You need to enable JavaScript to run this app.
优惠活动
大模型
产品
解决方案
定价
更多

Fail2ban针对//xmlrpc.php的过滤器无法触发封禁的问题求助

Fail2ban针对//xmlrpc.php的过滤器无法触发封禁的问题求助

我在Ubuntu 24.04系统上运行Apache服务器,最近一直收到一波又一波类似这样的请求:

www.server.com:80 104.197.225.110 - - [27/Sep/2024:22:13:06 +0000] "POST //xmlrpc.php HTTP/1.1" 200 818 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

为了封禁这类请求,我配置了对应的fail2ban规则:

首先是wordpress.conf的内容:

[INCLUDES]

before = apache-common.conf

[Definition]
failregex = ^<HOST> -.*"(GET|POST).*(/wp-login.php|/xmlrpc.php).*$
ignoreregex =

然后是jail.local里的配置:

[wordpress]
enabled = true
banaction = iptables-allports
port = all
logpath = /var/log/apache2/access.log
datepattern = %%d/%%b/%%Y:%%H:%%M:%%S %%z
maxretry = 5
findtime = 300
bantime = 3600
backend = auto

不过当我运行测试命令:

fail2ban-regex /var/log/apache2/access.log wordpress.conf

得到的结果是:

Running tests
=============

Use   failregex filter file : wordpress, basedir: /etc/fail2ban
Use      datepattern : {^LN-BEG} : Default Detectors
Use         log file : /var/log/apache2/access.log

现在问题来了,这个过滤器似乎没办法匹配到这些请求,也没触发封禁。有没有大佬能帮我看看哪里配置错了?

备注:内容来源于stack exchange,提问作者TommyPeanuts

相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级,最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分), 限时 9.9 元起

最近更新时间:2026.04.15 15:38:09