16 Oct 2014

Fail2ban

bloquer les bruteforce web

/etc/fail2ban/jail.conf:

ignoreip = 127.0.0.1/8 89.31.146.164 89.31.146.163 89.31.149.185


[apache-wp-login]

enabled = true
filter = apache-wp-login
#action = iptables-multiport [name = apache-wp-login, port = "http, https" protocol = tcp]
port = http,https
logpath = /var/log/apache2/*/*.access.*.log
maxretry = 5
findtime = 60
bantime = 86400

/etc/fail2ban/filter.d/apache-wp-login.conf:

[INCLUDES]

before = common.conf

[Definition]
failregex = ^<HOST> -.*POST /wp-login.php HTTP.*
ignoreregex =

Unban

fail2ban-client set ssh unbanip 192.168.0.105

Informatique

fail2ban, firewall, iptables