DEV Community

Cover image for Configuring and Enabling fail2ban to mitigate Wordpress authentication theft with Debian 12
Thomas Blevins
Thomas Blevins

Posted on

Configuring and Enabling fail2ban to mitigate Wordpress authentication theft with Debian 12

#fail2ban #wordpress #linux #nginx

We've recently run into a problem with our Wordpress site occasionally getting bombarded with login requests. To safeguard against this, we have implemented fail2ban on our Linux Machine to rate limit these requests.

Nginx Considerations

I am using fail2ban against Nginx access logs, and I've seen multiple times a recommendation to utilize Nginx's built-in rate-limiting limit-req (Rate Limiting with Nginx), and their zone idea seems to be what I'm doing when looking for specific requests.

I'm instead implementing fail2ban on its own, and just reading the access logs.

What is fail2ban?

Fail2ban reactively scans log files for requests matching a filter (known as a fail) that (over a findtime duration) break the maxretry limit. If this happens, it locks them in jail for a bantime, stopping further requests.

Installing fail2ban 

sudo apt update && sudo apt upgrade
sudo apt install fail2ban
Enter fullscreen mode Exit fullscreen mode

Ensure the package is installed correctly:

fail2ban-client --version
Enter fullscreen mode Exit fullscreen mode

Configuring fail2ban

Copy the default files into files that you can safely customize, without risk of overwriting them with a package update.

cp /etc/fail2ban/fail2ban.conf /etc/fail2ban/fail2ban.local
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Enter fullscreen mode Exit fullscreen mode

Configuring the Filter

/etc/fail2ban/filter.d/wordpress-login.conf

[Definition]

# Match any access log line that starts with an IP address and attempts to access the wp-login via POST
# If we do want to limit xml access
#           ^<HOST> .*"(POST) /xmlrpc\.php.*"
failregex = ^<HOST> .*"(POST) /wp-login\.php.*"
            ^<HOST> .*"(GET|POST) /wp-admin/.*"

# We don't want to ban people on asset requests, just the authentication requests
ignoreregex = ^<HOST> .*"(GET|POST) /wp-admin/(images|js|css)/.*"
Enter fullscreen mode Exit fullscreen mode

Configuring the Jail

/etc/fail2ban/jail.local

[wordpress-login]
enabled = true
filter = wordpress-login
port = http,https
logpath = /var/log/nginx/*.access.log
action = iptables-multiport[name=http, port="http,https", protocol=tcp]
maxretry = 10
findtime = 60
bantime = 3600
Enter fullscreen mode Exit fullscreen mode
  • The logpath is utilizing a wildcard to scan all site access logs.
  • The action is specifying that we will use the iptables of the firewall to restrict the requests.

Testing fail2ban

Before booting this up, you can test your individual log files (I believe wildcard is not supported) to see if your filter is reading the "failures" correctly.

fail2ban-regex /var/log/nginx/my.access.log /etc/fail2ban/filter.d/wordpress-login.conf --print-all-matched
Enter fullscreen mode Exit fullscreen mode

Though, keep in mind you'll have to have logs that will match this filter regex to see anything here.

Starting and Stopping fail2ban

To Start:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban
Enter fullscreen mode Exit fullscreen mode

To Stop:

sudo systemctl disable fail2ban
sudo systemctl stop fail2ban
Enter fullscreen mode Exit fullscreen mode

Monitoring fail2ban jails

To see how a specific jail is faring:

fail2ban-client status wordpress-login
Enter fullscreen mode Exit fullscreen mode

and you'll see something like:

Status for the jail: wordpress-login
|- Filter
|  |- Currently failed: 156
|  |- Total failed:     101134
|  `- File list:        /var/log/nginx/my.access.log ...
`- Actions
   |- Currently banned: 0
   |- Total banned:     1145
   `- Banned IP list:
Enter fullscreen mode Exit fullscreen mode

Extra

  • Also check out the default sshd jail, all you have to do is enable it.

Resources

Top comments (0)