0

I use PHPmyadmin (PMA) to manage my SQL based DB on an Apache environment secured with CSF-LFD (that as I know, also called "Fail2ban").

I don't want to protect PMA by limiting it to a certain IP or to remove and install it each time anew.

In contrast, I do secure PMA with basic HTTP-authentication and picked up a nice password for the root user but my question is where and what directives should one add to make sure CSF-LFD covers Brute Force Attacks for this one.

  • You could use Fail2Ban to firewall off hosts after a certain number if failed attempts. The best way would be to simply use something that can't be bruteforced like an HTTPS client certificate. – André Borie Nov 7 '16 at 12:52
  • Sadly I don't have spare budget (and currently, possibly also the spare time) to implement SSL. Must I have it to block surfers that will try to log in more than say, 3 times? – JohnDoea Nov 7 '16 at 13:13
  • @Benia Do you know LetsEncrypt? SSL/TLS does not necessarily cost something, nowadays. – deviantfan Nov 13 '16 at 1:24
6
+50

Add these lines to your Apache Config to log failed authentications

/etc/apache2/conf.d/phpmyadmin.conf:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %{userID}n %{userStatus}n" pma_combined
CustomLog /var/log/apache2/phpmyadmin_access.log pma_combined

Then create the fail2ban filter:

/etc/fail2ban/filter.d/phpmyadmin.conf

[Definition]
denied = mysql-denied|allow-denied|root-denied|empty-denied
failregex = ^<HOST> -.*(?:%(denied)s)$
ignoreregex =

Now add the jail to /etc/fail2ban/jail.local

[phpmyadmin]
enabled = true
port = http,https
filter = phpmyadmin
logpath = /var/log/apache2/phpmyadmin_access.log

Restart apache and fail2ban:

service  apache2 reload
service fail2ban reload
  • 2
    Fail2ban and CSF are two independent programs. CSF never is fail2ban, and fail2ban never is CSF. – deviantfan Nov 13 '16 at 7:50
  • 2
    @Benia Yes, exactly. – deviantfan Nov 13 '16 at 15:02
  • 2
    Ok, but the way you've edited your question now makes my answer seem completely unrelated. – J.A.K. Nov 13 '16 at 19:47
  • 1
    I honestly didn't think it would matter... I rolled back the edit. – JohnDoea Nov 13 '16 at 21:34
  • 1
    fail2ban.org/wiki/index.php/MANUAL_0_8 here under Configuration: jail.local is commonly used to override settings. The default jail.conf can be reset by package managers and therefore should not store changes. So yeah, create it. – J.A.K. Nov 13 '16 at 23:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.