Records various WordPress events to your server's system log for integration with Fail2Ban.
WP Fail2Ban Redux records various WordPress events to your server’s system log for integration with Fail2Ban.
This plugin is (mostly) a drop-in replacement for WP fail2ban by Charles Lecklider.
While WP fail2ban is a great plugin, there are a number of improvements that could be made. In order to facilitate these improvements, a major refactoring of the codebase was necessary.
The core functionality between WP Fail2Ban Redux and WP fail2ban remains the same. WP Fail2Ban Redux is considered to be mostly a drop-in replacement, because all constants have been replaced with filters, and will, possibly, require some upgrade work. Don’t work it’s as simple as implementing the constants.
The following events are recorded by default:
The following events can be enabled via filter:
Extra documentation is available on the WP Fail2Ban Redux GitHub Wiki.
config/filters/wordpress-hard.conf
and config/filters/wordpress-soft.conf
files to your Fail2Ban filters directory (generally /etc/fail2ban/filters.d
).config/jail/wordpress.conf
file to your Fail2Ban jail directory (generally /etc/fail2ban/jail.d
), or append it’s contents to your jail.local
file. Make sure you read the notes in this file to aid successful setup.If you haven’t set any of the WP fail2ban constants, you don’t need to do anything. If you have set some of the constants, view the upgrade instructions.
Yes! All of the improvements made in WP Fail2Ban Redux were done in a way that would allow existing functionality to work without changes to your filters. However, the demo filters included with the plugin do contain some recommended changes. There are also new features not found in WP fail2ban that will require changes to your filters to be effective. These changes are linked, by filter, below:
wordpress-hard.conf
wordpress-soft.conf
Be ye forewarned: Future changes to WP fail2ban may break backwards compatibility with WP Fail2Ban Redux filters. No attempts will be made to fix this. So, even though it’s not required, it is probably a good idea to update the filters anyway.
As of version 0.5.0, yes! Download the plugin, and unzip. Inside the plugin folder will be another folder named wp-fail2ban-redux
and wp-fail2ban-redux.php
. Upload this folder and file to the mu-plugins
directory of your site.
You need to add some code to your wp-config.php
file. See the below links for guidance.
require-dev
to reduce the number of packages installed when WP Fail2Ban Redux is installed via composer. See https://github.com/thebrandonallen/wp-fail2ban-redux/pull/17wordpress-hard.conf
file, in order to fix an issue with matches failing for XML-RPC multicall authentication failures. See https://github.com/thebrandonallen/wp-fail2ban-redux/pull/13/commits/2e3a3867749be7839edfae5707b62921c36ecd85wordpress-hard.conf
filter.mu-plugins
directory.wp_fail2ban_redux_openlog_indent
filter to wp_fail2ban_redux_openlog_ident
, because… it was misspelled.wp_die
to exit, to allow for greater customization of exit messages.esc_html
.syslog()
output.WP_Fail2Ban_Redux::comment_spam
expects two parameters. Decided it was probably a good idea to oblige.author
and author_name
parameters. The author_name
parameter could be used to validate the existence of a particular username, so blocking on this parameter as well will further reduce the attack surface.WP_Fail2Ban_Redux::redirect_canonical
is now deprecated. If you were doing anything with this function, or the hook that initialized it, you should look at WP_Fail2Ban_Redux::user_enumeration
instead.wordpress.conf
about the logpath
parameter, and common auth log locations. There is no need to changed existing configurations. This is merely to aid setup for future users.exit
isn’t allowed as a method name. WP_Fail2Ban_Redux_Log::exit
is now WP_Fail2Ban_Redux_Log::_exit
.