_vOv_

If they can restore from backups, then there’s no need to pay the ransom in the first place… Ransomware is designed to silently corrupt your backups.

This. Kamala is a very weak candidate with no real platform of her own.

Way too expensive for a service that will soon be irrelevant

And don't forget you're using some of those precious CPU cycles to parse the auth logs, with python no less :-)

You can ship the log somewhere else, do the fail2ban there and perform the block action in another place up the stack.

It's called PXE boot.

You need a server to host the ISO (via http/ftp/tftp or whatever you prefer) and a DHCP server that will distribute the ISO URI to the client.

Configure the client to boot from the network in the bios and put it in the same LAN as the dhcp server.

That's the gist of it.

So what's the min limit required to make it run?