Jul 22 - Update protect admin page with fail2ban

2026-07-22 16:41:08 -04:00
parent ade7c5b33c
commit 8533cbe27c
9 changed files with 254 additions and 23 deletions
@@ -0,0 +1,15 @@
+# fail2ban filter for JQC Features admin login failures.
+# Install to: /etc/fail2ban/filter.d/jqc-admin.conf
+#
+# Matches lines written by the app's "jqc.auth" logger, e.g.:
+#   2026-07-22 12:00:00,123 jqc.auth WARNING FAILED LOGIN user=admin from 203.0.113.5
+#
+# The client IP is the LAST token on the line and the regex is anchored to
+# end-of-line, so a crafted username cannot spoof the <HOST> capture.
+
+[Definition]
+failregex = ^.*\bFAILED LOGIN\b.* from <HOST>\s*$
+ignoreregex =
+
+# Timestamp the app writes ("YYYY-MM-DD HH:MM:SS"); trailing ,millis is ignored.
+datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S
@@ -0,0 +1,16 @@
+# fail2ban jail for JQC Features admin.
+# Install to: /etc/fail2ban/jail.d/jqc-admin.local
+#
+# Bans an IP after `maxretry` failed admin logins within `findtime` seconds.
+# Adjust logpath to your deployment directory.
+
+[jqc-admin]
+enabled  = true
+filter   = jqc-admin
+port     = http,https
+logpath  = /home/jqc/jqc_features/logs/auth.log
+maxretry = 5
+findtime = 600
+bantime  = 3600
+# Optional: escalate repeat offenders (uncomment if using fail2ban >= 0.11)
+# bantime.increment = true