If you are in a real production environment you shouldn't be opening up SSH to the world, most people that are accessing SSH have enough know how tunnel through

If you are in a real production environment you shouldn't be opening up SSH to the world, most people that are accessing SSH have enough know how tunnel through a VPN. So for most of my uses this is a non-issue. fail2web for me is used on Asterisk servers to watch HTTP auth and SIP. Most of the customers I work with have very strict corporate IT policies, they have to review every piece of hardware and most of the time I can only get an ATA approved. So I drop an ATA on their network with SIP/TLS and ZRTP and they setup the client. However, I don't want to make the assumption that their network is 100% safe, so fail2ban serves me well here. Also to your point of fail2ban being overloaded, this has never happened to me. I see scans/brute forces all the time add after five fails I usually block the small subnet, and the problem goes away. All of the solutions you posted are 100% a no go for the problems I am trying to solve.