Written 26 Aug 2026. This is a how-to, not a product card.

Slow down password guesses on SSH

After the firewall is on and key login is boring, you can let the computer briefly refuse an address that keeps guessing the password. Skip this on day one. Don't forward port 22.

SSH belongs on the house network. That is keep the computer on the house network. Don't forward port 22. On a house-only computer, this is optional polish, not a substitute for keeping SSH inside the house. It still helps if someone later opens the router by mistake, or if a phone on the house Wi-Fi keeps hammering a wrong password.

Skip until ufw works

If the simple firewall is not on yet, stop. Allow OpenSSH, then turn on ufw first. Prefer logging in with a key, then turning off password login once the key works, before this polish. If password SSH is still the only login and it is flaky, stop.

What this changes

fail2ban is software that watches the login log and briefly refuses an address that keeps guessing wrong. It reads the login log. After enough wrong guesses from one address, that address cannot try SSH for a short while. Your laptop key login still works. This is not a new firewall appliance. This is not a reason to open port 22 on the router.

Install

From your normal computer, SSH from the couch. Then update the package list:

sudo apt update

Install fail2ban:

sudo apt install fail2ban

On a Debian or Ubuntu computer from what OS to put on the computer, the stock sshd jail is enough for this note.

Turn it on and check

Turn it on so it starts now and after a reboot:

sudo systemctl enable --now fail2ban

Check the SSH jail:

sudo fail2ban-client status sshd

You should see the sshd jail active. If sshd is not listed yet, ask for the whole status:

sudo fail2ban-client status

Wait a minute and check again. Don't paste a long jail.local essay. Stock defaults are fine for this computer.

If you ban yourself

Use another device on the house network, or a screen and keyboard on the computer. Unban that address:

sudo fail2ban-client set sshd unbanip THAT-ADDRESS

Swap THAT-ADDRESS for the number of the laptop or phone that got locked out. SSH stays inside the house, as explained in keep the computer on the house network. Don't solve this by forwarding port 22.

What next

If weekly apt is boring, let the computer apply weekly fixes without you. The honest weekly look is still keep the computer updated. The boundary is still keep the computer on the house network. Skip a Protectli. Skip opening SSH to the internet.

Skip

• Skip this note on day one.
• Skip this note if ufw is not on.
• Skip this note if you still need password SSH from many devices and keep locking yourself out.
• Skip forwarding port 22 on the router.
• Skip a rack firewall.
• Skip fail2ban as an excuse to expose SSH.