0

In the access logs of my server I find thousands of attempts to access wp-login.php, but none of the sites on my server is wordpress...

37.19.108.121 - - [19/Dec/2018:02:31:10 +0000] "GET /wp-login.php HTTP/1.1" 301 525 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:31:11 +0000] "GET /wp-login.php HTTP/1.1" 403 14611 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.189.156.125 - - [19/Dec/2018:02:36:14 +0000] "GET /wp-login.php HTTP/1.1" 301 527 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.189.156.125 - - [19/Dec/2018:02:36:15 +0000] "GET /wp-login.php HTTP/1.1" 403 3732 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:40:04 +0000] "GET /wp-login.php HTTP/1.1" 301 535 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:40:05 +0000] "GET /wp-login.php HTTP/1.1" 403 3748 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:40:34 +0000] "GET /wp-login.php HTTP/1.1" 301 535 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:40:36 +0000] "GET /wp-login.php HTTP/1.1" 403 14663 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
116.199.102.237 - - [19/Dec/2018:02:48:04 +0000] "GET /wp-login.php HTTP/1.1" 301 525 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
116.199.102.237 - - [19/Dec/2018:02:48:04 +0000] "GET /wp-login.php HTTP/1.1" 403 3907 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
201.92.187.24 - - [19/Dec/2018:02:48:32 +0000] "GET /wp-login.php HTTP/1.1" 301 537 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
201.92.187.24 - - [19/Dec/2018:02:48:33 +0000] "GET /wp-login.php HTTP/1.1" 403 16139 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:52:44 +0000] "GET /wp-login.php HTTP/1.1" 301 533 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:52:45 +0000] "GET /wp-login.php HTTP/1.1" 403 3565 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.215.42.142 - - [19/Dec/2018:03:01:40 +0000] "GET /wp-login.php HTTP/1.1" 301 521 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.215.42.142 - - [19/Dec/2018:03:01:41 +0000] "GET /wp-login.php HTTP/1.1" 403 21504 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"

In my htaccess I added this rule:

RewriteCond %{REQUEST_URI} wp-login.php$ [NC]
RewriteRule . - [F,L]

But my server is always overloaded anyway.

I started to add the IPs to UFW, but they are now thousands and every day I find new ones. And probably the IPs will be dynamic and never end...

What is the best way to block these attacks without overloading the server?


I tried Fail2ban, after some online search I created this filter:

 /etc/fail2ban/filter.d/wp-login.conf 
[Definition]
failregex = ^<HOST> .* "POST .*wp-login.php
            ^<HOST> .* "GET .*wp-login.php
            ^<HOST> .* "POST .*xmlrpc.php
ignoreregex =

And added this to jail.local

[wp-login]
enabled   = true
port      = http,https
filter    = wp-login
action = iptables-multiport[name=wp-login, port="http,https", protocol=tcp]
logpath   = /var/log/apache2/access.log
maxretry  = 1
findtime = 600

But at some point was banned my IP... but I never went on wp-login.php, What's wrong? Can someone help me understand and configure fail2ban?


I removed the 3 lines and I left only one

failregex = ^<HOST> .* "GET .*/wp-login.php

seems to work better... I have no idea why, the guides I read say that you can put more rules on different lines...???

  • 3
    Have you tried to search ddos protection with fail2ban? It can read apache or nginx log and ban the ip using iptables in realtime, which should help your server loading problem. For example you can match wp-login.php and ban the ips. – Alvin Liang Dec 19 '18 at 4:28
  • I like the idea of Failtoban, but many of the guides that I find are for Ubuntu 14.04, I always had the doubt that it was very old, perhaps not more current and updated, but maybe it's just my idea, can you confirm or deny? – alebal Dec 19 '18 at 4:35
  • 2
    fail2ban is a still-active project and supports ipv6 now: github.com/fail2ban/fail2ban I never use it for http though so I can't provide exact answer, but there should be many out there. – Alvin Liang Dec 19 '18 at 7:10
0

In order to password protect a page with Apache, you need to add a new section to your Apache VirtualHost like the below:

<DirectoryMatch ^.*/wp-admin/>
    AuthType Basic
    AuthName "Restricted"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</DirectoryMatch>

Then set the user and password by running:

sudo htpasswd -c /etc/apache2/.htpasswd username

Finally, restart Apache for the changes to take effect:

sudo service apache2 restart

then add this code your .htaccess

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /

# require www and https 
# comment out the first two if you do not need www
# comment out all lines for local dev
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]

RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

</IfModule>

# END WordPress


## PROTECT .HTACCESS, ERROR LOGS, WP-CONFIG.PHP AND PHP.INI FILES ##
<FilesMatch "^.*(error_log|wp-config\.php|php.ini|\.[hH][tT][aApP].*)$">
    Order deny,allow
    Deny from all
</FilesMatch>

## PREVENT WORDPRESS DIRECTORY BROWSING ##
    Options All -Indexes

## PROTECT IMPORTANT PHP FILES ##
    RewriteCond %{REQUEST_URI} !^/wp-content/plugins/mu-plugins/
    RewriteRule wp-content/plugins/(.*\.php)$ - [R=404,L]
    RewriteCond %{REQUEST_URI} !^/wp-content/themes/V2/
    RewriteRule wp-content/themes/(.*\.php)$ - [R=404,L]

    # Block the include-only files.
    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^wp-admin/includes/ - [F,L]
    RewriteRule !^wp-includes/ - [S=3]
    RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
    RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
    RewriteRule ^wp-includes/theme-compat/ - [F,L]
    </IfModule>

## COMPRESS TEXT, HTML, JAVASCRIPT, CSS, XML ##
## BEGIN GZIP ##
    <IfModule mod_deflate.c>
        # The following line is enough for .js and .css .html
        AddOutputFilter DEFLATE js css html
        AddOutputFilterByType DEFLATE text/text text/html text/plain text/xml application/xhtml+xml text/css application/xml application/rss+xml application/atom_xml application/x-javascript application/javascript application/x-httpd-php application/x-httpd-fastphp text/html

        # The following lines are to avoid bugs with some browsers
        BrowserMatch ^Mozilla/4 gzip-only-text/html
        BrowserMatch ^Mozilla/4\.0[678] no-gzip
        BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
    </IfModule>

    # BEGIN EXPIRES
    <IfModule mod_expires.c>
        ExpiresActive On
        ExpiresDefault "access plus 10 days"
        ExpiresByType text/css "access plus 1 week"
        ExpiresByType text/plain "access plus 1 month"
        ExpiresByType image/gif "access plus 1 month"
        ExpiresByType image/png "access plus 1 month"
        ExpiresByType image/jpeg "access plus 1 month"
        ExpiresByType application/x-javascript "access plus 1 month"
        ExpiresByType application/javascript "access plus 1 week"
        ExpiresByType application/x-icon "access plus 1 year"
    </IfModule>

    <IfModule mod_headers.c>
        <FilesMatch "\.(js|css|xml|gz)$">
            Header append Vary Accept-Encoding
        </FilesMatch>
        <FilesMatch "\.(ico|jpe?g|png|gif|swf)$">
            Header set Cache-Control "public"
        </FilesMatch>
        <FilesMatch "\.(css)$">
            Header set Cache-Control "public"
        </FilesMatch>
        <FilesMatch "\.(js)$">
            Header set Cache-Control "private"
        </FilesMatch>
        <FilesMatch "\.(x?html?|php)$">
            Header set Cache-Control "private, must-revalidate"
        </FilesMatch>
    </IfModule>



## END OF HTACCESS
  • my sites is not wordpress... I don't want protect a directory, I want block the attack... – alebal Dec 20 '18 at 4:40
  • then leave its its go 404 :) its py bot github.com/Ghost173/php-webshells its web shell its auto try – GHOST Dec 20 '18 at 4:43
  • in your log 403 its mean permission dined are you sure you donat have wp-login? – GHOST Dec 20 '18 at 4:44
  • 1
    I add a rule in htaccess as write in the first post – alebal Dec 20 '18 at 4:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.