1 前言

一个问题，一篇文章，一出故事。
继上次笔者已经Fail2Ban一批wordpress攻击者，

如何Fail2Ban拉黑wordpress攻击者？

今天下午笔者发现服务器CPU又超过90%，于是查看Nginx日志，发现大量的如下日志，

183.56.195.106 - - [20/Aug/2025:14:04:51 +0800] "POST /xmlrpc.php HTTP/1.1" 200 520 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)" "-"
183.56.195.106 - - [20/Aug/2025:14:04:52 +0800] "POST /xmlrpc.php HTTP/1.1" 200 520 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)" "183.56.195.106"

看这架势，攻击者想通过大量的post请求瘫痪笔者的服务器，因此笔者需要根据具体情况增加拉黑攻击者的定义。

2 最佳实践

2.1 环境配置

如何安装部署fail2ban基础环境？

2.2 配置Fail2Ban

2.2.1 创建过滤规则

vim /etc/fail2ban/filter.d/wordpress-post.conf

加入如下配置，

[Definition]
failregex = ^<HOST> -.*"POST (?!/wp-admin/admin-ajax\.php).+\.php HTTP/1\.1" 200.*$

然后，你可以使用如下命令来确认规则，

fail2ban-regex /var/log/nginx/access.log /etc/fail2ban/filter.d/wordpress-post.conf

2.2.2 定义监视配置

vim /etc/fail2ban/jail.d/wordpress-post.local

加入如下配置，

[wordpress-post]
enabled = true
port = http,https
filter = wordpress-post
logpath = /var/log/nginx/access.log
maxretry = 5
findtime = 5m
bantime = 24h

配置修改后，你需要重启服务使配置生效，

systemctl restart fail2ban.service
systemctl status fail2ban.service

2.2.3 查看服务状态

fail2ban-client status wordpress-post

可见如下显示，

Status for the jail: wordpress-post
|- Filter
|  |- Currently failed: 1
|  |- Total failed:     124
|  `- File list:        /var/log/nginx/access.log
`- Actions
   |- Currently banned: 1
   |- Total banned:     1
   `- Banned IP list:   183.56.195.106

2.2.4 查看防火墙状态

iptables -L -v -n

可见如下显示，

#...
Chain f2b-wordpress-post (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    190 13749 REJECT     all  --  *      *       183.56.195.106       0.0.0.0/0            reject-with icmp-port-unreachable

2.2.5 手动确认日志状态

tail -f /var/log/nginx/access.log | grep POST

参阅文档
====================
https://github.com/fail2ban/fail2ban/wiki/Developing-Regex-in-Fail2ban
https://wangdoc.com/ssh/fail2ban