I use fail2ban to prevent brute force attacks on my production servers. Fail2ban bans an ip after 5 authentication failure and unbans it after 1 hour with my own configuration. I wonder that what is the optimum ban duration or do i really need to unban it again? Is banning an ip permanently the best solution?
There is no general rule for the optimum time of a ban, it depends on a lot of factors including
This is of course also true to decide if you need to unban at all - if very few IP addresses might legitimately connect to your services, banning attackers (semi) permanently might not be a bad idea, but in other cases, this will create more problems than doing good.
Edit regarding your comment:
The most important protection for root accounts is to
This also helps to protect you against the distributed type of brute-force attack you can see today where you are slowly attacked by a great number of bot net machines with each machine trying only a very small number of passwords, thus not triggering stuff like
2nd edit, regarding 2nd comment:
We are clearly in the "it depends" territory here. An example from my environments:
The thing is that the 24h ban works only marginally better, if at all (*), but machine 2 is much better protected nevertheless due to the restriction to non-root key based logins.
(*) This is my impression and is not founded in any real statistical analysis of log files.
It's not good behavior to banning IP forever, because of any harmless connection takes that IP in any time.
I generally prefer a day for optimal ban time span. This approach provides protection for taking attacks from same IP for a day. If you still get attacks from same IP You can ban it for a month manually.