WP fail2ban - Version 2.2.0

Version Description

  • Custom authentication log is now called WP_FAIL2BAN_AUTH_LOG
  • Add logging for pingbacks
  • Custom pingback log is called WP_FAIL2BAN_PINGBACK_LOG
Download this release

Release Info

Developer invisnet
Plugin Icon 128x128 WP fail2ban
Version 2.2.0
Comparing to
See all releases

Code changes from version 2.1.1 to 2.2.0

Files changed (3) hide show
  1. readme.txt +31 -2
  2. wordpress.conf +1 -0
  3. wp-fail2ban.php +16 -6
readme.txt CHANGED
@@ -4,8 +4,8 @@ Author URI: https://charles.lecklider.org/
4
  Plugin URI: https://charles.lecklider.org/wordpress/wp-fail2ban/
5
  Tags: fail2ban, security, syslog, login
6
  Requires at least: 3.4.0
7
- Tested up to: 3.6
8
- Stable tag: 2.1.0
9
  License: GPLv2 or later
10
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
11
 
@@ -20,6 +20,8 @@ Write all login attempts to syslog for integration with fail2ban.
20
  Oct 17 20:59:54 foobar wordpress(www.example.com)[1234]: Authentication failure for admin from 192.168.0.1
21
  Oct 17 21:00:00 foobar wordpress(www.example.com)[2345]: Accepted password for admin from 192.168.0.1
22
 
 
 
23
  *WPf2b* comes with a `fail2ban` filter, `wordpress.conf`.
24
 
25
  Requires PHP 5.3 or later.
@@ -42,6 +44,22 @@ You may want to set WP_FAIL2BAN_BLOCK_USER_ENUMERATION, WP_FAIL2BAN_PROXIES and/
42
 
43
  == Frequently Asked Questions ==
44
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
45
  = WP_FAIL2BAN_BLOCK_USER_ENUMERATION - what's it all about? =
46
 
47
  Brute-forcing WP requires knowing a valid username. Unfortunately, WP makes this all but trivial.
@@ -88,6 +106,11 @@ to the `[wordpress]` section in `jail.local`.
88
 
89
  == Changelog ==
90
 
 
 
 
 
 
91
  = 2.1.1 =
92
  * Minor bugfix.
93
 
@@ -116,6 +139,12 @@ to the `[wordpress]` section in `jail.local`.
116
 
117
  == Upgrade Notice ==
118
 
 
 
 
 
 
 
119
  = 2.1.0 =
120
  The `wordpress.conf` filter has been updated; you will need to update your `fail2ban` configuration.
121
 
4
  Plugin URI: https://charles.lecklider.org/wordpress/wp-fail2ban/
5
  Tags: fail2ban, security, syslog, login
6
  Requires at least: 3.4.0
7
+ Tested up to: 3.9
8
+ Stable tag: 2.2.0
9
  License: GPLv2 or later
10
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
11
 
20
  Oct 17 20:59:54 foobar wordpress(www.example.com)[1234]: Authentication failure for admin from 192.168.0.1
21
  Oct 17 21:00:00 foobar wordpress(www.example.com)[2345]: Accepted password for admin from 192.168.0.1
22
 
23
+ *WP fail2ban* can also log all pingbacks.
24
+
25
  *WPf2b* comes with a `fail2ban` filter, `wordpress.conf`.
26
 
27
  Requires PHP 5.3 or later.
44
 
45
  == Frequently Asked Questions ==
46
 
47
+ = WP_FAIL2BAN_AUTH_LOG - what's it all about? =
48
+
49
+ By default, *WPf2b* uses LOG_AUTH for logging authentication success or failure. However, some systems use LOG_AUTHPRIV instead, but there's no good run-time way to tell. If your system uses LOG_AUTHPRIV you should add the following to `wp-config.php`:
50
+
51
+ define('WP_FAIL2BAN_AUTH_LOG',LOG_AUTHPRIV);
52
+
53
+ = WP_FAIL2BAN_LOG_PINGBACKS - what's it all about? =
54
+
55
+ Based on a suggestion from *maghe*, *WPf2b* can now log pingbacks. To enable this feature, add the following to `wp-config.php`:
56
+
57
+ define('WP_FAIL2BAN_LOG_PINGBACKS',true);
58
+
59
+ By default, *WPf2b* uses LOG_USER for logging pingbacks. If you'd rather it used a different facility you can change it by adding something like the following to `wp-config.php`:
60
+
61
+ define('WP_FAIL2BAN_PINGBACK_LOG',LOG_LOCAL3);
62
+
63
  = WP_FAIL2BAN_BLOCK_USER_ENUMERATION - what's it all about? =
64
 
65
  Brute-forcing WP requires knowing a valid username. Unfortunately, WP makes this all but trivial.
106
 
107
  == Changelog ==
108
 
109
+ = 2.2.0 =
110
+ * Custom authentication log is now called WP_FAIL2BAN_AUTH_LOG
111
+ * Add logging for pingbacks
112
+ * Custom pingback log is called WP_FAIL2BAN_PINGBACK_LOG
113
+
114
  = 2.1.1 =
115
  * Minor bugfix.
116
 
139
 
140
  == Upgrade Notice ==
141
 
142
+ = 2.2.0 =
143
+ BREAKING CHANGE: WP_FAIL2BAN_LOG has been renamed to WP_FAIL2BAN_AUTH_LOG
144
+
145
+ Pingbacks are getting a lot of attention recently, so *WPf2b* can now log them.
146
+ The `wordpress.conf` filter has been updated; you will need to update your `fail2ban` configuration.
147
+
148
  = 2.1.0 =
149
  The `wordpress.conf` filter has been updated; you will need to update your `fail2ban` configuration.
150
 
wordpress.conf CHANGED
@@ -24,6 +24,7 @@ _daemon = wordpress
24
  failregex = ^%(__prefix_line)sAuthentication failure for .* from <HOST>$
25
  ^%(__prefix_line)sBlocked authentication attempt for .* from <HOST>$
26
  ^%(__prefix_line)sBlocked user enumeration attempt from <HOST>$
 
27
 
28
  # Option: ignoreregex
29
  # Notes.: regex to ignore. If this regex matches, the line is ignored.
24
  failregex = ^%(__prefix_line)sAuthentication failure for .* from <HOST>$
25
  ^%(__prefix_line)sBlocked authentication attempt for .* from <HOST>$
26
  ^%(__prefix_line)sBlocked user enumeration attempt from <HOST>$
27
+ ^%(__prefix_line)sPingback requested from <HOST>$
28
 
29
  # Option: ignoreregex
30
  # Notes.: regex to ignore. If this regex matches, the line is ignored.
wp-fail2ban.php CHANGED
@@ -3,13 +3,13 @@
3
  Plugin Name: WP fail2ban
4
  Plugin URI: https://charles.lecklider.org/wordpress/wp-fail2ban/
5
  Description: Write all login attempts to syslog for integration with fail2ban.
6
- Version: 2.1.1
7
  Author: Charles Lecklider
8
  Author URI: https://charles.lecklider.org/
9
  License: GPL2
10
  */
11
 
12
- /* Copyright 2012-13 Charles Lecklider (email : wordpress@charles.lecklider.org)
13
 
14
  This program is free software; you can redistribute it and/or modify
15
  it under the terms of the GNU General Public License, version 2, as
@@ -27,11 +27,11 @@ License: GPL2
27
 
28
  namespace org\lecklider\charles\wp_fail2ban;
29
 
30
- function openlog()
31
  {
32
  \openlog('wordpress('.$_SERVER['HTTP_HOST'].')',
33
  LOG_NDELAY|LOG_PID,
34
- defined('WP_FAIL2BAN_LOG') ? WP_FAIL2BAN_LOG : LOG_AUTH);
35
  }
36
 
37
  function bail()
@@ -67,7 +67,7 @@ function remote_addr()
67
  return $_SERVER['REMOTE_ADDR'];
68
  }
69
 
70
- if (defined('WP_FAIL2BAN_BLOCKED_USERS')) {
71
  add_action( 'authenticate',
72
  function($user, $username, $password)
73
  {
@@ -80,7 +80,7 @@ if (defined('WP_FAIL2BAN_BLOCKED_USERS')) {
80
  return $user;
81
  },1,3);
82
  }
83
- if (defined('WP_FAIL2BAN_BLOCK_USER_ENUMERATION')) {
84
  add_filter( 'redirect_canonical',
85
  function($redirect_url, $requested_url)
86
  {
@@ -105,4 +105,14 @@ add_action( 'wp_login_failed',
105
  openlog();
106
  \syslog(LOG_NOTICE,"Authentication failure for $username from ".remote_addr());
107
  });
 
 
 
 
 
 
 
 
 
 
108
 
3
  Plugin Name: WP fail2ban
4
  Plugin URI: https://charles.lecklider.org/wordpress/wp-fail2ban/
5
  Description: Write all login attempts to syslog for integration with fail2ban.
6
+ Version: 2.2.0
7
  Author: Charles Lecklider
8
  Author URI: https://charles.lecklider.org/
9
  License: GPL2
10
  */
11
 
12
+ /* Copyright 2012-14 Charles Lecklider (email : wordpress@charles.lecklider.org)
13
 
14
  This program is free software; you can redistribute it and/or modify
15
  it under the terms of the GNU General Public License, version 2, as
27
 
28
  namespace org\lecklider\charles\wp_fail2ban;
29
 
30
+ function openlog($log = LOG_AUTH, $custom_log = 'WP_FAIL2BAN_AUTH_LOG')
31
  {
32
  \openlog('wordpress('.$_SERVER['HTTP_HOST'].')',
33
  LOG_NDELAY|LOG_PID,
34
+ defined($custom_log) ? constant($custom_log) : $log);
35
  }
36
 
37
  function bail()
67
  return $_SERVER['REMOTE_ADDR'];
68
  }
69
 
70
+ if (defined('WP_FAIL2BAN_BLOCKED_USERS') && true === WP_FAIL2BAN_BLOCKED_USERS) {
71
  add_action( 'authenticate',
72
  function($user, $username, $password)
73
  {
80
  return $user;
81
  },1,3);
82
  }
83
+ if (defined('WP_FAIL2BAN_BLOCK_USER_ENUMERATION') && true === WP_FAIL2BAN_BLOCK_USER_ENUMERATION) {
84
  add_filter( 'redirect_canonical',
85
  function($redirect_url, $requested_url)
86
  {
105
  openlog();
106
  \syslog(LOG_NOTICE,"Authentication failure for $username from ".remote_addr());
107
  });
108
+ if (defined('WP_FAIL2BAN_LOG_PINGBACKS') && true === WP_FAIL2BAN_LOG_PINGBACKS) {
109
+ add_action( 'xmlrpc_call',
110
+ function($call)
111
+ {
112
+ if ('pingback.ping' == $call) {
113
+ openlog(LOG_USER,'WP_FAIL2BAN_PINGBACK_LOG');
114
+ \syslog(LOG_INFO,"Pingback requested from ".remote_addr());
115
+ }
116
+ });
117
+ }
118