A server on a public IP receives thousands of password attempts a day, and fail2ban reduces the rate rather than the risk. Turning the mechanism off removes it.…
Free certificates went GA this month. Automating issuance and renewal, the rate limits that catch staging first, and the monitoring that has to outlive the automation.
A week-old server already sees thousands of login attempts a day. Key-only SSH, a firewall, fail2ban and monit — and the recovery plan for locking yourself out.