PHP MySQL admin tools

Configuration to block IP addresses probing your web server for PHP-based database admin tools.

/etc/fail2ban/filter.d/phpmyadmin.conf:

# Fail2Ban configuration file
#
# Check Apache logs for attempts to access PHP admin tools
#

[Definition]

# Option:  failregex
# Notes.:  regex to match the 404'ed PMA file in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>\S+)
# Values:  TEXT
#failregex = <HOST> -.*"GET .*(php|pma|PMA|p/m/a|db|sql|admin).*/(config/config\.inc|main|scripts/setup)\.php.*".*404.*

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

Edit /etc/fail2ban/jail.conf and add:

# This jail blocks phpmyadmin probes
[phpmyadmin]

enabled = true
filter  = phpmyadmin
action  = iptables-allports[name=pma]
logpath = /path/to/apache/logfile
bantime = -1
maxretry = 1

Recent Updates

  • 2 years 3 days ago
  • 2 years 3 days ago
  • 2 years 5 days ago
    php 8.x
  • 2 years 6 days ago
    10.6.7
  • 2 years 1 week ago
    Drop Centos 5/6 stuff