Fail2Ban filter for sslh demultiplexed ssh - Doesn't (and cannot) detect auth errors, but many connection attempts from the same origin is reason enough to block - Works on Arch Linux

jail.local

[sslh-ssh]
enabled = true
filter = sslh-ssh
maxretry = 10
backend = systemd
bantime = 1w
action = firewallcmd-rich-rules[name=sslh,port="443"]

sslh-ssh.conf

[INCLUDES]

[DEFAULT]

[Definition]

failregex = ^.+ sslh\-select\[.+\]: ssh:connection from <HOST>:.+ to .+ forwarded from .+ to .+:ssh\s*$

journalmatch = _SYSTEMD_UNIT=sslh-select.service