Protecting WordPress from script fishing attacks with Fail2Ban

Posted by on December 28, 2011 Leave a comment (0) Go to comments

A better, but slightly more complex, solution has been posted here

Because WordPress redirects all incoming requests and serves dedicated 404 pages, nothing ends up in the Apache error.log. and so, The standard Fail2Ban filter apache-noscript.conf won’t work.

So here’s a filter that will pick up these attacks, which can be handy if you’re trying to reduce unnecessary traffic on a busy blog.

# Fail2Ban configuration file
#
# Author: Mark White
#
#

[Definition]

# Option:  failregex
# Values:  TEXT
#
failregex = .* "GET [^\s]* HTTP\/1\.." 404

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex = GET /apple-touch-icon.png
              GET /apple-touch-icon-precomposed.png
              bitlybot
              Googlebot
              GoogleToolbar
              msnbot

You will need to add a jail to jail.local, and if the above filter is called apache-wp-noscript.conf, the entry might look a little like this:

[apache-wp-noscript]

action = %(action_mwl)s
enabled = true
port    = http,https
filter  = apache-wp-noscript
logpath = /var/log/apache*/*access.log
maxretry = 5
findtime = 30

However…on a popular blog server, Fail2Ban can use quite a bit of CPU time in monitoring a busy access.log, so keep an eye on server load if you are using this.

That said, there is a definite satisfaction in getting an email to confirm the banning of some script kiddie trying every combination of versions numbers to try to hit phpMyAdmin. or trying to access random themes that might use timThumb.php…

[Wed Dec 29 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/admin/scripts
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/admin/pma
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/admin/phpmyadmin
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/db
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/dbadmin
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/myadmin
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/mysql
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/mysqladmin
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/typo3
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpadmin
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpmyadmin
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpmyadmin1
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpmyadmin2
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/pma
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/web
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/xampp
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/web
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/php-my-admin
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/websql
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpmyadmin
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/php-my-admin
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.2.3
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.2.6
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.5.1
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.5.4
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.5.5-rc1
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.5.5-rc2
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.5.5
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.5.5-pl1
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.5.6-rc1
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.5.6-rc2
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.5.6
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.5.7
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.5.7-pl1
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.0-alpha
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.0-alpha2
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.0-beta1
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.0-beta2
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.0-rc1
[Wed Dec 28 03:40:05 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.0-rc2
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.0-rc3
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.0
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.0-pl1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.0-pl2
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.0-pl3
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.1-rc1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.1-rc2
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.1-pl1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.1-pl2
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.1-pl3
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.2-rc1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.2-beta1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.2-rc1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.2
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.2-pl1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.3
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.3-rc1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.3
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.3-pl1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.4-rc1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.4-pl1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.4-pl2
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.4-pl3
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.4-pl4
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.6.4
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.7.0-beta1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.7.0-rc1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.7.0-pl1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.7.0-pl2
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.7.0
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.8.0-beta1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.8.0-rc1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.8.0-rc2
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.8.0
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.8.0.1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.8.0.2
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.8.0.3
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.8.0.4
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.8.1-rc1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.8.1
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpMyAdmin-2.8.2
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/sqlmanager
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/mysqlmanager
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/p
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/PMA2005
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/pma2005
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpmanager
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/php-myadmin
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/phpmy-admin
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/webadmin
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/sqlweb
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/websql
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/webdb
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/mysqladmin
[Wed Dec 28 03:40:06 2011] [error] [client 174.129.212.180] File does not exist: /var/www/mysql-admin
Wordpress, , ,

Leave a Comment


NOTE - You can use these HTML tags and attributes:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>