iptables Basics : Chapter 3, Configuring Fail2Ban With WordPress

We have talked with the needed basics though iptables Basics : Chapter 1, Creating root user with sudo privilege on Fail2Ban iptables Basics : Chapter 2. We talked about OSI model and of course easy article on how and what steps, works to perform on a blank new server. Chapter 3 Describes Configuring Fail2Ban With WordPress to Give Ultimate Protection. Thus We Secured OSI Model’s All Layers Which are Within Our Reach.

iptables Basics Chapter 3 : Prerequisites

You should read the above three iptables related articles and configure your server. You should not mix up following tutorials from this and that website on your server. We are describing method for Ubuntu server 16.04 LTS running Nginx latest version with PHP7.0-FPM. A running WordPress website is obviously needed for this guide. Other PHP-MySQL web application will work in the same way. We are assuming that /usr/share/nginx/html/ is the path of WordPress installation.

Above image is best seen on full size by clicking here.

iptables Basics : Chapter 3, Configuring Fail2Ban With WordPress

First install a WordPress Plugin from WordPress admin named WP Fail2Ban Redux, details of which can seen here :

it is a fork of popular plugin WP Fail2Ban. It controls Failed XML-RPC authentication attempts, successful authentication attempts, failed wp-login.php authentication attempts, pingback requests, blocked user enumeration attempts, authentication attempts for blocked usernames and spammed comments. It is for PHP7.0. Install and activate the plugin first.

From SSH screen, cd to where your WordPress installation’s plugins directory is located, like :

cd to wp-fail2ban-redux directory. If you do a ls, you will see these directories :

If you cd to config/filters of that wp-fail2ban-redux directory and do a ls, you’ll see 2 files :

Now, cd to /etc/fail2ban/filter.d directory and do a ls. There will be lot of files for SSH, PAM, Nginx etc. Copy both files to that directory from wp-fail2ban-redux directory :

In that WordPress installation’s plugins wp-fail2ban-redux directory’s wp-fail2ban-redux/config/jail location, there is another file named wordpress.conf file :

highlight and copy only this part from the SSH output :

Now open jail.local from /etc/fail2ban/jail.local location and add that stanza at the bottom :

You will get output like :

It is an optional step. Open logrotate.conf :

Add this stanza :

It is to set the maximum size of the file, permissions of the file, and the number of weeks (4 in above example) that file will not become /var/log/auth.log.1. It is auto cleaning system in GNU/Linux preserving the record in different file. You can cat on these files :

I got something like this :

Like we say not to allow root user to do SSH but a custom username with sudo privilege, for WordPress you should not use the publicly available name as username to login. I can drop that IP :

If I run a cat on cat /var/log/fail2ban.log file :

I will find :

There is nothing to explain. If you add this to Nginx server block :

You can make it a file named wp-login-ban.conf. Then call the file by including on Nginx server block :

Perform nginx -t and do service nginx restart.

These problems with attack on wp-login.php will get reduced. We never use WordPress backend 24*7 unlike official WordPress website. Before writing posts and doing other works i.e. logging to WordPress, you can comment out that :

Perform nginx -t and do service nginx restart. Previously we talked about how Nginx, PHP5-FPM behaves on WordPress XML-RPC attack fakes PHP-FPM errors and how to fix. You can ban those IP from iptables too.