0

I use PHPmyadmin (PMA) to manage my SQL based DB on an Apache environment secured with CSF-LFD (that as I know, also called "Fail2ban").

I don't want to protect PMA by limiting it to a certain IP or to remove and install it each time anew.

In contrast, I do secure PMA with basic HTTP-authentication and picked up a nice password for the root user but my question is where and what directives should one add to make sure CSF-LFD covers Brute Force Attacks for this one.

  • You could use Fail2Ban to firewall off hosts after a certain number if failed attempts. The best way would be to simply use something that can't be bruteforced like an HTTPS client certificate. – André Borie Nov 7 '16 at 12:52
  • Sadly I don't have spare budget (and currently, possibly also the spare time) to implement SSL. Must I have it to block surfers that will try to log in more than say, 3 times? – user123574 Nov 7 '16 at 13:13
  • @Benia Do you know LetsEncrypt? SSL/TLS does not necessarily cost something, nowadays. – deviantfan Nov 13 '16 at 1:24
5
+50

Add these lines to your Apache Config to log failed authentications

/etc/apache2/conf.d/phpmyadmin.conf:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %{userID}n %{userStatus}n" pma_combined
CustomLog /var/log/apache2/phpmyadmin_access.log pma_combined

Then create the fail2ban filter:

/etc/fail2ban/filter.d/phpmyadmin.conf

[Definition]
denied = mysql-denied|allow-denied|root-denied|empty-denied
failregex = ^<HOST> -.*(?:%(denied)s)$
ignoreregex =

Now add the jail to /etc/fail2ban/jail.local

[phpmyadmin]
enabled = true
port = http,https
filter = phpmyadmin
logpath = /var/log/apache2/phpmyadmin_access.log

Restart apache and fail2ban:

service  apache2 reload
service fail2ban reload
| improve this answer | |
  • 2
    Fail2ban and CSF are two independent programs. CSF never is fail2ban, and fail2ban never is CSF. – deviantfan Nov 13 '16 at 7:50
  • 2
    @Benia Yes, exactly. – deviantfan Nov 13 '16 at 15:02
  • 2
    Ok, but the way you've edited your question now makes my answer seem completely unrelated. – J.A.K. Nov 13 '16 at 19:47
  • 1
    I honestly didn't think it would matter... I rolled back the edit. – user123574 Nov 13 '16 at 21:34
  • 1
    fail2ban.org/wiki/index.php/MANUAL_0_8 here under Configuration: jail.local is commonly used to override settings. The default jail.conf can be reset by package managers and therefore should not store changes. So yeah, create it. – J.A.K. Nov 13 '16 at 23:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy