phpmyadmin fail2ban failed login log

Question

I have a Debian server with phpmyadmin. I want to use fail2ban to block brute force attack. I have questions:

1. How can I log the failed login attempts to log? Where to set that? I can only find the log in /var/log/apache2/access.log even it is success or fail in login.

10.0.5.1 - - [01/Mar/2016:23:47:46 +0800] "GET /phpmyadmin/ HTTP/1.1" 200 4028 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36" 10.0.5.1 - - [01/Mar/2016:23:47:49 +0800] "POST /phpmyadmin/index.php HTTP/1.1" 200 4033 "http://10.0.0.105/phpmyadmin/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36" 10.0.5.1 - - [01/Mar/2016:23:47:55 +0800] "POST /phpmyadmin/index.php HTTP/1.1" 200 4019 "http://10.0.0.105/phpmyadmin/index.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36" 10.0.5.1 - - [01/Mar/2016:23:48:29 +0800] "POST /phpmyadmin/index.php HTTP/1.1" 200 4019 "http://10.0.0.105/phpmyadmin/index.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"

2. If that is the only log I can have, what should be the regular expression for fail2ban? failregex = ^ -*POST /phpmyadmin/index.php *

Answer 1

1. Edit /etc/phpmyadmin/config.user.inc.php file and add something similar to:

<?php

$cfg['AuthLog'] = '/tmp/phpmyadmin.log';

2. Check it out:

tail -F /tmp/phpmyadmin.log

3. Perform a bad login in your phpmyadmin. Expected output similar to:

Jan 19 09:20:00 phpmyadmin: user denied: sfsd (mysql-denied) from 10.163.1.128

If your phpmyadmin server is behind a reverse proxy and its private IP address is 10.163.1.128 you probably want to log the public IP address of the client, so step 1 should be:

<?php

$cfg['AuthLog'] = '/tmp/phpmyadmin.log';
$cfg['TrustedProxies'] = array('10.163.1.128' => 'HTTP_X_FORWARDED_FOR');

Please bear in mind that the user running your phpmyadmin (typically www-data) should have write access to file and parent dir defined in $cfg['AuthLog'] variable name

---

Answer 2

From the documentation for version 4.7.0, which is still in development and not directly available:

Alternative approach might be using using fail2ban as phpMyAdmin logs failed authentication attempts to syslog (if available)

Unfortunately this logging is only introduced in the current master branch, which as I mentioned will become 4.7.0 at some point in the future. You can probably safely use the master branch, as the developers try to not break anything there during development. Aside from that, you'll have to implement something by looking at the Apache access logs rather than directly from phpMyAdmin.

With Ubuntu, the packaged fail2ban is pretty well configured out of the box, I imagine Debian is similar. Edit /etc/fail2ban/jail.local and enable the Apache sections, which include [apache] and a number of similar sections (such as [apache-overflows] and [apache-badbots]). You may wish to also turn on filtering for PHP here.

I wouldn't expect to see anything in the Apache error log in this case, so you're fine in that regard.

About actually tuning fail2ban, I'm not much of an expert, but this should get you started at least.

Additional reading: https://www.digitalocean.com/community/tutorials/how-to-protect-an-apache-server-with-fail2ban-on-ubuntu-14-04 or any other tutorial you can find on Google.

Answer 3

The version provided through apt is still 4.6.6 unfortunately, but there is a really way to update to the current stable version (4.8.3): https://askubuntu.com/a/1057085. Basically:

• wget the latest version from https://www.phpmyadmin.net/downloads/
• unzip
• rm or mv the old phpmyadmin folder in /usr/share (obviously backup any custom config)
• copy the freshly unzipped version with something like cp -r phpMyAdmin-4.8.3-english /usr/share/phpmyadmin
• set "blowfish_secret" in /usr/share/phpmyadmin/config.inc.php and use mkdir tmp & chown -R www-data:www-data /usr/share/phpmyadmin/tmp to enable template caching

After that, you will see the failed attempts in auth.log. Something like phpMyAdmin[27685]: user denied: admin (mysql-denied) from X.X.X.X. Now open your fail2ban jail configuration (I think it is located at /etc/fail2ban/jail.local and add the following block:

[phpmyadmin-syslog]
enabled  = true
filter   = phpmyadmin-syslog
maxretry = 3

Should work fine.