Skip to main content

Using Fail2Ban to prevent/limit bot attack to wordpress wp-login.php [Centos7]

 


This article demonstrates how to use Fail2Ban to block IP addresses attempting to compromise a WordPress instance via the login process. In this walk-through, we’re using CentOS 7 and FirewallD. Just be aware that if you’re using a caching service like CloudFlare, you can’t use this method because you’ll block the cache and not the source of the traffic.

Install Fail2Ban:

yum install fail2ban fail2ban-firewalld

Edit the “/etc/fail2ban/jail.conf” file. Add the following chunk to the bottom of that file. Notice the log file to be monitored. You can either specify it exactly or use a wild-card:

[apache-wordpress-login]
enabled = true
action = iptables-multiport[name=wordpress, port="http,https", protocol=tcp]
port = http,https
filter = apache-wordpress-login
logpath = /var/log/httpd/*_log
bantime = 36000
findtime = 600
maxretry = 1

And modify the “ignoreip” line to include the IP that you’re coming from (so you don’t get kicked out):

ignoreip = 127.0.0.1/8 ::1 my.ip.address

And set the following to ensure FirewallD is assumed:

#banaction = iptables-multiport
banaction = firewallcmd-ipset

Create the file “/etc/fail2ban/filter.d/apache-wordpress-login.conf” and enter the following content:

[Definition]
mode = normal
failregex = ^<HOST> -.*"POST.*wp-login.php

#Note: If you want to add more filter you can use like below:
[Definition]
mode = normal
failregex = ^<HOST> -.*"POST.*wp-login.php
            ^<HOST> -.*"POST.*xmlrpc.php
            ......................

Enable and Start Fail2Ban:

systemctl enable fail2ban
systemctl start fail2ban

Check the status of Fail2Ban blocking hosts:

fail2ban-client status apache-wordpress-login
firewall-cmd --list-all
iptables -L -n
tail -f /var/log/fail2ban.log


Post Credit: https://www.agix.com.au/using-fail2ban-to-protect-wordpress-logins-centos/

Comments

Post a Comment

Popular posts from this blog

Setup a Multi-Protocol VPN Server Using SoftEther on Centos7

  Introduction This article explains how to install and configure a multi-protocol VPN server using the SoftEther package. We enable and configure OpenVPN and L2TP over IPSec and SSTP VPN Servers on Linux. What is SoftEther SoftEther VPN is one of the world’s most powerful and easy-to-use multi-protocol VPN software, made by the good folks at the University of Tsukuba, Japan. It runs on Windows, Linux, Mac, FreeBSD and Solaris and is freeware and open-source. You can use SoftEther for any personal or commercial use free of charge. Step 1: Create a Virtual Server First, you need to create a DigitalOcean Droplet. As mentioned in SoftEther’s website, SoftEther will work on almost every Linux distro with kernel v2.4 or above,; however it’s recommended to choose one of these distributions: CentOS, Fedora, or Red Hat Enterprise Linux. Personally I have tried it on Ubuntu, CentOS and Fedora, both 32 and 64 bit editions, and it has worked perfectly. Step 2: Update your Server Software Usin...
Post a Comment
Read more

Setting Up MariaDB MaxScale Binlog Proxy for backup/failover

  Setting Up MariaDB MaxScale Binlog Proxy MariaDB MaxScale Binlog Server acts as an intermediate master replication proxy. By storing binary logs and serving them to replicas, it enables scalable replication architectures, reduces primary database load, and accelerates disaster recovery. Step 1: Install MariaDB MaxScale Install MaxScale using the package manager appropriate for your Linux distribution, then verify the installation. On Ubuntu/Debian: sudo apt-get update sudo apt-get install maxscale On RHEL/CentOS: sudo yum install maxscale Verify the installation: maxscale --version Step 2: Configure MaxScale as a Binlog Proxy Open MaxScale's core configuration file to establish the routing properties and specify your database backend configuration. sudo nano /etc/maxscale.cnf Add the following configurations for the moni...
Post a Comment
Read more

Deploying a laravel app using nginx alias

  server { listen 80; server_name subdomian.example.com; root /var/www/mainapp/; add_header X-Frame-Options "SAMEORIGIN"; add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff"; index index.html index.htm index.php; charset utf-8; error_log /var/log/nginx/error.log warn; location / { try_files $uri $uri/ /index.php?$query_string; } location = /favicon.ico { access_log off; log_not_found off; } location = /robots.txt { access_log off; log_not_found off; } error_page 404 /index.php; location ~ \.php$ { fastcgi_pass unix:/var/run/php/php8.1-fpm.sock; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name; include fastcgi_params; } location /laravelapp { alias /var/www/mainapp/laravelapp/public; index index.php index.html in...
Post a Comment
Read more