>> I know the usual advice then is to reduce ban time and just not have permabanning, but that seems to kind of defeat the purpose. > The purpose is to make ra

>> I know the usual advice then is to reduce ban time and just not have permabanning, but that seems to kind of defeat the purpose. > The purpose is to make random password attempts even more impractical. With even fairly lax fail2ban rules, it'll take multiple lifetimes to find a password made up of just two common use english words. True, but the other reason to use such a measure is layered security. For instance I systematically disable all password only access, which kind of makes fail2ban seem a little pointless, but if there were to be some obscure bug in PAM, or SSH, or more likely a misconfiguration, then there is another layer that makes it more difficult.