Blocking WordPress Bruteforce Attacks on Nginx

Abhishek Ghosh

By Abhishek Ghosh May 24, 2015 12:05 pm Updated on May 24, 2015

Blocking WordPress Bruteforce Attacks on Nginx

If You Follow Nginx Official Documentation, Blocking WordPress Bruteforce Attacks on Nginx Will Be Quite Easier. We Can Stop Ping of Death For Example. Ping of Death is a kind of DDoS, we are not covering DDoS on IaaS in this article, it is already covered. Here are some easy and basic tricks, which most are not aware of.

Blocking WordPress Bruteforce Attacks on Nginx

Nginx Module ngx_http_limit_req_module limits the request processing rate. We need to add it on /etc/nginx.nginx.conf file on default Nginx apt version installation. Official method to limit the rate for an imaginary location named /search/ is this :

limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;

server {
    location /search/ {
        limit_req zone=one burst=5;
    }

1

2

3

4

5

6

limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;

server {

location /search/ {

limit_req zone=one burst=5;

}

An example to limit requests towards wp-login.php file can be like this which unix socket settings :

location ~ \.php$ {
location ~* wp\-login\.php {
limit_req zone=one burst=1 nodelay;
try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
include fastcgi_params;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/var/run/php5-fpm.sock;
}

try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;

include fastcgi_params;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/var/run/php5-fpm.sock;

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

location ~ \.php$ {

location ~* wp\-login\.php {

limit_req zone=one burst=1 nodelay;

try_files $uri =404;

fastcgi_split_path_info ^(.+\.php)(/.+)$;

include fastcgi_params;

fastcgi_index index.php;

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

fastcgi_pass unix:/var/run/php5-fpm.sock;

}

try_files $uri =404;

fastcgi_split_path_info ^(.+\.php)(/.+)$;

include fastcgi_params;

fastcgi_index index.php;

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

fastcgi_pass unix:/var/run/php5-fpm.sock;

}

Fail2Ban supports this feature of Nginx, so to fine-tune, we can install Fail2Ban :

apt-get install fail2ban

1	apt-get install fail2ban

then open the config file to adjust :

nano /etc/fail2ban/filter.d/nginx-req-limit.conf

1	nano /etc/fail2ban/filter.d/nginx-req-limit.conf

to this :

[Definition]

failregex = ^.*limiting requests, excess:.* by zone.*client: <HOST>, server.*$
ignoreregex =

1

2

3

4

[Definition]

failregex = ^.*limiting requests, excess:.* by zone.*client: <HOST>, server.*$

ignoreregex =

This is highly configurable, an example config :

[Definition]
failregex = ^<HOST> -.*\"(GET|POST).*
ignoreregex = ^<HOST> -.*\"(GET|POST).*Googlebot

1

2

3

[Definition]

failregex = ^<HOST> -.*\"(GET|POST).*

ignoreregex = ^<HOST> -.*\"(GET|POST).*Googlebot

/etc/fail2ban/jail.d/nginx-req-limit.conf should have this kind of settings :

---

[nginx-req-limit]

enabled = true
filter = nginx-req-limit
action = ufw
log path = /var/log/nginx/*error.log

1

2

3

4

5

6

[nginx-req-limit]

enabled = true

filter = nginx-req-limit

action = ufw

log path = /var/log/nginx/*error.log

You can run service ufw status command in Ubuntu to check whether ufw is running or not. Enable/Disable is this set :

sudo ufw disable
sudo ufw enable

1 2	sudo ufw disable sudo ufw enable

You should cat this file – /etc/fail2ban/jail.local to check the settings :

[DEFAULT]
ignoreip = 127.0.0.1/8
banaction = ufw
maxRetry = 5
findtime = 600
bantime = 7200

1

2

3

4

5

6

[DEFAULT]

ignoreip = 127.0.0.1/8

banaction = ufw

maxRetry = 5

findtime = 600

bantime = 7200

We can configure /etc/fail2ban/action.d/ufw.conf file to control ufw. You should check the manual of Fail2Ban for better settings, the file somewhat looks like this :

[Definition]
actionstart =
actionstop =
actioncheck =
...

1

2

3

4

5

[Definition]

actionstart =

actionstop =

actioncheck =

...

At the end, if you try ApacheBench with a higher value against our domain :

Blocking WordPress Bruteforce Attacks on Nginx

ab -c 1 -n 1 https://thecustomizewindows.com:443/

1	ab -c 1 -n 1 https://thecustomizewindows.com:443/

Increase the value from 1 to few hundred times, it will reject. That is a basic way to flood. Never do these with others’ server, your IP might get blacklisted.

Blocking WordPress Bruteforce Attacks on Nginx

Blocking WordPress Bruteforce Attacks on Nginx

About Abhishek Ghosh

Here’s what we’ve got for you which might like :

Take The Conversation Further ...

Blocking WordPress Bruteforce Attacks on Nginx

About Abhishek Ghosh

Here’s what we’ve got for you which might like :

Articles Related to Blocking WordPress Bruteforce Attacks on Nginx

Take The Conversation Further ...