Fail2ban针对//xmlrpc.php的过滤器无法触发封禁的问题求助
Fail2ban针对//xmlrpc.php的过滤器无法触发封禁的问题求助
我在Ubuntu 24.04系统上运行Apache服务器,最近一直收到一波又一波类似这样的请求:
www.server.com:80 104.197.225.110 - - [27/Sep/2024:22:13:06 +0000] "POST //xmlrpc.php HTTP/1.1" 200 818 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
为了封禁这类请求,我配置了对应的fail2ban规则:
首先是wordpress.conf的内容:
[INCLUDES] before = apache-common.conf [Definition] failregex = ^<HOST> -.*"(GET|POST).*(/wp-login.php|/xmlrpc.php).*$ ignoreregex =
然后是jail.local里的配置:
[wordpress] enabled = true banaction = iptables-allports port = all logpath = /var/log/apache2/access.log datepattern = %%d/%%b/%%Y:%%H:%%M:%%S %%z maxretry = 5 findtime = 300 bantime = 3600 backend = auto
不过当我运行测试命令:
fail2ban-regex /var/log/apache2/access.log wordpress.conf
得到的结果是:
Running tests ============= Use failregex filter file : wordpress, basedir: /etc/fail2ban Use datepattern : {^LN-BEG} : Default Detectors Use log file : /var/log/apache2/access.log
现在问题来了,这个过滤器似乎没办法匹配到这些请求,也没触发封禁。有没有大佬能帮我看看哪里配置错了?
备注:内容来源于stack exchange,提问作者TommyPeanuts
相关产品推荐
相关产品推荐

