A host banned for an hour returns at the end of the hour and starts again, so the same address is banned twenty times a week and the short ban achieves nothing against it.
[recidive]
enabled = true
logpath = /var/log/fail2ban.log
banaction = %(banaction_allports)s
findtime = 1d
maxretry = 5
bantime = 1wIt reads fail2ban’s own log, so it bans whatever has been banned five times in a day regardless of which jail caught it — which is a much better signal than any single filter. Banning all ports rather than just the one is right here: something that has tripped five jails is not a mistyped password. The one thing to watch is that the ban list persists across restarts only if the database is enabled, which it is by default in recent versions and was not always.