2

I have a Magento 1.9.2 system that is currently undergoing a brute force attack against its xml-rpc endpoint from an EC2 host.

I can simply firewall the source address but that is a short term solution, since it will likely face another attack from a different address. I would like to be able to detect these attacks automatically to lock them down.

Fail2ban is commonly used under such circumstances but in order for it to work, I understand that it must be able to find login failure messages in a log file somewhere, however Magento does not seem to be logging the failed attempts.

How can I prevent the xml-rpc endpoint being brute forced?

54.246.87.74 - - [20/Jul/2015:13:10:24 +0000] "POST /index.php/api/xmlrpc/ HTTP/1.1" 200 777 "-" "XML-RPC.NET"
54.246.87.74 - - [20/Jul/2015:13:10:24 +0000] "POST /index.php/api/xmlrpc/ HTTP/1.1" 200 777 "-" "XML-RPC.NET"
54.246.87.74 - - [20/Jul/2015:13:10:25 +0000] "POST /index.php/api/xmlrpc/ HTTP/1.1" 200 777 "-" "XML-RPC.NET"
54.246.87.74 - - [20/Jul/2015:13:10:26 +0000] "POST /index.php/api/xmlrpc/ HTTP/1.1" 200 777 "-" "XML-RPC.NET"
54.246.87.74 - - [20/Jul/2015:13:10:27 +0000] "POST /index.php/api/xmlrpc/ HTTP/1.1" 200 777 "-" "XML-RPC.NET"

Action taken so far

I've configured fail2ban with a new filter and jail to lock it down but I still don't know if this is the best solution.

filter.d/magento-xmlrpc.conf

[Definition]
failregex = ^<HOST> .*POST .*api\/xmlrpc\/
ignoreregex =

jail.local

[magento-xmlrpc]

enabled     = true
port        = http,https
filter      = magento-xmlrpc
logpath     = /home/user/logs/access.log
maxretry    = 20
findtime    = 30
bantime     = 600
Kebian
  • 664
  • 6
  • 17
  • Do you have many legitimate users of the API? If not then create a whitelist for it instead. – clockworkgeek Jul 20 '15 at 14:25
  • @clockworkgeek We have one legitimate user. Is there a way to whitelist IPs in Magento, or does it have to be done with iptables? – Kebian Jul 20 '15 at 15:18
  • 1
    Actually I was thinking of doing it in `.htaccess` like [this answer](http://stackoverflow.com/a/3604605/471559). – clockworkgeek Jul 20 '15 at 16:54

0 Answers0