为了使用阻止过多的失败phpMyAdmin登录尝试fail2ban，我创建了一个脚本，用于将失败的尝试记录到文件中：/var/log/phpmyadmin_auth.log
自定义日志
该/var/log/phpmyadmin_auth.log文件的格式为：
phpMyadmin login failed with username: root; ip: 192.168.1.50; url: http://somedomain.com/phpmyadmin/index.php
phpMyadmin login failed with username: ; ip: 192.168.1.50; url: http://192.168.1.48/phpmyadmin/index.php
自定义过滤器
[Definition]
# Count all bans in the logfile
failregex = phpMyadmin login failed with username: .*; ip: <HOST>;
phpMyAdmin监狱
[phpmyadmin]
enabled = true
port = http,https
filter = phpmyadmin
action = sendmail-whois[name=HTTP]
logpath = /var/log/phpmyadmin_auth.log
maxretry = 6
该fail2ban日志包含：
2012-10-04 10:52:22,756 fail2ban.server : INFO Stopping all jails
2012-10-04 10:52:23,091 fail2ban.jail : INFO Jail 'ssh-iptables' stopped
2012-10-04 10:52:23,866 fail2ban.jail : INFO Jail 'fail2ban' stopped
2012-10-04 10:52:23,994 fail2ban.jail : INFO Jail 'ssh' stopped
2012-10-04 10:52:23,994 fail2ban.server : INFO Exiting Fail2ban
2012-10-04 10:52:24,253 fail2ban.server : INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.6
2012-10-04 10:52:24,253 fail2ban.jail : INFO Creating new jail 'ssh'
2012-10-04 10:52:24,253 fail2ban.jail : INFO Jail 'ssh' uses poller
2012-10-04 10:52:24,260 fail2ban.filter : INFO Added logfile = /var/log/auth.log
2012-10-04 10:52:24,260 fail2ban.filter : INFO Set maxRetry = 6
2012-10-04 10:52:24,261 fail2ban.filter : INFO Set findtime = 600
2012-10-04 10:52:24,261 fail2ban.actions: INFO Set banTime = 600
2012-10-04 10:52:24,279 fail2ban.jail : INFO Creating new jail 'ssh-iptables'
2012-10-04 10:52:24,279 fail2ban.jail : INFO Jail 'ssh-iptables' uses poller
2012-10-04 10:52:24,279 fail2ban.filter : INFO Added logfile = /var/log/auth.log
2012-10-04 10:52:24,280 fail2ban.filter : INFO Set maxRetry = 5
2012-10-04 10:52:24,280 fail2ban.filter : INFO Set findtime = 600
2012-10-04 10:52:24,280 fail2ban.actions: INFO Set banTime = 600
2012-10-04 10:52:24,287 fail2ban.jail : INFO Creating new jail 'fail2ban'
2012-10-04 10:52:24,287 fail2ban.jail : INFO Jail 'fail2ban' uses poller
2012-10-04 10:52:24,287 fail2ban.filter : INFO Added logfile = /var/log/fail2ban.log
2012-10-04 10:52:24,287 fail2ban.filter : INFO Set maxRetry = 3
2012-10-04 10:52:24,288 fail2ban.filter : INFO Set findtime = 604800
2012-10-04 10:52:24,288 fail2ban.actions: INFO Set banTime = 604800
2012-10-04 10:52:24,292 fail2ban.jail : INFO Jail 'ssh' started
2012-10-04 10:52:24,293 fail2ban.jail : INFO Jail 'ssh-iptables' started
2012-10-04 10:52:24,297 fail2ban.jail : INFO Jail 'fail2ban' started
当我发出：
sudo service fail2ban restart
fail2ban向我发送电子邮件以说ssh已经重新开始，但是我没有收到有关我phpmyadmin入狱的此类电子邮件。重复失败的登录phpMyAdmin不会导致发送电子邮件。
我错过了一些关键的设置吗？我的过滤器的正则表达式错误吗？
更新：添加了对默认安装的更改
从全新fail2ban安装开始：
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
将电子邮件地址更改为我自己的地址，操作为：
action = %(action_mwl)s
将以下内容附加到 jail.local
[phpmyadmin]
enabled = true
port = http,https
filter = phpmyadmin
action = sendmail-whois[name=HTTP]
logpath = /var/log/phpmyadmin_auth.log
maxretry = 4
将以下内容添加到 /etc/fail2ban/filter.d/phpmyadmin.conf
# phpmyadmin configuration file
#
# Author: Michael Robinson
#
[Definition]
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
# Count all bans in the logfile
failregex = phpMyadmin login failed with username: .*; ip: <HOST>;
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
# Ignore our own bans, to keep our counts exact.
# In your config, name your jail 'fail2ban', or change this line!
ignoreregex =
重新开始 fail2ban
sudo service fail2ban restart
PS：我喜欢鸡蛋
1
似乎它并没有在配置中占用您的新监狱。请确切说明您更改了哪些文件。
—
mgorven 2012年
@mgorven我用全面的概述更新了我的问题
—
Michael Robinson
这些是实际登录到phpmyadmin实例的尝试，还是只是扫描程序在寻找 phpmyadmin？
—
Scott Pack
我相信他们是后者
—
Michael Robinson