fail2ban is such a great software and flexible. I'm using it to protect ssh and nginx with specific rules to block php and cgi requests (since my site is purely static).
Yep fail2ban is indeed a great alternative way to tackle the issue. Although fail2ban works by blocking specific IPs. If the brute force specifies a new IP for each attempt, I'm not sure how that will be handled by fail2ban
If we want to prevent failed login attempts, dont we have to make all logins succeed?
I'm sorry I didn't quite understand that point. All logins are going to fail unless we talk to the REST server that's controlling the firewalld rules.