Install: sudo apt install fail2ban. Config lives in /etc/fail2ban/jail.local (never edit jail.conf directly — it gets overwritten on updates).
Basic SSH jail: 5 failures within 10 minutes triggers a 1 hour ban. Check status with sudo fail2ban-client status sshd.
Locked yourself out from a flaky connection? Unban from the console with sudo fail2ban-client set sshd unbanip <your-ip>.