Banning phpMyAdmin bots using fail2ban

I've had it with those evil bots trying to exploit non-existing phpMyAdmin installations on anything webserverish, therefore I wrote up a small fail2ban rule to ban those bastards after the third attempt. Maybe it's of help to you too, thus here it is.

Unable to display file "blog/media/20080414-apache-phpmyadmin.conf": It may not exist, or permission may be denied.

The badadmin matchers will prolly be extended in the future, this was just what I found regarding trial-and-error-URLs after a quick scan through the logs of one of the servers at work.

I added this to /etc/fail2ban/jail.conf to enable the rule:

enabled  = true
port     = http,https
filter   = apache-phpmyadmin
logpath  = /var/log/apache*/*error.log
maxretry = 3


JeremyJeremy, 2008/04/26 22:40


Thanks for posting this. It was exactly what I was looking for!

AlejoAlejo, 2010/04/22 18:44

Thank you so much for the post!

MartinMartin, 2010/09/22 09:36

When you use Fail2Ban, so you can generate Abuse-Complaints automatically over my Project for some Services.

lucluc, 2011/07/16 12:18

I get the following error testing the regex: fail2ban-regex /var/log/httpd/error_log etc/fail2ban/filter.d/apache-phpmyadmin.conf

No 'host' group in 'etc/fail2ban/filter.d/apache-phpmyadmin.conf' Cannot remove regular expression. Index 0 is not valid

any tips?

kergebirkakergebirka, 2011/08/15 04:34

Works fine, thx.

“I added this to /etc/fail2ban/jail.conf to enable the rule:”

It's a bad idea, your personal settings can be overwrited by update/updgrade. :)

Better if you use a local config file for that.

If you don't have then just create (touch /etc/fail2ban/jail.local), and add your all personal settings into /etc/fail2ban/jail.local .

Thomas HeissThomas Heiss, 2011/11/24 13:07

Hi for the index 0 problem you might want to try this:

failregex = [[]client (?P<host>\S*)[][] File does not exist: %(docroot)s/(?:%(badadmin)s)

the first part (client hosting matching and saving the ip for iptables) works well with fail2ban-regex on a debian system.

Either for IPs (%a) or hostname (%h).


It loosk like that the capture image is rendered wrong!

You could leave a comment if you were logged in.


[...] Banning phpMyAdmin bots using fail2ban [...]
[...] [...]
[...] [...]
[...] Gina Haeussge [...]
[...] Banning phpMyAdmin bots using fail2ban [...]
[...] [...]
[...] this blog post [...]
blog/2008/04/banning_phpmyadmin_bots_using_fail2ban.txt · Last modified: 2008/04/14 09:39 by foosel