I've been flooded with POST requests at /wp-login.php

I know the OP was from a while ago, but hopefully this will help anyone finding this same issue.

Our solution uses fail2ban like the others, but with actions setup to use ufw commands since we love the simplicity of that firewall. Note that our log file is different from the default and includes the IP address the request was sent to first (other_vhosts_access.log), so remove the first “\S*” and space from regex for the normal access log. For some reason, this was the default when we set up the Wordpress droplet. YMMV.

# cat /etc/fail2ban/action.d/ufw.conf
[Definition]
actionstart =
actionstop =
actioncheck =
actionban = ufw insert 1 deny from <ip>
actionunban = ufw delete deny from <ip>

# cat /etc/fail2ban/filter.d/xmlrpc.conf 
[Definition]
failregex = ^\S* <HOST> .*POST .*xmlrpc\.php.*
ignoreregex =

# cat /etc/fail2ban/filter.d/wp-login.conf 
[Definition]
failregex = ^\S* <HOST> .*POST .*wp-login\.php.*
ignoreregex =

# cat /etc/fail2ban/jail.d/xmlrpc.conf 
[xmlrpc]
enabled = true
filter = xmlrpc
action = ufw
logpath = /var/log/apache2/other_vhosts_access.log
bantime = 43200
maxretry = 2

# cat /etc/fail2ban/jail.d/wp-login.conf 
[wp-login]
enabled = true
filter = xmlrpc
action = ufw
logpath = /var/log/apache2/other_vhosts_access.log
bantime = 600
maxretry = 6
findtime = 60

No changes were required to Wordpress or any plugins to install. This does mean that fail2ban can’t actually tell if there was a failure, it just looks at how often those URLs were accessed.

HTH

Sources:

• https://bjornjohansen.no/using-fail2ban-with-wordpress - I used the ufw custom action from there
• https://rbgeek.wordpress.com/2014/09/11/block-wordpress-xmlprc-php-ddos-attacks-using-fail2ban/ - General rule structure

You can deny the IP address using a firewall. If you’re on Ubuntu I’d suggest using UFW as a frontend to IPTables.

First set up some basic rules that will open port 22 for SSH and port 80 for HTTP while denying any incoming requests for other ports:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 80/tcp

Then, set a rule that will deny all requests from the IP address:

sudo ufw insert 1 deny from 181.165.120.195

Finally, enable the firewall:

sudo ufw enable

Your fail2ban doesn’t look right. Think you need a log file. I got this from http://en.alexnogard.com/securing-wordpress-using-fail2ban-wp-login/

Hope it helps

/etc/fail2ban/jail.conf

[Apache-wplogin]

enabled = true filter = apache-wplogin action = iptables-multiport [name = apache-wplogin, port = “http, https” protocol = tcp] port = http, https logpath = /var/log/httpd/access_log maxretry = 5 findtime = 60 bantime = 86400

/etc/fail2ban/filter.d/apache-wplong.conf

[Définition]

failregex = ^. * “POST. * / wp-login \. php HTTP. * 200e * $
ignoreregex =

Edit I can never get the code blocks to work right :(