fail2ban alternatives that don't eat RAM

Fail2ban is the Sendmail of intrusion prevention. Everyone runs it because everyone ran it, not because it's optimal.

For what it's worth, on a 512MB HostHatch instance I watched fail2ban eat 80MB resident just parsing logs. That's 15% of RAM to block IPs a simple nftables set could handle.

Lightweight alternatives I've tested:

• Sshguard — C, no dependencies, ~2MB RSS, handles ssh/dovecot/whatever via syslog
• nftables ipset + timer script — 0MB daemon overhead, parses journal yourself
• Crowdsec — heavier but shared blocklists, ymmv on lowend boxes

Sshguard won for my mail servers. Log parsing is solid, ban logic is conservative enough not to trap legitimate SMTP retries from greylisting. The nftables backend integrates cleanly.

Correcting a common misconception: fail2ban's python overhead isn't "negligible on modern systems." on low-end hosting, every MB counts toward OOM kills.

To be honest I ran sshguard for six months on a Contabo 256MB plan.

• RSS: 1.8MB
• CPU: negligible, parses syslog via tail
• Reliability: zero crashes, zero false positives on my ssh port

Switched to custom nftables set last quarter. 15-line bash script, systemd timer every 60s. As said, 0MB overhead. The daemon itself was the waste.

Script parses journalctl -u ssh --since "1 minute ago", extracts failed IPs, adds to

set blackhole4 { type ipv4_addr; flags timeout; timeout 1h; }

Dry humor: my "intrusion prevention system" now uses less RAM than the MOTD.

Run ZFS on it, ARC eats 8GB, and you still have room for fail2ban plus a mail server.

But on actual low-end VPS tiers? Agree with Pieter. My KnownHost 1GB box runs a RAIDZ1 pool across three attached volumes, ZFS already starved. Dropped fail2ban, gained stability.

Specs matter. List your RAM budget first, then pick the tool.

So I tried the sshguard approach on my gemütlich home Lab. The Kubernetes Node has only 2GB, so every Megabyte is a small Drama.

Na yes, the nftables Script from pieter_rtm works so well that I packaged it as a DaemonSet. No Container, just a HostPath Volume with the bash File and a CronJob. The Worker Node overhead is so minimal that I almost feel bad measuring it.

Compoundwordcreation: logparser-to-nftables-bridge. Very german. Very efficient.

Hey folks gonna be real with you

I ran sshguard on a InterServer 512MB box, super stoked about the "lightweight" hype. Then I misconfigured my maxretry and locked myself out of my own node. Whoops.

Admitting mistakes openly: that was on me, not sshguard. Fixed the config, added my home IP to whitelist, back in business.

But the custom nftables set? Gonna try that next. Zero overhead sounds wild.