Banning phpMyAdmin bots using fail2ban
I've had it with those evil bots trying to exploit non-existing phpMyAdmin installations on anything webserverish, therefore I wrote up a small fail2ban rule to ban those bastards after the third attempt. Maybe it's of help to you too, thus here it is.
/etc/fail2ban/filter.d/apache-phpmyadmin.conf
# Fail2Ban configuration file # # Bans bots scanning for non-existing phpMyAdmin installations on your webhost. # # Author: Gina Haeussge # [Definition] docroot = /var/www badadmin = PMA|phpmyadmin|myadmin|mysql|mysqladmin|sqladmin|mypma|admin|xampp|mysqldb|mydb|db|pmadb|phpmyadmin1|phpmyadmin2 # Option: failregex # Notes.: Regexp to match often probed and not available phpmyadmin paths. # Values: TEXT # failregex = [[]client <HOST>[]] File does not exist: %(docroot)s/(?:%(badadmin)s) # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex =
The badadmin matchers will prolly be extended in the future, this was just what I found regarding trial-and-error-URLs after a quick scan through the logs of one of the servers at work.
I added this to /etc/fail2ban/jail.conf to enable the rule:
[apache-phpmyadmin] enabled = true port = http,https filter = apache-phpmyadmin logpath = /var/log/apache*/*error.log maxretry = 3
Linkbacks
[...] Banning phpMyAdmin bots using fail2ban [...]
Supprimer les tentatives d’accès à phpMyAdmin en utilisant fail2ban (via.zapoyok.info) « Lucas BÉNARD, mon Blog, 2011/02/24 09:19 (Pingback)
[...] http://foosel.org/blog/2008/04/banning_phpmyadmin_bots_using_fail2ban [...]
[...] http://www.foosel.org/blog/2008/04/banning_phpmyadmin_bots_using_fail2ban [...]
[...] Gina Haeussge [...]
[...] Banning phpMyAdmin bots using fail2ban [...]
blog/2008/04/banning_phpmyadmin_bots_using_fail2ban.txt · Last modified: 2008/04/14 09:39 by foosel
Discussion
Hi,
Thanks for posting this. It was exactly what I was looking for!
Thank you so much for the post!
When you use Fail2Ban, so you can generate Abuse-Complaints automatically over my Project http://www.blocklist.de for some Services.
I get the following error testing the regex: fail2ban-regex /var/log/httpd/error_log etc/fail2ban/filter.d/apache-phpmyadmin.conf
No 'host' group in 'etc/fail2ban/filter.d/apache-phpmyadmin.conf' Cannot remove regular expression. Index 0 is not valid
any tips?
Works fine, thx.
“I added this to /etc/fail2ban/jail.conf to enable the rule:”
It's a bad idea, your personal settings can be overwrited by update/updgrade. :)
Better if you use a local config file for that.
If you don't have then just create (touch /etc/fail2ban/jail.local), and add your all personal settings into /etc/fail2ban/jail.local .
Hi for the index 0 problem you might want to try this:
failregex = [[]client (?P<host>\S*)[][] File does not exist: %(docroot)s/(?:%(badadmin)s)
the first part (client hosting matching and saving the ip for iptables) works well with fail2ban-regex on a debian system.
Either for IPs (%a) or hostname (%h).
BTW:
It loosk like that the capture image is rendered wrong!