I got fail2ban and logwatch running on my server. Each day I have a few IP:s that's been probing my server and also a few "Attempts to use known hacks", as it states in the daily mail.
I would like to block these IP:s using the knowledge of logwatch, since it apparently knows what "known hacks" are. By looking trough the apache access logs I don't quite understand what logwatch refers to.
As I said, fail2ban is installed and uses UFW as block action. Is there somehow possible to block these IP:s that are recognized by logwatch? fail2ban doesn't seem to block them.
Thanks, Daniel
0 Answers