I’m not a fan of fail2ban. A simple but quite effective approach would be permitting remote login only from certain IP ranges. I know that it looks like a bad t

I’m not a fan of fail2ban. A simple but quite effective approach would be permitting remote login only from certain IP ranges. I know that it looks like a bad trade for self hosted web apps, but it is very easy to setup on many cloud providers. Also I normally set up a jump host first - a smallest instance that only runs ssh and everything else would not open ssh port to the outside at all. One nice effect is having to search just one auth log if something about ssh looks concerning.