フィルター wordpress.conf
[Definition]
# /var/log/apache2/access.log のアクセス例
# 93.113.111.100 – – [06/Mar/2020:11:03:37 +0900] “POST /xmlrpc.php HTTP/1.1” 200 494 “-” “Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0”
#
failregex = ^<HOST>.*(POST|GET).*(wp-login\.php|xmlrpc\.php).*
ignoreregex =
debug
# tail -n100 /var/log/fail2ban.log
banの確認
# tal -n100 /var/log/fail2ban.log
2020-03-06 11:03:37,791 fail2ban.filter [25044]: INFO [wordpress] Found 93.113.111.100 – 2020-03-06 11:03:37
2020-03-06 11:22:28,362 fail2ban.filter [25044]: INFO [wordpress] Found 66.70.189.24 – 2020-03-06 11:22:28
logの確認
# cat access.log | grep “xmlrpc.php”
コメント