Severe problems with filters included with v3.0

  • Resolved Brian

    (@brianedwardreynolds)


    8 years, 10 months ago

    Updating the plug-in itself (the php) alters the way the plugin writes to the system logs (/var/log/messages on Redhat/CentoS) and thus:

    unknown users are no longer blocked
    xml-rpc failed authentications are no longer blocked

    Whereas in wp-fail2ban v2.3.1 an xml-rpc authentication attempt or an authentication attempt from an unknown user was merely logged as an “authentication failure” and thus easily caught by one simple filter line. . . wp-fail2ban v3.0 now defines those attempts as an “authentication attempt for unknown user x” where x is the username or as “XML-RPC authentication failure from x.x.x.x”. This is more accurate, but unless the filters are updated to take note of these, things break.

    To confuse things further, two filter files are included. But neither of them are quite right.

    wordpress-soft.conf will catch known users when they fail to authenticate. And it will catch the new xml-rpc failures. But it won’t catch unknown users.

    wordpress-hard.conf, due to a missing “.*” already noted by others, will not catch unknown users at all. Nor will it catch known users, nor xml-rpc attempts. It’s the worst of all possible choices.

    Watching my /var/log/messages, and /var/log/fail2ban.log while doing some testing, I eventually confirmed that the following will work (in then end, I decided against using either of the provided filters and instead just adjusted the existing one provided in wp-fail2ban v2.3.1):

    failregex = ^%(__prefix_line)sAuthentication failure for .* from <HOST>$
    ^%(__prefix_line)sAuthentication attempt for unknown user .* from <HOST>$
    ^%(__prefix_line)sBlocked authentication attempt for .* from <HOST>$
    ^%(__prefix_line)sBlocked user enumeration attempt from <HOST>$
    ^%(__prefix_line)sPingback requested from <HOST>$
    ^%(__prefix_line)sXML-RPC authentication failure from <HOST>$

    https://www.ads-software.com/plugins/wp-fail2ban/

Viewing 2 replies - 1 through 2 (of 2 total)
  • Thread Starter Brian

    (@brianedwardreynolds)

    On other quick note. . .

    XML-RPC attempts will become banned twice as fast as they appear to generate two log entries caught by the filter lines above. So, using the WordPress XML-RPC Validation Service at xmlrpc.eritreo.it, you get the following two entires (though I redacted the IP for no real reason):

    Authentication attempt for unknown user test from x.x.x.x
    XML-RPC authentication failure from x.x.x.x

    Plugin Author invisnet

    (@invisnet)

    The filters were fixed in 3.0.1.

    The double logging was due to a change in WP 4.5.x and is fixed in 3.0.2.

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘Severe problems with filters included with v3.0’ is closed to new replies.