Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured. Out of the box Fail2Ban comes with filters for various services (apache, courier, ssh, etc).
Would be a great addition. Natively installing it is pretty damn difficult, honestly, but I have it running and it works great. Would be nice not to have to configure so much out of the box, although it is python-based, so not sure if that disqualifies this from being added.
Platform:
asuswrt-merlin (380.65) / Asus RT-AC68U / Python3
Linux 2.6.36.4brcmarm #2 SMP PREEMPT Fri Feb 3 00:27:49 EST 2017 armv7l ASUSWRT-Merlin
Side-note: would love to see an openssh-server-with-pam package (installing openssl and openssh manually is not terribly easy).
Package: fail2ban
Platform:
Linux 2.6.36.4brcmarm #2 SMP PREEMPT Fri Feb 3 00:27:49 EST 2017 armv7l ASUSWRT-Merlin
Side-note: would love to see an openssh-server-with-pam package (installing openssl and openssh manually is not terribly easy).