I have already blocked logging in as root with ssh, so I know that any attempt to do that is malicious. I know they wont succeed (sshd wont allow it), but I'd nevertheless would like to ban the IP in question immediately. How would I do that?
I'm running Gentoo Linux, and have fail2ban already running. I don't want to ban everyone for one failed logging attempt, so simply setting fail2ban attempt to 1 is not an option. Root is the only account I'd wish to apply this immediate ban.