folekaule

Fail2ban is just another tool in your toolbox. Defense in depth, as others mentioned.

Fail2ban is primarily a tool to prevent brute force attacks, especially useful for services that don’t do their own throttling. For example I usually put ssh in fail2ban, but if Authelia’s built-in protection is good enough, then use that.

Outside ssh, anything that could be used to brute force credentials should be in fail2ban if they’re exposed: web sites with simple auth, mail, etc.

I only know this because of Max Miller’s Tasting History.