jail (fail2ban)
Security
One named section of /etc/fail2ban/jail.local — [sshd] — tying three things together: the source to read, the filter that recognises a failure in it, and the ban applied when maxretry matches land inside findtime. All three have to hold. And a jail is enabled long before it is proven. On an exposed server, sudo fail2ban-client status sshd printing Total failed: 0 is not good news: it is a jail reading somewhere nothing is written. Pointed at /var/log/auth.log while sshd's failures go to the systemd journal, it looks line for line like a machine nobody is attacking. Count them yourself: sudo journalctl -u ssh --since "1 hour ago" | grep -i failed. If the failures are there, the jail needs backend = systemd.