0

I have a Debian server with phpmyadmin. I want to use fail2ban to block brute force attack. I have questions:

  1. How can I log the failed login attempts to log? Where to set that? I can only find the log in /var/log/apache2/access.log even it is success or fail in login.

10.0.5.1 - - [01/Mar/2016:23:47:46 +0800] "GET /phpmyadmin/ HTTP/1.1" 200 4028 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36" 10.0.5.1 - - [01/Mar/2016:23:47:49 +0800] "POST /phpmyadmin/index.php HTTP/1.1" 200 4033 "http://10.0.0.105/phpmyadmin/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36" 10.0.5.1 - - [01/Mar/2016:23:47:55 +0800] "POST /phpmyadmin/index.php HTTP/1.1" 200 4019 "http://10.0.0.105/phpmyadmin/index.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36" 10.0.5.1 - - [01/Mar/2016:23:48:29 +0800] "POST /phpmyadmin/index.php HTTP/1.1" 200 4019 "http://10.0.0.105/phpmyadmin/index.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"

  1. If that is the only log I can have, what should be the regular expression for fail2ban? failregex = ^ -*POST /phpmyadmin/index.php *
  • Check your error log – Iain Mar 1 '16 at 16:35
  • there's nothing in the error log in /var/log/apache2/error.log – hatted Mar 1 '16 at 16:37
  • Or is there any settings that I can add in the /etc/phpmyadmin/config.inc.php so that the errors can be saved to a log file? – hatted Mar 1 '16 at 16:39
0

From the documentation for version 4.7.0, which is still in development and not directly available:

Alternative approach might be using using fail2ban as phpMyAdmin logs failed authentication attempts to syslog (if available)

Unfortunately this logging is only introduced in the current master branch, which as I mentioned will become 4.7.0 at some point in the future. You can probably safely use the master branch, as the developers try to not break anything there during development. Aside from that, you'll have to implement something by looking at the Apache access logs rather than directly from phpMyAdmin.

With Ubuntu, the packaged fail2ban is pretty well configured out of the box, I imagine Debian is similar. Edit /etc/fail2ban/jail.local and enable the Apache sections, which include [apache] and a number of similar sections (such as [apache-overflows] and [apache-badbots]). You may wish to also turn on filtering for PHP here.

I wouldn't expect to see anything in the Apache error log in this case, so you're fine in that regard.

About actually tuning fail2ban, I'm not much of an expert, but this should get you started at least.

Additional reading: https://www.digitalocean.com/community/tutorials/how-to-protect-an-apache-server-with-fail2ban-on-ubuntu-14-04 or any other tutorial you can find on Google.

  • so right now we can only wait for 4.7 to support saving log for fail2ban. Then I think right now the best solution to protect from brute force is using recaptcha? – hatted Mar 3 '16 at 2:41
  • Recaptcha is a good choice for most situations, yes. Your other options as I see them are installing from the development version to get early access to the log feature and/or using fail2ban with the Apache logs, which should work okay...if you really want to only limit it to phpMyAdmin, you could even run a virtual host with a unique logfile. – ibennetch Mar 3 '16 at 13:44
0

The version provided through apt is still 4.6.6 unfortunately, but there is a really way to update to the current stable version (4.8.3): https://askubuntu.com/a/1057085. Basically:

  • wget the latest version from https://www.phpmyadmin.net/downloads/
  • unzip
  • rm or mv the old phpmyadmin folder in /usr/share (obviously backup any custom config)
  • copy the freshly unzipped version with something like cp -r phpMyAdmin-4.8.3-english /usr/share/phpmyadmin
  • set "blowfish_secret" in /usr/share/phpmyadmin/config.inc.php and use mkdir tmp & chown -R www-data:www-data /usr/share/phpmyadmin/tmp to enable template caching

After that, you will see the failed attempts in auth.log. Something like phpMyAdmin[27685]: user denied: admin (mysql-denied) from X.X.X.X. Now open your fail2ban jail configuration (I think it is located at /etc/fail2ban/jail.local and add the following block:

[phpmyadmin-syslog]
enabled  = true
filter   = phpmyadmin-syslog
maxretry = 3

Should work fine.

  • Where is the auth.log? I am using phpmyadmin 4.8.3 . – hatted Oct 28 '18 at 4:39
  • I can only find below login in /var/log/apache2/phpmyadmin-access.log 145.64.242.15 - - [28/Oct/2018:12:42:23 +0800] "POST /phpmyadmin/index.php HTTP/1.1" 200 3654 – hatted Oct 28 '18 at 4:44
  • In the regular auth log: /var/log/auth.log @hatted – esco_ Oct 31 '18 at 16:58

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.