2

I have a MediaWiki website and someone is trying to login as my WikiSysop user by guessing lots of passwords.

What can I do to ban IPs if they exceed a threshold of failed login attempts?

(Okay, no-one is trying to brute-force my password just yet. I want to be ready in case someone does try in the future.)

  • I've reworded the question so it isn't asking for software recommendation, instead asking the general question without presuming a particular type of answer. I hope this is enough to take the question off hold. – billpg May 4 at 12:55
  • They are probably hitting other services, like cPanel and WebMin, MySQLAdmin, and ssh. If you can get fail2ban to work, then it is a good option as @DKing suggests. – user40589 Jun 7 at 18:44
1

You may be looking for something like Fail2ban. There is a MediaWiki extension for it.

The extension makes a log entry for each failed log in attempt, which includes the IP address. Fail2ban can then use those entries to blacklist IP addresses which fail to login a certain number of times.

Those same logs can also be used with other tools. For instance, I commonly use Fail2ban logs with CSF and LFD for my firewall. It has the ability to do temporary blacklisting, which then becomes permanent after repeating the process, and you can whitelist IPs to prevent them from ever being blacklisted so that you don't lock yourself out.

In general, I would recommend blocking IP addresses in the firewall rather than restricting user accounts. That way, an attacker couldn't lock out a legitimate user. Also, if you block them in the firewall, that same device can't attempt further attacks on other services, and since the firewall acts on the kernel level, it prevents extra load on the database, etc., meaning that it is better for performance if your brute force attack becames an unintentional DoS attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.