Issue Fail2ban WordPress login detection doesn't work and fail2ban couldn't be configured trough Plesk

[andreios]

Server operating system version

Ubuntu 22.04

Plesk version and microupdate number

18.0.60

In the default plesk-wordpress jail it looks for /var/www/vhosts/system/*/logs/*access*log.processed. But in my system there was basically nothing in these processed log files. I don't know if it is because I'm only using nginx (proxy off) for all WordPress Hosts. I changed it to /var/www/vhosts/system/*/logs/*access*log

But after I change this, I noticed that fail2ban did not react properly to a brute force attack I was watching in at that time, it created some kind of ban but in iptbles the IP was not visible, so the attack continued unhindered because the address was not blocked. However, it appeared on the list of blocked IPs in fail2ban. Only a restart of fail2ban and the deletion of the incorrectly blocked IP entry caused fail2ban to create a correct entry and the attack was blocked.

 

[Kaspar]

I am pretty sure the default log for the plesk-wordpress jail is /var/www/vhosts/system/*/logs/*access*log. Usually whenever you modify a fail2ban fail in Plesk the fail gets reload after saving it. Which can be checked in the fail2ban log. There will be an entry like fail2ban.server [11342]: INFO Jail 'plesk-wordpress' reloaded.

However it can take some time for fail2ban to fully analyze each log (epically if you have many domains on the server). Fail2ban does not ban real time.

Perhaps there are errors to be found in you fail2ban.log that indicate why the IP addresses weren't added to iptbles?

 

[andreios]

Yes, I have been watching the fail2ban log closely the whole time. I also kept deleting the supposedly blocked IP, which was not actually blocked, from the jail to try out new methods. I tried various action parameters. Nothing helped, the IP was recognized and “blocked” again and again, but the block was not created correctly and did not work. The attack kept coming through even though fail2ban had thought it already applied the "ban".