If you run a public SSH server, you will see failed login attempts in your logs constantly. Fail2ban monitors those logs and adds firewall rules to block offending IPs.
Here is what you see in /var/log/auth.log from a machine that has been online for a few days:
Nov 20 06:30:43 serverName sshd[63467]: Address 91.191.166.95 maps to 91-191-166-95.netdirekt.com.tr
Nov 20 00:47:45 serverName sshd[24617]: Invalid user fluffy from 221.179.34.37
Nov 20 00:47:55 serverName sshd[24617]: Failed password for invalid user fluffy from 221.179.34.37
Install and configure:
apt-get install fail2ban
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Edit the .local file. A typical SSH jail:
[DEFAULT]
ignoreip = 127.0.0.1 192.168.1.0/24
bantime = 600
maxretry = 3
[ssh]
enabled = true
Check banned IPs:
iptables -L
iptables -L --line-numbers
Remove a specific ban:
iptables -D fail2ban-ssh
On modern systems, use fail2ban-client for an easier overview:
sudo fail2ban-client status sshd
Set it up once and it will quietly block thousands of attempts without you thinking about it.