Ask HN: Alternatives to Fail2ban?

#1

Post by jech » Fri, Aug 28, 2026, 12:48 PM UTC

I'm administering a small number of Linux servers that run an ssh server exposed to the Internet. I usually connect using a cryptographic key, but I still allow password authentication in case of trouble (perhaps I'm being overly cautious). I've been using fail2ban with good results, but I'm annoyed at having to install a Python interpreter on every server.

Is there an alternative to fail2ban that is just a single binary? It doesn't need to have all of the features of fail2ban, blocking dictionary attacks against ssh is all I need.

Re: Ask HN: Alternatives to Fail2ban?

#2

Post by Bender » Fri, Aug 28, 2026, 12:50 PM UTC

This isn't for everyone and it will block old ssh libraries (libssh, go ssh, etc...), windows and others but if you only have OpenSSH 10+ and that's all you connect with then this method [1] has worked well for me. It gets botters to exclude my nodes that expose SSH on purpose (such as public anonymous SFTP). If trying it out test from an out of band console first.

Edit: I should add, there will still be some syslog entries, but that can be filtered out using regex filters in rsyslog one so desired. Only do so once it is confirmed most of the brute forcing has stopped.

[1] - https://nochan.net/b/Internet-Crap/20260108-Confuse-Some-SSH...

Re: Ask HN: Alternatives to Fail2ban?

#3

Post by atmosx » Fri, Aug 28, 2026, 4:43 PM UTC

[dead]

Re: Ask HN: Alternatives to Fail2ban?

#4

Post by laruss5 » Fri, Aug 28, 2026, 6:56 PM UTC

sshguard is exactly this - single C binary, no interpreter needed. It tails your logs (journalctl/syslog) and bans offenders via iptables/nftables/pf. No Python, no dependencies beyond the firewall backend: https://www.sshguard.net/

Re: Ask HN: Alternatives to Fail2ban?

#5

Post by jech » Fri, Aug 28, 2026, 8:12 PM UTC

laruss5 wrote: post #4

sshguard is exactly this - single C binary, no interpreter needed. It tails your logs (journalctl/syslog) and bans offenders via iptables/nftables/pf. No Python, no dependencies beyond the firewall backend: https://www.sshguard.net/

> sshguard is exactly this

Thanks. I've replaced fail2ban with sshguard on one machine, we'll see how it goes.

Re: Ask HN: Alternatives to Fail2ban?

#6

Post by jech » Fri, Aug 28, 2026, 9:25 PM UTC

laruss5 wrote: post #4

sshguard is exactly this - single C binary, no interpreter needed. It tails your logs (journalctl/syslog) and bans offenders via iptables/nftables/pf. No Python, no dependencies beyond the firewall backend: https://www.sshguard.net/

One hour later, it appears that sshguard is working fine. It's structured as a dozen binaries or so, but it has no dependencies. I haven't done any CPU usage measurements, but I haven't seen it appear in top's output.

Re: Ask HN: Alternatives to Fail2ban?

#7

Post by f30e3dfed1c9 » Sat, Aug 29, 2026, 2:52 AM UTC

> an ssh server exposed to the Internet. I... still allow password authentication in case of trouble

You gotta get over that eventually and really, the sooner the better.

Re: Ask HN: Alternatives to Fail2ban?

#8

Post by BlueRoguesDevel » Sat, Aug 29, 2026, 2:27 PM UTC

laruss5 wrote: post #4

sshguard is exactly this - single C binary, no interpreter needed. It tails your logs (journalctl/syslog) and bans offenders via iptables/nftables/pf. No Python, no dependencies beyond the firewall backend: https://www.sshguard.net/

How did I miss this? I have a stack begging to try this out, and for the same reasons as OP. Thank you.