And/or just reconnect through another server or VPN.

Yes, but my aim is more to create a molasses pit to slow down the log fill rate rather than to ban anyone for long. If I manage to lock myself out I just get up and get a drink of water.

Using a short ban time keeps the load of running fail2ban to a minimum. I at one point was banning the kiddies/bots for a week and 40% of the server load was chewed up just running fail2ban.

Fail2ban has issues when you have a lot of IPs blocked in memory.

The solution I came up with to this problem is to use a custom ban action that adds an IP to the blocked ipset list with a given TTL, but set fail2ban to think that the IP has to be only banned for 5 seconds or so.

The result is that ipset purges the IP from the list after the TTL expires, but fail2bans working set is a 5 second rolling windows of blocked IPs.

This works great and it's being used in production for a couple of years.

Sounds like a great solution. Have you written about this in any detail?

  > so that my logs don’t fill with a zillion pointless attempts

What about moving SSH to a different port?

I do this, but it is the port scanning that I am tracking. It is hard to find your ssh port if you get banned port scanning.

When your server is down and you need to ssh into an arbitrary 5 minute wait is going to frustrate you.

You don't really need fail2ban at all. Just don't log failed password attempts. Key access only, no one is going to get in.

I am not worried about people getting in via ssh, I am worried about some zero-day on some other service.

Do you really need the space or is it just some anxiety issue / ocd issue?

If a sufficiently interested botnet discovers your SSH server, it'll hammer your server with 10's of connections a second, from many different IPs. That doesn't take up enough bandwidth to be noticeable, but it can fill up the disk, when you're least expecting, which can cause all sorts of trouble.

Of course there are ways to deal with it, but that's just extra work.

Fill up a terabyte? Doubt it, especially since logs are compressed nightly.

Are you serious? There are others https://riskemy.com/free-cloud-vulnerability-scanning-tools/

What does your comment have to do with mine? You seriously registered an account just to reply to me? What's going on?

.