0

I have fail2ban and logwatch set up. There are IP addresses that are banned > 20 times every day for trying to brute force (I assume) access the server.

I have added these IP addresses to the .htaccess file within the vhosts folder as well as within the root of the site folder.

e.g.
Order Allow,Deny
Deny from env=DenyAccess
Allow from all
SetEnvIf X-Forwarded-For "^xx\.xxx\.xx\.xx" DenyAccess

(real IP hidden)

The .htaccess config does not stop these access attempts (which I can understand if they are simply trying to ssh our IP address rather than trying to access the site in the browser). Is there anything else I can do to ensure they don't get in? Will they always show on the logwatch regardless of the .htaccess? I have disabled root log in.

0

I have just entered into /etc/hosts.deny the IP addresses I want to block

sshd: 123.456.789.10

And the offending IP addresses no longer show up on logwatch. This is manual but there are ways to do this automatically. One way is to use the 'recidive' function of fail2ban itself

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.