Configuring and Enabling fail2ban to mitigate Wordpress authentication theft with Debian 12

Thomas Blevins — Sat, 08 Nov 2025 21:29:36 +0000

We've recently run into a problem with our Wordpress site occasionally getting bombarded with login requests. To safeguard against this, we have implemented fail2ban on our Linux Machine to rate limit these requests.

Nginx Considerations

I am using fail2ban against Nginx access logs, and I've seen multiple times a recommendation to utilize Nginx's built-in rate-limiting limit-req (Rate Limiting with Nginx), and their zone idea seems to be what I'm doing when looking for specific requests.

I'm instead implementing fail2ban on its own, and just reading the access logs.

What is fail2ban?

Fail2ban reactively scans log files for requests matching a filter (known as a fail) that (over a findtime duration) break the maxretry limit. If this happens, it locks them in jail for a bantime, stopping further requests.

Installing fail2ban

sudo apt update && sudo apt upgrade
sudo apt install fail2ban

Ensure the package is installed correctly:

fail2ban-client --version

Configuring fail2ban

Copy the default files into files that you can safely customize, without risk of overwriting them with a package update.

cp /etc/fail2ban/fail2ban.conf /etc/fail2ban/fail2ban.local
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Configuring the Filter

/etc/fail2ban/filter.d/wordpress-login.conf

[Definition]

# Match any access log line that starts with an IP address and attempts to access the wp-login via POST
# If we do want to limit xml access
#           ^<HOST> .*"(POST) /xmlrpc\.php.*"
# If we do want to limit access
#           ^<HOST> .*"(GET|POST) /wp-admin/.*"
failregex = ^<HOST> .*"(POST) /wp-login\.php.*"

# If we do want to limit access, don't look for asset requests
# ignoreregex = ^<HOST> .*"(GET|POST) /wp-admin/(images|js|css)/.*"
ignoreregex =

Configuring the Jail

/etc/fail2ban/jail.local

[wordpress-login]
enabled = true
filter = wordpress-login
port = http,https
logpath = /var/log/nginx/*.access.log
action = iptables-multiport[name=http, port="http,https", protocol=tcp]
maxretry = 10
findtime = 60
bantime = 3600

The logpath is utilizing a wildcard to scan all site access logs.
The action is specifying that we will use the iptables of the firewall to restrict the requests.

Testing fail2ban

Before booting this up, you can test your individual log files (I believe wildcard is not supported) to see if your filter is reading the "failures" correctly.

fail2ban-regex /var/log/nginx/my.access.log /etc/fail2ban/filter.d/wordpress-login.conf --print-all-matched

Though, keep in mind you'll have to have logs that will match this filter regex to see anything here.

Starting and Stopping fail2ban

To Start:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

To Stop:

sudo systemctl disable fail2ban
sudo systemctl stop fail2ban

Monitoring fail2ban jails

To see how a specific jail is faring:

fail2ban-client status wordpress-login

and you'll see something like:

Status for the jail: wordpress-login
|- Filter
|  |- Currently failed: 156
|  |- Total failed:     101134
|  `- File list:        /var/log/nginx/my.access.log ...
`- Actions
   |- Currently banned: 0
   |- Total banned:     1145
   `- Banned IP list:

Extra

Also check out the default sshd jail, all you have to do is enable it.

Resources

Creating thumbnails for multi-page Pdfs in Carrierwave 2.2.3 and Rails 7

Thomas Blevins — Fri, 09 Jun 2023 19:16:14 +0000

Prerequisites:

Have set up Carrierwave to upload files
Know what version :thumb does
Have imagemagick and ghostscript installed on the host machine.

Please review this Carrierwave Uploader as the final solution. The documentation should be worthy enough to explain what's going on.

class VersionUploader < CarrierWave::Uploader::Base
  include CarrierWave::MiniMagick
  include CarrierWave::RMagick
  storage :fog

  # @doc Specifies the position on remote hosting to save the file
  def store_dir = "shared/system/#{klass}/#{attachment}/#{id_partition}/#{style}/"

  # @doc Returns the model class name, camel_case and pluralized.
  # @example 
  #   irb(main):038:0> MyModel.first.file.file.klass
  #   => "my_models"
  def klass = model.class.name.underscore.pluralize

  # @doc Specifies the uploader's association name that is mounted on the model.  In the model `MyModel.rb`, we mount an uploader called VersionUploader, and we call that mount `file`.  This is considered the `attachment`
  # @example
  #   irb(main):039:0> MyModel.first.file.file.attachment
  #   => "files"
  def attachment = mounted_as.to_s.downcase.pluralize

  # @doc Creates a section of the final path partitioned by the id's of the model
  # @note
  #   These appear to be the id of the model, with a weird operation done to them.
  #   I sourced this code from the paperclip compatibility source code of Carrierwave's github as in my situation, I was converting from Paperclip to Carrierwave
  def id_partition = ("%09d" % model.id).scan(/.{3}/).join("/")

  # @doc Specifies the style of file for storage directory purposes
  def style = :original

  # @doc Returns the first page of a file
  version :thumb do
    process :to_array
    process :front
    process convert: "jpg"
    def full_filename(filename = model.file.filename) = "#{filename.split(".").first}.jpg"
    def style = :thumb
  end

  private

  # @doc Utilizes minimagick to split the uploading file from it's temporary path into an array
  # @note This code was sourced from https://github.com/janko/image_processing/wiki/Splitting-a-PDF-into-multiple-images, though I've made a few edits
  def to_array
    MiniMagick::Image.new(path).pages.count.times.map{ |page_number|
      ImageProcessing::MiniMagick
        .source(path)
        .convert("jpg")
        .colorspace("RGB")
        .loader(page: page_number).call
    }.first
  end

  # @doc Used in conjunction with `to_array` to return the first page of the array of pages
  # @note This utilizes the module CarrierWave::RMagick in some way...
  def front
    manipulate! do |frame, index|
      frame if index.zero?
    end
  end

end

Hopefully I've made this journey easier than mine was, thanks!

DEV Community: Thomas Blevins