diff --git a/filter.d/wordpress.conf b/filter.d/wordpress.conf new file mode 100644 index 0000000..c6a19df --- /dev/null +++ b/filter.d/wordpress.conf @@ -0,0 +1,19 @@ +## Version 2024/10/15 +# Fail2Ban filter for Wordpress login failures + +[INCLUDES] +before = common.conf + +[Definition] + +# pattern: 69.12.111.70 - - [28/Apr/2021:15:09:19 -0400] "GET /wp-login.php HTTP/1.1" 200 8315 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" +# 69.12.111.70 - - [28/Apr/2021:15:09:21 -0400] "POST /xmlrpc.php HTTP/1.1" 503 18354 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" +# 69.12.111.70 - - [28/Apr/2021:15:09:22 -0400] "POST /wp-login.php HTTP/1.1" 503 18382 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" +# +# +# Option: failregex +# Notes.: regex to match the password failure messages in the logfile. + +failregex = ^.* (GET|POST) (wp-login\.php|xmlrpc\.php) + +ignoreregex = \ No newline at end of file diff --git a/jail.d/wordpress.conf b/jail.d/wordpress.conf new file mode 100644 index 0000000..5c4a9a7 --- /dev/null +++ b/jail.d/wordpress.conf @@ -0,0 +1,8 @@ +## Version 2024/10/15 +# Fail2Ban jail configuration for wordpress via NGINX logs + +[wordpress] + +enabled = false +port = http,https +logpath = %(nginx_error_log)s