#linuxstr if see anyone try2bang critical service port - enable #fail2ban 
sudo tail -n 500 /var/log/auth.log | grep rhost=
/etc/fail2ban/jail.local
findtime  = 10m
bantime  = 1d
tune accordingly