I've got a debian-machine running several services, like apache with http and https, jabber and an openssh server for administration. The ssh-server is not running on port 22. It's on something like port 62111. I secure the openssh with fail2ban. So whenever an attacker tries to connect to ssh on port 62111 he has got two tries before being banned for two day by fail2ban on port 62111.
I would like to start a (fake) SSH-Server on Port 22 and whenever someone tries to connect to that port he gets banned on all port by iptables forever or at least until i drop the iptables rule. Any legal SSH connection will not try to ssh to port 22, because every administrator knows the correct SSH-port.
The idea is that an attacker will try to attack port 22 first. Therefore he hasn't even got a chance to try to SSH to port 62111. I don't care about those cracker to see my website. So it's fine to block them on any port (including 80 and 443).
Any suggestion on how to do this?