A host banned for an hour returns at the end of the hour and starts again, so the same address is banned twenty times a week and the short ban achieves nothing.
[recidive]
enabled = true
logpath = /var/log/fail2ban.log
banaction = %(banaction_allports)s
findtime = 1d
maxretry = 5
bantime = 1wIt reads fail2ban’s own log, so it bans whatever has tripped five jails in a day regardless of which — a much better signal than any single filter. Banning all ports rather than one is right here: something caught five times is not a mistyped password. The ban list survives a restart only if the persistent database is enabled, which is the default in recent versions and was not always.