このサイトではスパムコメント対策にプラグインのAkismet Anti-SpamとFast Secure reCAPTCHAを導入しています｡
Akismet
https://ja.wordpress.org/plugins/akismet/
Fast Secure reCAPTCHA
https://ja.wordpress.org/plugins/fast-secure-recaptcha/
Fast Secure reCAPTCHAを導入すると直接wp-comments-post.phpを操作してコメントを投げつけるものについては500(Internal Server Error)を返しています｡
|
1 2 3 |
46.166.186.227 - - [29/May/2017:15:17:49 +0900] "POST /wp-comments-post.php HTTP/1.1" 500 4894 "https://www.rootlinks.net/2016/01/22/apache-mysql-php%e3%81%ae%e3%83%90%e3%83%bc%e3%82%b8%e3%83%a7%e3%83%b3%e7%a2%ba%e8%aa%8d/" "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:34.0) Gecko/20100101 Firefox/34.0" 46.166.186.227 - - [29/May/2017:15:17:51 +0900] "POST /wp-comments-post.php HTTP/1.1" 500 4894 "https://www.rootlinks.net/2016/01/22/apache-mysql-php%e3%81%ae%e3%83%90%e3%83%bc%e3%82%b8%e3%83%a7%e3%83%b3%e7%a2%ba%e8%aa%8d/" "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:34.0) Gecko/20100101 Firefox/34.0" 46.166.186.227 - - [29/May/2017:15:17:54 +0900] "POST /wp-comments-post.php HTTP/1.1" 500 4894 "https://www.rootlinks.net/2016/01/22/apache-mysql-php%e3%81%ae%e3%83%90%e3%83%bc%e3%82%b8%e3%83%a7%e3%83%b3%e7%a2%ba%e8%aa%8d/" "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:34.0) Gecko/20100101 Firefox/34.0" |
スクリプトで連投しているので､これをfail2banでブロックするようにしました｡
- フィルタの作成
- jail.local設定
- fail2ban reload
フィルタ(/etc/fail2ban/filter.d/apache-spamcomment.conf)を作成します｡
|
1 2 3 4 |
[Definition] failregex = ^<HOST>\ \-.*\"POST\ \/wp-comments-post.php HTTP\/1\..\" 500 * ignoreregex = |
|
1 2 3 4 5 6 7 |
[apache-spamcomment] enabled = true port = http,https bantime = 604800 findtime = 180 maxretry = 1 logpath = %(apache_access_log)s |
|
1 |
# systemctl reload fail2ban.service |
数日経過して確認すると197IPをbanしています｡
|
1 2 3 4 5 6 7 8 9 10 |
# fail2ban-client status apache-spamcomment Status for the jail: apache-spamcomment |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- File list: /var/log/httpd/access_log /var/log/httpd/ssl_access_log `- Actions |- Currently banned: 197 |- Total banned: 197 `- Banned IP list: 1.214.69.66 ................................................. |
ちなみにコメント欄からreCAPTCHA認証を経由すると302で正常にポストできます｡
|
1 |
xxx.xxx.xxx.xxx - - [29/May/2017:15:39:18 +0900] "POST /wp-comments-post.php HTTP/1.1" 302 - "https://www.rootlinks.net/2009/10/16/hello-world/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; InfoPath.2; .NET4.0E)" |