Once upon a time, Jason L Tibbitts III tibbs@math.uh.edu said:
In general, fail2ban is simply a far better choice. The primary feature it appears to lack is the ability to synchronize lists of blocked hosts between machines. (And I could be quite wrong about that.)
Just as an FYI: I'm not sure fail2ban supports that out of the box, but it is easy enough to:
- set fail2ban to use syslog - replicate the fail2ban "Ban" messages between hosts - configure a fail2ban filter to match the Ban messages - configure a fail2ban jail to react to 1 hit on the Ban messages