0

fail2ban to prevent Brute Force Attacks on WordPress?

Is it possible to use fail2ban to do so instead installing a WP plugin or write one?

2

[pedantic mode] fail2ban obviously do not prevent attacks. The only way to prevent attacks is by sending the people that originate them to jail or give them some other incentive to stop.

More to the point, fail2ban suffers from having only a single point of reference while attackers control many sources. To have an effective brute force attack detection you probably need to gather info from many servers and accumulate information about possible attackers, otherwise you will have to set such a long attack retention tracking that you will increase the possibility of locking yourself out.

The right way to avoid being "broken into" is by having strong password, and possibly to change the login url.

But if you still want the fuzzy warm feeling of creating a security theater by integrating with fal2ban, just use one of the plugins that do that. There is zero point in reinventing the wheel as there are probably many small details to take care of, and it is a total waste of time if you are doing it as a "one off" thing.

  • I guess you meant `[pedantic mode] fail2ban obviously do not prevent attacks in WordPress). – Arcticooling Jan 7 '18 at 8:45
  • it do not prevent attacks on anything. It stops sometimes from attacker to be able to gain unauthorized access, but it does not prevent the attack itself. In addition, there is a cost for running fail2ban and other utilities like it and if it is not coded or configured well they may serve as a way to DDOS your server. – Mark Kaplun Jan 7 '18 at 12:03
  • Thank you mark, will you please let me the honor of reading only a few more words from you on why fail2ban and similar utilities might in some cases, rise the chance for DDOS?... – Arcticooling Jan 7 '18 at 12:05
  • 1
    fail2ban is relatively light, but there are plugins that do similar things but they track the attacks in the DB, and usually they perform a DB write on each attack. Now DB writes are very expensive from a performance POV and if you have someone just trying to "slightly" brute force you (and not to DDOS), the stress the attack itself imposes on your server will be amplified by those DB writes, and what could have been no more than a small annoyance, will become an actual problem that will degrade the performance of the server. – Mark Kaplun Jan 7 '18 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.