Что лучший способ состоит в том, чтобы остановить нападения в wp-login.php?

Question 1

В журналах доступа моего сервера я нахожу тысячи попыток получить доступ к wp-login.php, но ни один из сайтов на моем сервере не Wordpress...

37.19.108.121 - - [19/Dec/2018:02:31:10 +0000] "GET /wp-login.php HTTP/1.1" 301 525 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:31:11 +0000] "GET /wp-login.php HTTP/1.1" 403 14611 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.189.156.125 - - [19/Dec/2018:02:36:14 +0000] "GET /wp-login.php HTTP/1.1" 301 527 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.189.156.125 - - [19/Dec/2018:02:36:15 +0000] "GET /wp-login.php HTTP/1.1" 403 3732 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:40:04 +0000] "GET /wp-login.php HTTP/1.1" 301 535 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:40:05 +0000] "GET /wp-login.php HTTP/1.1" 403 3748 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:40:34 +0000] "GET /wp-login.php HTTP/1.1" 301 535 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:40:36 +0000] "GET /wp-login.php HTTP/1.1" 403 14663 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
116.199.102.237 - - [19/Dec/2018:02:48:04 +0000] "GET /wp-login.php HTTP/1.1" 301 525 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
116.199.102.237 - - [19/Dec/2018:02:48:04 +0000] "GET /wp-login.php HTTP/1.1" 403 3907 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
201.92.187.24 - - [19/Dec/2018:02:48:32 +0000] "GET /wp-login.php HTTP/1.1" 301 537 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
201.92.187.24 - - [19/Dec/2018:02:48:33 +0000] "GET /wp-login.php HTTP/1.1" 403 16139 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:52:44 +0000] "GET /wp-login.php HTTP/1.1" 301 533 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:52:45 +0000] "GET /wp-login.php HTTP/1.1" 403 3565 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.215.42.142 - - [19/Dec/2018:03:01:40 +0000] "GET /wp-login.php HTTP/1.1" 301 521 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.215.42.142 - - [19/Dec/2018:03:01:41 +0000] "GET /wp-login.php HTTP/1.1" 403 21504 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"

В моем htaccess я добавил это правило:

RewriteCond %{REQUEST_URI} wp-login.php$ [NC]
RewriteRule . - [F,L]

Но мой сервер всегда перегружается так или иначе.

Я начал добавлять дюйм/с к UFW, но они - теперь тысячи, и каждый день я нахожу новые. И вероятно дюйм/с будет динамичным и никогда не заканчиваться...

Что лучший способ состоит в том, чтобы заблокировать эти нападения, не перегружая сервер?

Я попробовал Fail2ban после некоторого поиска онлайн, я создал этот фильтр:

 /etc/fail2ban/filter.d/wp-login.conf 
[Definition]
failregex = ^<HOST> .* "POST .*wp-login.php
            ^<HOST> .* "GET .*wp-login.php
            ^<HOST> .* "POST .*xmlrpc.php
ignoreregex =

И добавил это к jail.local

[wp-login]
enabled   = true
port      = http,https
filter    = wp-login
action = iptables-multiport[name=wp-login, port="http,https", protocol=tcp]
logpath   = /var/log/apache2/access.log
maxretry  = 1
findtime = 600

Но в какой-то момент был запрещен мой IP..., но я никогда не шел на wp-login.php, Что случилось? Кто-то может помочь мне понять и настроить fail2ban?

Я удалил эти 3 строки, и я оставил только один

failregex = ^<HOST> .* "GET .*/wp-login.php

кажется, работает лучше... Я понятия не имею, почему, в руководствах, которые я прочитал, говорится, что можно поместить больше правил о различных строках...???

Question 2

Чтобы к паролю защищают страницу с Apache, необходимо добавить новый раздел к Apache VirtualHost как ниже:

<DirectoryMatch ^.*/wp-admin/>
    AuthType Basic
    AuthName "Restricted"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</DirectoryMatch>

Затем установите пользователя и пароль путем выполнения:

sudo htpasswd -c /etc/apache2/.htpasswd username

Наконец, перезапустите Apache для изменений для вступления в силу:

sudo service apache2 restart

затем добавьте этот код Ваш .htaccess

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /

# require www and https 
# comment out the first two if you do not need www
# comment out all lines for local dev
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]

RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

</IfModule>

# END WordPress


## PROTECT .HTACCESS, ERROR LOGS, WP-CONFIG.PHP AND PHP.INI FILES ##
<FilesMatch "^.*(error_log|wp-config\.php|php.ini|\.[hH][tT][aApP].*)$">
    Order deny,allow
    Deny from all
</FilesMatch>

## PREVENT WORDPRESS DIRECTORY BROWSING ##
    Options All -Indexes

## PROTECT IMPORTANT PHP FILES ##
    RewriteCond %{REQUEST_URI} !^/wp-content/plugins/mu-plugins/
    RewriteRule wp-content/plugins/(.*\.php)$ - [R=404,L]
    RewriteCond %{REQUEST_URI} !^/wp-content/themes/V2/
    RewriteRule wp-content/themes/(.*\.php)$ - [R=404,L]

    # Block the include-only files.
    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^wp-admin/includes/ - [F,L]
    RewriteRule !^wp-includes/ - [S=3]
    RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
    RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
    RewriteRule ^wp-includes/theme-compat/ - [F,L]
    </IfModule>

## COMPRESS TEXT, HTML, JAVASCRIPT, CSS, XML ##
## BEGIN GZIP ##
    <IfModule mod_deflate.c>
        # The following line is enough for .js and .css .html
        AddOutputFilter DEFLATE js css html
        AddOutputFilterByType DEFLATE text/text text/html text/plain text/xml application/xhtml+xml text/css application/xml application/rss+xml application/atom_xml application/x-javascript application/javascript application/x-httpd-php application/x-httpd-fastphp text/html

        # The following lines are to avoid bugs with some browsers
        BrowserMatch ^Mozilla/4 gzip-only-text/html
        BrowserMatch ^Mozilla/4\.0[678] no-gzip
        BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
    </IfModule>

    # BEGIN EXPIRES
    <IfModule mod_expires.c>
        ExpiresActive On
        ExpiresDefault "access plus 10 days"
        ExpiresByType text/css "access plus 1 week"
        ExpiresByType text/plain "access plus 1 month"
        ExpiresByType image/gif "access plus 1 month"
        ExpiresByType image/png "access plus 1 month"
        ExpiresByType image/jpeg "access plus 1 month"
        ExpiresByType application/x-javascript "access plus 1 month"
        ExpiresByType application/javascript "access plus 1 week"
        ExpiresByType application/x-icon "access plus 1 year"
    </IfModule>

    <IfModule mod_headers.c>
        <FilesMatch "\.(js|css|xml|gz)$">
            Header append Vary Accept-Encoding
        </FilesMatch>
        <FilesMatch "\.(ico|jpe?g|png|gif|swf)$">
            Header set Cache-Control "public"
        </FilesMatch>
        <FilesMatch "\.(css)$">
            Header set Cache-Control "public"
        </FilesMatch>
        <FilesMatch "\.(js)$">
            Header set Cache-Control "private"
        </FilesMatch>
        <FilesMatch "\.(x?html?|php)$">
            Header set Cache-Control "private, must-revalidate"
        </FilesMatch>
    </IfModule>



## END OF HTACCESS

GHOST · Answer 1 · 26 October 2019 в 19:45

Чтобы к паролю защищают страницу с Apache, необходимо добавить новый раздел к Apache VirtualHost как ниже:

<DirectoryMatch ^.*/wp-admin/>
    AuthType Basic
    AuthName "Restricted"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</DirectoryMatch>

Затем установите пользователя и пароль путем выполнения:

sudo htpasswd -c /etc/apache2/.htpasswd username

Наконец, перезапустите Apache для изменений для вступления в силу:

sudo service apache2 restart

затем добавьте этот код Ваш .htaccess

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /

# require www and https 
# comment out the first two if you do not need www
# comment out all lines for local dev
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]

RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

</IfModule>

# END WordPress


## PROTECT .HTACCESS, ERROR LOGS, WP-CONFIG.PHP AND PHP.INI FILES ##
<FilesMatch "^.*(error_log|wp-config\.php|php.ini|\.[hH][tT][aApP].*)$">
    Order deny,allow
    Deny from all
</FilesMatch>

## PREVENT WORDPRESS DIRECTORY BROWSING ##
    Options All -Indexes

## PROTECT IMPORTANT PHP FILES ##
    RewriteCond %{REQUEST_URI} !^/wp-content/plugins/mu-plugins/
    RewriteRule wp-content/plugins/(.*\.php)$ - [R=404,L]
    RewriteCond %{REQUEST_URI} !^/wp-content/themes/V2/
    RewriteRule wp-content/themes/(.*\.php)$ - [R=404,L]

    # Block the include-only files.
    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^wp-admin/includes/ - [F,L]
    RewriteRule !^wp-includes/ - [S=3]
    RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
    RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
    RewriteRule ^wp-includes/theme-compat/ - [F,L]
    </IfModule>

## COMPRESS TEXT, HTML, JAVASCRIPT, CSS, XML ##
## BEGIN GZIP ##
    <IfModule mod_deflate.c>
        # The following line is enough for .js and .css .html
        AddOutputFilter DEFLATE js css html
        AddOutputFilterByType DEFLATE text/text text/html text/plain text/xml application/xhtml+xml text/css application/xml application/rss+xml application/atom_xml application/x-javascript application/javascript application/x-httpd-php application/x-httpd-fastphp text/html

        # The following lines are to avoid bugs with some browsers
        BrowserMatch ^Mozilla/4 gzip-only-text/html
        BrowserMatch ^Mozilla/4\.0[678] no-gzip
        BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
    </IfModule>

    # BEGIN EXPIRES
    <IfModule mod_expires.c>
        ExpiresActive On
        ExpiresDefault "access plus 10 days"
        ExpiresByType text/css "access plus 1 week"
        ExpiresByType text/plain "access plus 1 month"
        ExpiresByType image/gif "access plus 1 month"
        ExpiresByType image/png "access plus 1 month"
        ExpiresByType image/jpeg "access plus 1 month"
        ExpiresByType application/x-javascript "access plus 1 month"
        ExpiresByType application/javascript "access plus 1 week"
        ExpiresByType application/x-icon "access plus 1 year"
    </IfModule>

    <IfModule mod_headers.c>
        <FilesMatch "\.(js|css|xml|gz)$">
            Header append Vary Accept-Encoding
        </FilesMatch>
        <FilesMatch "\.(ico|jpe?g|png|gif|swf)$">
            Header set Cache-Control "public"
        </FilesMatch>
        <FilesMatch "\.(css)$">
            Header set Cache-Control "public"
        </FilesMatch>
        <FilesMatch "\.(js)$">
            Header set Cache-Control "private"
        </FilesMatch>
        <FilesMatch "\.(x?html?|php)$">
            Header set Cache-Control "private, must-revalidate"
        </FilesMatch>
    </IfModule>



## END OF HTACCESS

Что лучший способ состоит в том, чтобы остановить нападения в wp-login.php?

1 ответ

Другие вопросы по тегам:

Похожие вопросы: