10

In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log


Custom log

The format of the /var/log/phpmyadmin_auth.log file is:

phpMyadmin login failed with username: root; ip: 192.168.1.50; url: http://somedomain.com/phpmyadmin/index.php
phpMyadmin login failed with username: ; ip: 192.168.1.50; url: http://192.168.1.48/phpmyadmin/index.php

Custom filter

[Definition]

# Count all bans in the logfile
failregex = phpMyadmin login failed with username: .*; ip: <HOST>;

phpMyAdmin jail

[phpmyadmin]

enabled  = true
port    = http,https
filter   = phpmyadmin
action   = sendmail-whois[name=HTTP]
logpath  = /var/log/phpmyadmin_auth.log
maxretry = 6

The fail2ban log contains:

2012-10-04 10:52:22,756 fail2ban.server : INFO   Stopping all jails
2012-10-04 10:52:23,091 fail2ban.jail   : INFO   Jail 'ssh-iptables' stopped
2012-10-04 10:52:23,866 fail2ban.jail   : INFO   Jail 'fail2ban' stopped
2012-10-04 10:52:23,994 fail2ban.jail   : INFO   Jail 'ssh' stopped
2012-10-04 10:52:23,994 fail2ban.server : INFO   Exiting Fail2ban
2012-10-04 10:52:24,253 fail2ban.server : INFO   Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.6
2012-10-04 10:52:24,253 fail2ban.jail   : INFO   Creating new jail 'ssh'
2012-10-04 10:52:24,253 fail2ban.jail   : INFO   Jail 'ssh' uses poller
2012-10-04 10:52:24,260 fail2ban.filter : INFO   Added logfile = /var/log/auth.log
2012-10-04 10:52:24,260 fail2ban.filter : INFO   Set maxRetry = 6
2012-10-04 10:52:24,261 fail2ban.filter : INFO   Set findtime = 600
2012-10-04 10:52:24,261 fail2ban.actions: INFO   Set banTime = 600
2012-10-04 10:52:24,279 fail2ban.jail   : INFO   Creating new jail 'ssh-iptables'
2012-10-04 10:52:24,279 fail2ban.jail   : INFO   Jail 'ssh-iptables' uses poller
2012-10-04 10:52:24,279 fail2ban.filter : INFO   Added logfile = /var/log/auth.log
2012-10-04 10:52:24,280 fail2ban.filter : INFO   Set maxRetry = 5
2012-10-04 10:52:24,280 fail2ban.filter : INFO   Set findtime = 600
2012-10-04 10:52:24,280 fail2ban.actions: INFO   Set banTime = 600
2012-10-04 10:52:24,287 fail2ban.jail   : INFO   Creating new jail 'fail2ban'
2012-10-04 10:52:24,287 fail2ban.jail   : INFO   Jail 'fail2ban' uses poller
2012-10-04 10:52:24,287 fail2ban.filter : INFO   Added logfile = /var/log/fail2ban.log
2012-10-04 10:52:24,287 fail2ban.filter : INFO   Set maxRetry = 3
2012-10-04 10:52:24,288 fail2ban.filter : INFO   Set findtime = 604800
2012-10-04 10:52:24,288 fail2ban.actions: INFO   Set banTime = 604800
2012-10-04 10:52:24,292 fail2ban.jail   : INFO   Jail 'ssh' started
2012-10-04 10:52:24,293 fail2ban.jail   : INFO   Jail 'ssh-iptables' started
2012-10-04 10:52:24,297 fail2ban.jail   : INFO   Jail 'fail2ban' started

When I issue:

sudo service fail2ban restart

fail2ban emails me to say ssh has restarted, but I receive no such email about my phpmyadmin jail. Repeated failed logins to phpMyAdmin does not cause an email to be sent.

Have I missed some critical setup? Is my filter's regular expression wrong?


Update: added changes from default installation

Starting with a clean fail2ban installation:

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Change email address to my own, action to:

action = %(action_mwl)s

Append the following to jail.local

[phpmyadmin]

enabled  = true
port     = http,https
filter   = phpmyadmin
action   = sendmail-whois[name=HTTP]
logpath  = /var/log/phpmyadmin_auth.log
maxretry = 4

Add the following to /etc/fail2ban/filter.d/phpmyadmin.conf

# phpmyadmin configuration file
#
# Author: Michael Robinson
#

[Definition]

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>\S+)
# Values:  TEXT
#

# Count all bans in the logfile
failregex = phpMyadmin login failed with username: .*; ip: <HOST>;

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#

# Ignore our own bans, to keep our counts exact.
# In your config, name your jail 'fail2ban', or change this line!
ignoreregex =

Restart fail2ban

sudo service fail2ban restart

PS: I like eggs

4
  • 1
    It seems that it isn't picking up your new jail in the configuration. Please specify exactly which files you changed.
    – mgorven
    Oct 5, 2012 at 0:58
  • @mgorven I've update my question with a comprehensive overview of what I changed Oct 5, 2012 at 1:11
  • Are these actual login attempts to your phpmyadmin instance or are they simply scanners looking for phpmyadmin?
    – Scott Pack
    Feb 3, 2013 at 16:52
  • I believe they're the latter Feb 3, 2013 at 20:16

2 Answers 2

9

That's fine but why not using the apache functionality to log failed logins ?

Add these lines to your Apache Config (i.e:/etc/apache2/conf.d/phpmyadmin.conf) in the according VirtualHost Section:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %{userID}n %{userStatus}n" pma_combined
CustomLog /var/log/apache2/phpmyadmin_access.log pma_combined

Then create the fail2ban filter:

/etc/fail2ban/filter.d/phpmyadmin.conf

[Definition]
denied = mysql-denied|allow-denied|root-denied|empty-denied
failregex = ^<HOST> -.*(?:%(denied)s)$
ignoreregex =

Now add the jail to /etc/fail2ban/jail.local

[phpmyadmin]
enabled = true
port = http,https
filter = phpmyadmin
logpath = /var/log/apache2/phpmyadmin_access.log

Restart apache and fail2ban:

service  apache2 reload
service fail2ban reload

and you are done, no need of php scripts so on..

3
  • 3
    Please don't edit directly jail.conf, create instead a copy jail.local Feb 27, 2016 at 10:59
  • You are right @Simone, I modified my answer, thanks
    – spacebiker
    Feb 29, 2016 at 8:14
  • I'm having a problem with the solution. Please see: serverfault.com/questions/815396/…
    – user329119
    Nov 17, 2016 at 0:23
2
  1. You should change your script to include timestamp in log files. Without this, fail2ban will not work

  2. use fail2ban-regex /var/log/phpmyadmin_auth.log /etc/fail2ban/filter.d/phpmyadmin.conf to verify your regex first.

  3. I could start fail2ban successfully using your original configuration (prior to jail.local)

    Oct  7 00:42:07 hostname yum: Installed: python-inotify-0.9.1-1.el5.noarch 
    Oct  7 00:42:08 hostname yum: Installed: fail2ban-0.8.4-29.el5.noarch
    Oct  7 00:42:10 hostname yum: Installed: phpMyAdmin-2.11.11.3-2.el5.noarch
    Oct  7 01:01:03 hostname fail2ban.server : INFO   Changed logging target to SYSLOG for Fail2ban v0.8.4
    Oct  7 01:01:03 hostname fail2ban.jail   : INFO   Creating new jail 'phpmyadmin'
    Oct  7 01:01:03 hostname fail2ban.jail   : INFO   Jail 'phpmyadmin' uses Gamin
    Oct  7 01:01:03 hostname fail2ban.filter : INFO   Set maxRetry = 2
    Oct  7 01:01:03 hostname fail2ban.filter : INFO   Set findtime = 600
    Oct  7 01:01:03 hostname fail2ban.actions: INFO   Set banTime = 600
    Oct  7 01:01:03 hostname fail2ban.jail   : INFO   Creating new jail 'ssh-iptables'
    Oct  7 01:01:03 hostname fail2ban.jail   : INFO   Jail 'ssh-iptables' uses Gamin
    Oct  7 01:01:03 hostname fail2ban.filter : INFO   Added logfile = /var/log/secure
    Oct  7 01:01:03 hostname fail2ban.filter : INFO   Set maxRetry = 5
    Oct  7 01:01:03 hostname fail2ban.filter : INFO   Set findtime = 600
    Oct  7 01:01:03 hostname fail2ban.actions: INFO   Set banTime = 600
    Oct  7 01:01:03 hostname fail2ban.jail   : INFO   Jail 'phpmyadmin' started
    Oct  7 01:01:03 hostname fail2ban.jail   : INFO   Jail 'ssh-iptables' started
    Oct  7 01:10:54 hostname fail2ban.jail   : INFO   Jail 'phpmyadmin' stopped
    Oct  7 01:10:55 hostname fail2ban.jail   : INFO   Jail 'ssh-iptables' stopped
    Oct  7 01:10:55 hostname fail2ban.server : INFO   Exiting Fail2ban
    Oct  7 01:10:56 hostname fail2ban.server : INFO   Changed logging target to SYSLOG for Fail2ban v0.8.4
    Oct  7 01:10:56 hostname fail2ban.jail   : INFO   Creating new jail 'phpmyadmin'
    Oct  7 01:10:56 hostname fail2ban.jail   : INFO   Jail 'phpmyadmin' uses Gamin
    Oct  7 01:10:56 hostname fail2ban.filter : INFO   Added logfile = /var/log/phpmyadmin_auth.log
    
  4. Once correct regex are in place, you can use audit to see whether your file is accessed or not by fail2ban.

I used auditctl -w /var/log/phpmyadmin_auth.log -p warx -k phpmyadmin_fail2ban

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .