anti-bruteforcing daemon that works on connection attempts to services such as SSH
fail2ban is a utility that can be used to help enforce the security of services like SSH daemons. Essentially, fail2ban monitors e.g. incoming SSH connections and if there are too many from a certain IP address, fail2ban will start dropping connection requests from that IP. This is useful because oftentimes, an attacker will repeatedly connect to an SSH daemon and attempt to guess the password by simply trying every password possible (this is called bruteforcing). fail2ban makes this much harder, because a potential attacker will only have a limited number of guesses before his or her IP address is banned.
fail2ban can work on a number of services. The most common service to use fail2ban for is SSH, but it can also work on other network daemons, like Apache.
Internally, fail2ban relies on iptables to look at network traffic. fail2ban can usually be installed with the fail2ban package on major distributions.
