I use PHPmyadmin (PMA) to manage my SQL based DB on an Apache environment secured with CSF-LFD (that as I know, also called "Fail2ban").

I don't want to protect PMA by limiting it to a certain IP or to remove and install it each time anew.

In contrast, I do secure PMA with basic HTTP-authentication and picked up a nice password for the root user but my question is where and what directives should one add to make sure CSF-LFD covers Brute Force Attacks for this one.

  • You could use Fail2Ban to firewall off hosts after a certain number if failed attempts. The best way would be to simply use something that can't be bruteforced like an HTTPS client certificate. Commented Nov 7, 2016 at 12:52
  • Sadly I don't have spare budget (and currently, possibly also the spare time) to implement SSL. Must I have it to block surfers that will try to log in more than say, 3 times?
    – user123574
    Commented Nov 7, 2016 at 13:13
  • @Benia Do you know LetsEncrypt? SSL/TLS does not necessarily cost something, nowadays.
    – deviantfan
    Commented Nov 13, 2016 at 1:24

2 Answers 2


Add these lines to your Apache Config to log failed authentications


LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %{userID}n %{userStatus}n" pma_combined
CustomLog /var/log/apache2/phpmyadmin_access.log pma_combined

Then create the fail2ban filter:


denied = mysql-denied|allow-denied|root-denied|empty-denied
failregex = ^<HOST> -.*(?:%(denied)s)$
ignoreregex =

Now add the jail to /etc/fail2ban/jail.local

enabled = true
port = http,https
filter = phpmyadmin
logpath = /var/log/apache2/phpmyadmin_access.log

Restart apache and fail2ban:

service  apache2 reload
service fail2ban reload
  • 3
    Fail2ban and CSF are two independent programs. CSF never is fail2ban, and fail2ban never is CSF.
    – deviantfan
    Commented Nov 13, 2016 at 7:50
  • 2
    @Benia Yes, exactly.
    – deviantfan
    Commented Nov 13, 2016 at 15:02
  • 2
    Ok, but the way you've edited your question now makes my answer seem completely unrelated.
    – J.A.K.
    Commented Nov 13, 2016 at 19:47
  • 1
    I honestly didn't think it would matter... I rolled back the edit.
    – user123574
    Commented Nov 13, 2016 at 21:34
  • 1
    fail2ban.org/wiki/index.php/MANUAL_0_8 here under Configuration: jail.local is commonly used to override settings. The default jail.conf can be reset by package managers and therefore should not store changes. So yeah, create it.
    – J.A.K.
    Commented Nov 13, 2016 at 23:20

CSF supports dynamic blocking of HTTP Basic Authentication failures natively, using the *HTACCESS* configuration items in csf.conf, usually found as /etc/csf/csf.conf. This also includes 'client denied by server configuration' log items that produce 403 Forbidden errors.

# [*]Enable login failure detection of Apache .htpasswd connections
# Due to the often high logging rate in the Apache error log, you might want to
# enable this option only if you know you are suffering from attacks against
# password protected directories

Search for HTACCESS in csf.conf for the related options. Note that some of the actual config options have other names, such as LF_APACHE_403, but most of them mention HTACCESS_LOG in the comments.

These all depend on the HTACCESS_LOG file/path location configuration item, to know what log file to monitor - so make sure that is correct.

You must log in to answer this question.