I currently block all ssh logins using root. But I wanted to go the extra mile and block the ip address of the client who tried to login as root. I currently have denyhosts and fail2ban setup and working, can I use denyhosts and or fail2ban to block the ip addresses of those who try to login as root?
Depending on your distribution, edit
Change the parameters as required. It won't specifically block root, but every attempt that fails. Be careful with
I wouldn't try to block the IP forever as a lot of attempts come from dynamic IPs which could block some legitim users at a later point of time.
(Some distributions offer a jail.options file for your modifications. This is the preferred place to put your changes to as it shouldn't be affected by updates overwriting the conf.)
How did you block ssh logins? /bin/false or the sshd_config DenyUsers option?
I can't think of an answer out of my head, but IIRC denyhosts parses the log file, so just see if you get a failed entry in the log file after some one tries to log in to root with it disabled