WordPress and security are not the best of friends, but if you’re going to be dragged over the coals by Ivan you might as well make him work for it. Fail2Ban is a great little service to help stall brute force attempts against SSH and similar auth methods, it can also be used to monitor and block persistent failed authentications against WordPress and Webmin. Since wordpress does not automatically log failed login attempts, a simple plugin is required to provide fail2ban the proper notifications, that plugin is called “WP fail2ban” and can be found here. You will need to make a few configuration changes to fail2ban to get things working, these are the configurations that worked for me on Fedora:
WordPress jail.local (/etc/fail2ban/jail.local):
[wordpress]
enabled = true
filter = wordpress
logpath = /var/log/messages
maxretry = 5
action = iptables-multiport[name=wordpress, port="http,https", protocol=tcp]
sendmail-whois[name=Wordpress, dest=root, sender=fail2ban@jackson-brain.com, sendername="The WordPress Bouncer"]
WordPress filter (/etc/fail2ban/filter.d/wordpress.conf):
_daemon = wordpress # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "" can # be used for standard IP/hostname matching and is only an alias for # (?:::f{4,6}:)?(?P [\w\-.^_]+) # Values: TEXT # failregex = ^%(__prefix_line)sAuthentication failure for .* from $ ^%(__prefix_line)sBlocked authentication attempt for .* from $ ^%(__prefix_line)sBlocked user enumeration attempt from $ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex =
For Webmin, all I needed to do was update the [webmin-auth] section to properly reflect the location of failed webmin login attempts:
[webmin-auth] enabled = true filter = webmin-auth action = iptables-multiport[name=webmin,port="10007"] logpath = /var/log/secure