Block wp-login.php and xmlrpc.php via fail2ban on RunCloud

How to ban IP addresses that are brute forcing your wp-login.php and xmlrpc.php with fail2ban on a RunCloud server.

 

Add a WordPress fail2ban filter

Create a wordpress.conf file in /etc/fail2ban/filter.d/

[Definition]
failregex = ^<HOST> .* "POST .*wp-login.php
            ^<HOST> .* "POST .*xmlrpc.php
ignoreregex =

If you just want to ban only one of them just remove one.

 

Add a WordPress fail2ban Jail config

Create a wordpress.conf file in /etc/fail2ban/jail.d/

[wordpress]
enabled = true
port = http,https
filter = wordpress
banaction = firewallcmd-new
logpath = /home/*/logs/nginx/*_access.log
maxretry = 2
findtime = 10800
bantime = 86400

Change the maxretry or bantime or findtime if needed. The logpath uses RunCloud log paths and the banaction value of firewallcmd-new hooks in nicely with iptables to show fail2ban banned IPs in iptables.

 

Restart fail2ban

service fail2ban restart

If fail2ban fails to start, make sure you have at least one site configured as this will validate the log path by adding the nginx log – otherwise fail2ban won’t start.

Check fail2ban Log

Check the fail2ban log to ensure everything loads without error

tail -f /var/log/fail2ban.log

 

Check wordpress Jail status

You can check the WordPress jail status

fail2ban-client status wordpress

This will give you the log file list and any banned IP addresses.

 

Manually ban an IP address

fail2ban-client set wordpress banip 1.2.3.4

 

Manually unban an IP address

fail2ban-client set wordpress unbanip 1.2.3.4

 

See banned IPs in iptables from fail2ban

See the lot.

iptables -v -L f2b-wordpress

Or search for a particular one

iptables -nL | grep -i  1.2.3.4

Permanently Whitelist an IP address in fail2ban

You may want to permanently allow your IP address, add this in /etc/fail2ban/jail.local as a value in ignoreip – for multiple addresses just space separate them.

[DEFAULT]
ignoreip = 127.0.0.1/8  1.2.3.4
bantime = 86400
findtime = 43200
maxretry = 6
...

Then restart fail2ban

service fail2ban restart

 

Ref & Ref & Ref