Written 26 Aug 2026. This is a how-to, not a product card. Buy links are not tagged yet.

Slow down password guesses on SSH

After the firewall is on and key login is boring, you can let the leftover box briefly refuse an address that keeps guessing the leftover-box password. Skip this on day one. Do not forward port 22.

SSH belongs on the house network. That is keep the leftover box on the house network. Do not forward port 22. On a house-only leftover box, this is optional polish, not a substitute for keeping SSH inside the house. It still helps if someone later opens the router by mistake, or if a phone on the house Wi-Fi keeps hammering a wrong password.

Skip until ufw works

If the simple firewall is not on yet, stop. Allow OpenSSH, then turn on ufw first. Prefer logging in with a key, then turning off leftover-box password login once the key works, before this polish. If password SSH is still the only login and it is flaky, stop.

What this changes

fail2ban is software that watches the login log and briefly refuses an address that keeps guessing wrong. It reads the leftover-box login log. After enough wrong guesses from one address, that address cannot try SSH for a short while. Your laptop key login still works. This is not a new firewall appliance. This is not a reason to open port 22 on the router.

Install

From your normal computer, SSH from the couch. Then update the package list:

sudo apt update

Install fail2ban:

sudo apt install fail2ban

On a Debian or Ubuntu leftover box from what OS to put on the leftover box, the stock sshd jail is enough for this note.

Turn it on and check

Turn it on so it starts now and after a reboot:

sudo systemctl enable --now fail2ban

Check the SSH jail:

sudo fail2ban-client status sshd

You should see the sshd jail active. If sshd is not listed yet, ask for the whole status:

sudo fail2ban-client status

Wait a minute and check again. Do not paste a long jail.local essay. Stock defaults are fine for a first leftover box.

If you ban yourself

Use another device on the house network, or a screen and keyboard on the leftover box. Unban that address:

sudo fail2ban-client set sshd unbanip THAT-ADDRESS

Swap THAT-ADDRESS for the number of the laptop or phone that got locked out. SSH stays inside the house, as explained in keep the leftover box on the house network. Do not solve this by forwarding port 22.

What next

If weekly apt is boring, let the leftover box apply weekly fixes without you. The honest weekly look is still keep the leftover box updated. The boundary is still keep the leftover box on the house network. Skip a Protectli. Skip opening SSH to the internet.

Skip

• Skip this note on day one.
• Skip this note if ufw is not on.
• Skip this note if you still need password SSH from many devices and keep locking yourself out.
• Skip forwarding port 22 on the router.
• Skip a rack firewall.
• Skip fail2ban as an excuse to expose SSH.