I have fail2ban and logwatch set up. There are IP addresses that are banned > 20 times every day for trying to brute force (I assume) access the server. I have added these IP addresses to the .htaccess file within the vhosts folder as well as within the root of the site folder. e.g.Order Allow,DenyDeny from env=DenyAccessAllow from allSetEnvIf X-Forwarded-For ^xx\.xxx\.xx\.xx DenyAccess(real IP hidden)The .htaccess config does not stop these access attempts (which I can understand if they are simply trying to ssh our IP address rather than trying to access the site in the browser). Is there anything else I can do to ensure they don't get in? Will they always show on the logwatch regardless of the .htaccess? I have disabled root log in.
fail2ban logs IP address trying to access server, enough?
htaccess;ip address;block
I have just entered into /etc/hosts.deny the IP addresses I want to blocksshd: 123.456.789.10And the offending IP addresses no longer show up on logwatch.This is manual but there are ways to do this automatically. One way is to use the 'recidive' function of fail2ban itself