Is leaving SSH open to the internet bad practice even with Fail2ban?

Fail2ban helps, but it does not make an exposed SSH server safe. It blocks addresses after a number of failed logins, which cuts password guessing and log noise, but attackers spread their attempts across many addresses, and it does nothing against a flaw in the SSH server itself or a stolen private key. The real protection is in the configuration: key-based logins only, password and root logins disabled, OpenSSH kept up to date, and access limited to known source addresses or placed behind a VPN or bastion host. With those in place, Fail2ban is a reasonable extra layer. Review regularly which servers expose SSH at all; the forgotten ones are the risk. NetSenX sees connections to monitored SSH servers and flags repeated login attempts, scanning and unusual sessions, on every plan. It does not block addresses itself; Fail2ban or the firewall does that.

← All 40 questions on Remote work and exposed servicesAll topics