https://www.guguweb.com/2022-01-07T15:59:56+01:00Freelance developer and sysadmin2014-03-31T08:58:04+00:002022-01-07T15:59:56+01:00Augusto Destrerotag:www.guguweb.com,2014-03-31:/2014/03/31/joomla-brute-force-attacks-file2ban/

<p>If you administer at least one Joomla instance you&#8217;ll be subject to brute force attacks before or after. <a title="Fail2ban home page" href="http://www.fail2ban.org/wiki/index.php/Main_Page" target="_blank" rel="noopener noreferrer">Fail2ban</a> is a very nice service written in Python which periodically scans your log files looking for signs of brute force attacks and perform some actions when an attack is discovered …</p>

<p>If you administer at least one Joomla instance you&#8217;ll be subject to brute force attacks before or after. <a title="Fail2ban home page" href="http://www.fail2ban.org/wiki/index.php/Main_Page" target="_blank" rel="noopener noreferrer">Fail2ban</a> is a very nice service written in Python which periodically scans your log files looking for signs of brute force attacks and perform some actions when an attack is discovered. The most common actions is to ban the attacker IP at firewall level and send an email to the server administrator.</p> <p>Fail2ban comes bundled with filters for many common services (ssh, apache authentication, etc.), but it lacks a built-in Joomla integration. Anyway it&#8217;s easy to add a Joomla filter to Fail2ban, here I explain how to do it.</p> <div class="toc"><span class="toctitle">Table of Contents</span><ul> <li><a href="#install-fail2ban">Install Fail2ban</a></li> <li><a href="#install-fail2ban-joomla-plugin">Install Fail2ban Joomla plugin</a></li> <li><a href="#fail2ban-configuration">Fail2ban configuration</a></li> <li><a href="#be-happy-when-an-attacker-gets-banned">Be happy when an attacker gets banned</a></li> </ul> </div> <h2 id="install-fail2ban">Install Fail2ban</h2> <p>Installing fail2ban in a Debian based server is as simple as issuing the following command:</p> <div class="highlight"><pre><span></span><code>$ apt-get install fail2ban </code></pre></div> <p>Configuring Fail2ban properly is out of scope of this howto, you can find many resources online and in the official Fail2ban wiki.</p> <h2 id="install-fail2ban-joomla-plugin">Install Fail2ban Joomla plugin</h2> <p>To ease the integration of Fail2ban with Joomla authentication system you can install a <a title="Joomla file2ban plugin" href="http://extensions.joomla.org/extensions/extension?searchall=fail2ban&filter%5Btags%5D%5B%5D=&filter%5Bcore_catid%5D=&filter%5Bincludes%5D=&filter%5Bversions%5D=&filter%5Btype%5D=&filter%5Bhasdemo%5D=&order=&filter%5Bnewupdated%5D=&filter%5Bscore%5D=&filter%5Bfavourites%5D=&dir=DESC&limitstart=0&controller=filter&view=extension&layout=list&Itemid=145&clearorders=0&clearfilters=1" target="_blank" rel="noopener noreferrer">Joomla fail2ban plugin</a> using the standard Joomla plugin installation mechanism. This plugin logs Joomla authentication errors in the standard web server error log. There it will be easy for Fail2ban to scan for errors and ban the attackers IPs.</p> <p>After installing and activating the plugin you&#8217;ll find something like this in your web server error log when user authentication fails in Joomla:</p> <div class="highlight"><pre><span></span><code><span class="o">/</span><span class="nf">var</span><span class="o">/</span><span class="nf">log</span><span class="o">/</span><span class="n">apache2</span><span class="o">/</span><span class="n">mywebsite_error</span><span class="p">.</span><span class="nf">log</span><span class="err">:</span><span class="o">[</span><span class="n">Mon Mar 31 10:13:58 2014</span><span class="o">]</span><span class="w"> </span><span class="o">[</span><span class="n">error</span><span class="o">]</span><span class="w"> </span><span class="o">[</span><span class="n">client 212.109.14.203</span><span class="o">]</span><span class="w"> </span><span class="k">user</span><span class="w"> </span><span class="n">mywebsite</span><span class="w"> </span><span class="n">authentication</span><span class="w"> </span><span class="n">failure</span><span class="w"></span> </code></pre></div> <h2 id="fail2ban-configuration">Fail2ban configuration</h2> <p>Save this Fail2ban filter in a file called joomla-error.conf and save it in /etc/fail2ban/filters.d:</p> <div class="highlight"><pre><span></span><code><span class="k">[Definition]</span> <span class="c1"># Option: failregex</span> <span class="c1"># Notes.: matches something like:</span> <span class="c1"># [Mon Mar 31 10:15:00 2014] [error] [client 212.109.14.203] user mywebsite authentication failure</span> <span class="c1"># Values: TEXT</span> <span class="na">failregex</span> <span class="o">=</span> <span class="s">[[]client &amp;amp;lt;HOST&amp;amp;gt;[]] user .* authentication failure.*</span> <span class="c1"># Option: ignoreregex</span> <span class="c1"># Notes.: regex to ignore. If this regex matches, the line is ignored.</span> <span class="c1"># Values: TEXT</span> <span class="c1">#</span> <span class="na">ignoreregex</span> <span class="o">=</span> </code></pre></div> <p>Add this jail to your /etc/fail2ban/jail.local:</p> <div class="highlight"><pre><span></span><code><span class="k">[joomla-error]</span> <span class="na">enabled</span> <span class="o">=</span> <span class="s">true</span> <span class="na">port</span> <span class="o">=</span> <span class="s">http,https</span> <span class="na">filter</span> <span class="o">=</span> <span class="s">joomla-error</span> <span class="na">logpath</span> <span class="o">=</span> <span class="s">/var/log/apache2/*error.log</span> <span class="na">maxretry</span> <span class="o">=</span> <span class="s">5</span> </code></pre></div> <p>Reload fail2ban configuration with:</p> <div class="highlight"><pre><span></span><code><span class="o">$</span> <span class="n">fail2ban</span><span class="o">-</span><span class="n">client</span> <span class="n">reload</span> </code></pre></div> <h2 id="be-happy-when-an-attacker-gets-banned">Be happy when an attacker gets banned</h2> <p>If you configured Fail2ban to send you an email when an attacker is banned you&#8217;ll receive an email with a text similar to the following:</p> <div class="highlight"><pre><span></span><code>The IP 212.109.14.203 has just been banned by Fail2Ban after 5 attempts against joomla-error. </code></pre></div> <p>The attacker IP here is left on purpose. I think it&#8217;s useful to expose attackers IP in public! 😉</p>