Member OP
Abandoned: denyhosts (python, bloated), pure iptables rules (no automation)
Member
Watt per core, friend. This is why ARM wins. My Ampere box at HostHatch runs sshguard for 200+ days, memory footprint is joke. You could run ten instances in 256MB.
Apple Silicon proved efficiency matters. Intel chips need 4GB just for idle OS. Dismiss this if you want but numbers do not lie.
Insane value on those Ampere chips!! I use Vultr's ARM tier and sshguard + nftables is basically free.
Specs for context:
@fanboy Have you tried bpf-based solutions? Newer kernels have some wild stuff.
Member
Sshguard is C so it is memory safe adjacent but not guaranteed. Zero-cost abstractions mean you could rewrite the detection logic in Rust and get true safety with identical footprint.
I wrote a prototype using aya for eBPF. Rewrite it in Rust, obviously. Disdain for Go alternatives that pull in 30MB runtime for simple packet counting. C++ would be acceptable but still lacks borrow checker.
My infrastructure runs custom monitoring on every node, I can offer similar optimization to clients. Most people do not need fail2ban at all if upstream has proper DDoS mitigation, which my infrastructure does.
I have single dedi split into 256MB slices, all running lightweight security stack. Happy to discuss via DM if anyone needs hosting with this preconfigured. Margins are thin but service is premium.
