So, since my wp-login guide seems to have helped a few out there, I’ve modified it to work for Magento’s Admin panel. This guide assumes use of Apache and CentOS.
Install fail2ban if it is not installed already, then add this configuration file:
/etc/fail2ban/filter.d/magento-admin.conf
and these contents:
[Definition]
failregex = ^<HOST> -.*POST \/index.php\/admin\/.*
ignoreregex =
Append or add this file:
/etc/fail2ban/jail.conf
and the contents:
[magento-admin]
enabled = true
filter = magento-admin
action = iptables-multiport[name=NoAuthFailures, port=”https,https”]
logpath = /var/log/httpd/*access*.log
findtime = 60
bantime = 86400
maxretry = 3
fail2ban uses the sites access logs to check. This is set up to check all access logs in the /var/log/httpd folder. Adjust this rule based on your server’s log location and configuration (not the wildcard *).
Finally restart fail2ban
service fail2ban restart
or
systemctl restart fail2ban
Thor swings that ban hammer!