The defaults in debian for fail2ban are too short, in my opinion, it's useful to turn the ssh, postfix and other daemons' fail2ban time up to 3000 seconds.
back
2 comments
I use recidive[1] jail to ban an IP if it tries again and again.
[1] https://github.com/fail2ban/fail2ban/blob/master/config/jail...
I've read that some scanners are now doing a few probes here and there and only give up on an IP address after a week or two of no response. I adapted my ssh scan blocking software (part of some custom syslog software I wrote just to play around with: https://github.com/spc476/syslogintr) to block for 31 days. I figure it couldn't hurt.