Question Why isn't xmlrpc.php monitored by the WordPress jail in Fail2Ban?

[brother4]

Server operating system version

Ubuntu 22.04

Plesk version and microupdate number

Plesk Obsidian 18.0.64 Web Host Edition

Hello!
I've been using the WordPress jail in Fail2Ban to protect my WordPress installations from brute-force attacks. While I appreciate the protection it offers, I recently noticed a significant gap in its coverage that raises some concerns regarding security.

Specifically, I’ve observed thousands of POST requests targeting xmlrpc.php on several WordPress instances. These frequent requests are often used for brute-force attacks, exploiting the system.multicall method to test multiple login credentials in a single request.

While it’s good practice to disable or block xmlrpc.php via .htaccess, this isn’t commonly done by default, especially for less experienced users. Therefore, I believe the WordPress jail in Plesk should extend its monitoring to include suspicious activities related to xmlrpc.php as well. As it stands, this critical file seems to be outside the scope of the current jail filter, which primarily focuses on /wp-login.php attacks.

Given that Fail2Ban suggests it protects against brute-force attacks for WordPress, shouldn't this protection encompass xmlrpc.php, given its known vulnerabilities? I think this poses a major security risk, especially for users who trust Plesk's default protections to keep their sites safe without further customization.

Is there any plan to enhance the filters to cover attacks on xmlrpc.php? It seems essential, considering how common these attacks are.

Looking forward to hearing your thoughts on this!

 

[brother4]

Acutal /etc/fail2ban/filter.d/plesk-wordpress.conf:

failregex = ^<HOST>.* "POST .*/wp-login.php([/\?#\\].*)? HTTP/.*" 200

Suggestion /etc/fail2ban/filter.d/plesk-wordpress.conf:

failregex = ^<HOST>.* "POST .*/wp-login.php([/\?#\\].*)? HTTP/.*" 200
failregex = ^<HOST>.* "POST .*/xmlrpc.php([/\?#\\].*)? HTTP/.*"

 

[Maarten]

You don't need to create a Fail2ban rule to block xmlrpc.php attackers. The xmlrpc.php protection is already included in the WP Toolkit:

WP Toolkit

WP Toolkit is a single management interface that enables you to easily install, configure, and manage WordPress. It i...

docs.plesk.com

To enable this protection, follow these steps:

1. Ensure the WordPress website is managed by the WordPress Toolkit.
2. Click on Fix Vulnerabilities next to the Status label.
3. Go to the Security Measures tab.
4. Check the box for Block access to xmlrpc.php.
5. Click the Secure button.

 

[brother4]

@Maarten But not every WordPress instance is managed with WP Toolkit. That's what the Fail2bBan jails are for.

So it doesn't change the actual point that many brute force attacks on servers are not recognized, but this is suggested with the jail.

But thanks for the info anyway. I wasn't aware that there was an option there.