In general I agree with the recommendations here. Though it may be slightly over prescriptive in what security approaches universally make sense (e.g. privilege

In general I agree with the recommendations here. Though it may be slightly over prescriptive in what security approaches universally make sense (e.g. privileged ports) it carries a very valid conclusion about the applicability of Fail2Ban. The only time I almost used Fail2Ban was with a personal "guaranteed to work from wherever and whatever I'm on" jumphost which ran SSH on 22 and 443. 443 because, like the post says, outbound filter compatibility (Fun note: to listen on multiple ports simultaneously you can literally just include multiple "Port xyz" lines in your sshd_config). Ultimately I decided for this use case it made more sense to just let bad attempts to fail silently by changing the logging config. If I was ever in a situation I felt I needed the failed attempts logged I'm not sure I could simultaneously justify username+password login on a public host.