IPSET and replacement of CSF

CMS & WordPress
1

xmlrpc wp-login are common attacks for WordPress installations, with CSF firewall
we can block them.

We used to define in LOG inside the log directory from which CSF will be able to search for wp-login.php and xmlrpc.php requests.

Than we edit your /etc/csf/csf.conf like bellow:
CUSTOM1_LOG = “/var/log/httpd/domains/*.log”

How to manage IPSET for a WordPress DDoS attacks?

An example:

# XMLRPC
if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] "\w*(?:GET|POST) \/xmlrpc\.php.*" /)) {
return ("WP XMLPRC Attack",$1,"XMLRPC","5","80,443","1");
}

# WP-LOGINS
if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] "\w*(?:GET|POST) \/wp-login\.php.*" /)) {
return ("WP Login Attack",$1,"WPLOGIN","5","80,443","1");
2

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.