One-line SSH bruteforce shield, no fail2ban needed

One-line SSH bruteforce shield, no fail2ban needed
Don't have fail2ban set up yet on a fresh box? ufw has built-in rate limiting.
— ufw limit 22/tcp
That blocks any IP making 6+ connections in 30 seconds, baked into the firewall layer. It's not a replacement for fail2ban on a real box, but on a throwaway it stops the dumb scanners in one command. Combine with a non-22 port and key-only auth. 10 seconds of work, instant noise reduction. Try it tonight.