Get Eiciel.
Eiciel watches one Linux server for SSH brute-force attacks and blocks the attacking IP address automatically, over both IPv4 and IPv6.
What you get
SSH attack detection
Counts failed logins per address, for real and unknown usernames, over IPv4 and IPv6.
Automatic IP blocking
Bans the offending address with nftables. Defaults: 5 failures in 60 seconds, banned for 1 hour. All three are adjustable.
Your admin addresses are safe
List your own IPs or ranges once. They are never banned or rate-limited.
Per-address connection limit
Stops one host from flooding SSH and locking everyone else out.
Local event log
Every ban is written with time, address and reason to
/var/log/eiciel-events.log.Dashboard
A desktop app that lists the addresses currently blocked and your recent events.