Can sshd block IPs with failed attempts or is a tool like denyhosts or fail2ban necessary?

Question

I am only indirectly familiar with denyhosts (and only just discovered fail2ban) and they certainly seem like worthwhile tools. However, after looking through the options for sshd_config I am trying to determine if there may be some similar functionality within sshd itself.

In particular, MaxAuthTries seems relevant. From the man page for sshd_config:

MaxAuthTries
          Specifies the maximum number of authentication attempts  permit‐
          ted  per  connection.   Once the number of failures reaches half
          this value, additional failures are logged.  The default is 6.

However, this seems less like it will block the IP and more like it will simply close the connection which wouldn't do much for security if it allows further connections and thus authorization attempts. That said, I'd be surprised to find that it doesn't support some level of IP blocking, even if it's level of logging or configuration isn't as desirable as some of the other tools.

I have password authentication turned off and I'm considering changing my ssh port, if only to avoid completely blind attempts to connect, so I'm not super concerned about brute-force attacks. But blocking the IPs from potential attacks seems like it might be a nice additional level of security.

Is there a way to set up this up without a secondary tool or, if not, is there a reason this functionality isn't included?

Answer 1

SSH can manage itself as a service, so shutting down a connection after X number of attempts is within its expected domain of control. Blocking an IP is a much bigger task, which is why things like fail2ban exist. SSH logs the failures, fail2ban reads those logs and then kicks off remediation, like blocking the IP at the firewall.

In short, SSH cannot do what you want it to do because that functionality is handled by other layers of the system.