I've been flooded with POST requests at /wp-login.php

I know the OP was from a while ago, but hopefully this will help anyone finding this same issue.

Our solution uses fail2ban like the others, but with actions setup to use ufw commands since we love the simplicity of that firewall. Note that our log file is different from the default and includes the IP address the request was sent to first (other_vhosts_access.log), so remove the first “\S*” and space from regex for the normal access log. For some reason, this was the default when we set up the Wordpress droplet. YMMV.

# cat /etc/fail2ban/action.d/ufw.conf
[Definition]
actionstart =
actionstop =
actioncheck =
actionban = ufw insert 1 deny from <ip>
actionunban = ufw delete deny from <ip>

# cat /etc/fail2ban/filter.d/xmlrpc.conf 
[Definition]
failregex = ^\S* <HOST> .*POST .*xmlrpc\.php.*
ignoreregex =

# cat /etc/fail2ban/filter.d/wp-login.conf 
[Definition]
failregex = ^\S* <HOST> .*POST .*wp-login\.php.*
ignoreregex =

# cat /etc/fail2ban/jail.d/xmlrpc.conf 
[xmlrpc]
enabled = true
filter = xmlrpc
action = ufw
logpath = /var/log/apache2/other_vhosts_access.log
bantime = 43200
maxretry = 2

# cat /etc/fail2ban/jail.d/wp-login.conf 
[wp-login]
enabled = true
filter = xmlrpc
action = ufw
logpath = /var/log/apache2/other_vhosts_access.log
bantime = 600
maxretry = 6
findtime = 60

No changes were required to Wordpress or any plugins to install. This does mean that fail2ban can’t actually tell if there was a failure, it just looks at how often those URLs were accessed.

HTH

Sources:

• https://bjornjohansen.no/using-fail2ban-with-wordpress - I used the ufw custom action from there
• https://rbgeek.wordpress.com/2014/09/11/block-wordpress-xmlprc-php-ddos-attacks-using-fail2ban/ - General rule structure

Your fail2ban doesn’t look right. Think you need a log file. I got this from http://en.alexnogard.com/securing-wordpress-using-fail2ban-wp-login/

Hope it helps

/etc/fail2ban/jail.conf

[Apache-wplogin]

enabled = true filter = apache-wplogin action = iptables-multiport [name = apache-wplogin, port = “http, https” protocol = tcp] port = http, https logpath = /var/log/httpd/access_log maxretry = 5 findtime = 60 bantime = 86400

/etc/fail2ban/filter.d/apache-wplong.conf

[Définition]

failregex = ^. * “POST. * / wp-login \. php HTTP. * 200e * $
ignoreregex =

Edit I can never get the code blocks to work right :(

Your fail2ban doesn’t look right. Think you need a log file. I got this from http://en.alexnogard.com/securing-wordpress-using-fail2ban-wp-login/

Hope it helps

/etc/fail2ban/jail.conf

[Apache-wplogin]

enabled = true filter = apache-wplogin action = iptables-multiport [name = apache-wplogin, port = “http, https” protocol = tcp] port = http, https logpath = /var/log/httpd/access_log maxretry = 5 findtime = 60 bantime = 86400

/etc/fail2ban/filter.d/apache-wplong.conf

[Définition]

failregex = ^. * “POST. * / wp-login \. php HTTP. * 200e * $
ignoreregex =

Edit I can never get the code blocks to work right :(

http://wordpress.org/plugins/ninjafirewall/

I’ve set up the following fail2ban filter:

[Definition] 
failregex = <HOST>.*] "POST /wp-login.php 302
ignoreregex =

And added the following to the jail.conf

[wp-auth]

enabled = true
filter = wp-auth
port = http
action = iptables[name=wp-auth, port=http, protocol=tcp]
         sendmail-whois[name=wp-auth, dest=mail@tehnika.mk, sender=mail@tehnika.mk]
logpath = /var/log/nginx/access.log
maxretry = 3
bantime = 14400

This is the best solution for my problem… Will wait and see if something happens

I still doesn’t get it with the requests from the access log:

When I try to login with a incorrect username and password, i get a request like this

89.205.72.83 - - [02/Sep/2014:23:55:47 +0200] "POST /wp-login.php HTTP/1.1" 200 1626 "http://www.tehnika.mk/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0"

The requests that are coming from the IP address that is flooding me are

181.165.120.195 - - [02/Sep/2014:21:30:07 +0200] "POST /wp-login.php HTTP/1.0" 302 0 "-" "-"

Why are mine HTTP 200, and why are those HTTP 302? Isnt 302 a redirect code? I don’t get it

You can deny the IP address using a firewall. If you’re on Ubuntu I’d suggest using UFW as a frontend to IPTables.

First set up some basic rules that will open port 22 for SSH and port 80 for HTTP while denying any incoming requests for other ports:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 80/tcp

Then, set a rule that will deny all requests from the IP address:

sudo ufw insert 1 deny from 181.165.120.195

Finally, enable the firewall:

sudo ufw enable