I have fail2ban and logwatch set up. There are IP addresses that are banned > 20 times every day for trying to brute force (I assume) access the server.
I have added these IP addresses to the .htaccess file within the vhosts folder as well as within the root of the site folder.
e.g. Order Allow,Deny Deny from env=DenyAccess Allow from all SetEnvIf X-Forwarded-For "^xx\.xxx\.xx\.xx" DenyAccess
(real IP hidden)
The .htaccess config does not stop these access attempts (which I can understand if they are simply trying to ssh our IP address rather than trying to access the site in the browser). Is there anything else I can do to ensure they don't get in? Will they always show on the logwatch regardless of the .htaccess? I have disabled root log in.