Piwigo.org

mendip_discovery · 2022-07-23 12:41:16

Afternoon all,

I would like to know if anyone would share their Jail and Filter setups for Fail2Ban. I have recently upgraded my VPS and I am going through the process of getting everything setup. Turns out there are a lot of script kiddies out there trying to hack websites.

Thanks

le78ld · 2025-02-27 13:53:43

Hello,

I'm a bit late to answer, but I hope it helps. Here is my setup.
Disclaimer: This is only my setup. It comes with no warranty

I filtered anything related to logging on the apache access log. Sadly I could not differentiate between a failed and a successful attempts. So I had to increase the number of retries to avoid false-positives.

Here is my filter:

Code:

# /etc/fail2ban/filter.d/piwigo.conf
# Fail2Ban configuration file
#
# Regexp to catch authentication attempts on Piwigo
#
# Protects:
#  - identification.php         -> Broodforce username/pass combination
#  - password.php               -> Probe for username/email
#  - register.php               -> Probe for username/email


[Definition]

failregex =     ^<HOST> -.*"POST \/identification\.php(\?.*)? .*HTTP.*"
                ^<HOST> -.*"POST \/password\.php(\?.*)? .*HTTP.*"
                ^<HOST> -.*"POST \/register\.php(\?.*)? .*HTTP.*"

ignoreregex =

datepattern =  ^[^\[]*\[({DATE})
              {^LN-BEG}

And for the jail:

Code:

# /etc/fail2ban/jail.d/piwigo
[piwigo]
enabled = true
port = 80,443
protocol = tcp
filter = piwigo
backend = auto
logpath = /var/log/apache2/access.log
maxretry = 10

Tell me if you have any idea on how to improve it :)

Piwigo.org

Announcement

#1 2022-07-23 12:41:16

Fail2ban Jail and Filter

#2 2025-02-27 13:53:43

Re: Fail2ban Jail and Filter

Code:

Code:

Board footer