With fail2ban
They do different jobs. Run both.
| fail2ban | sshsentry | |
|---|---|---|
| Blocks IPs | Yes | No (detection only) |
| Tells you a login succeeded after failures | No | Yes (HIGH / CRITICAL) |
| New user, new SSH key, new IP/country | No | Yes |
| Plain-English alerts, daily digest | No | Yes |
A sensible small-server setup: key-only SSH (PasswordAuthentication no), fail2ban's sshd jail, a firewall, and sshsentry to tell you when something gets past them or changes underneath you.
Both read the same auth log and don't interfere with each other. fail2ban bans may mean you see fewer brute-force alerts, which is fine: the alerts that remain are the interesting ones.