Failed login attempts (the noise) are not where bad things happen. What

I agree that almost all use cases of fail2ban are little more than feel-good exercises. Failed login attempts (the noise) are not where bad things happen. What we should be concerned with is if the attempt succeeds but is not from a legitimate user. fail2ban is no help there. Having said that it might be a decent way to collect IPs. At one point I was distributing the collected IPs from VMs and blocking them for the whole network. fail2ban does provide mechanisms to do this.