Update: I edited this and added a fail2ban tag. Perhaps that might be another way to handle this issue.
I'm running phpbb 3.0.13-PL1 and I would like to protect the login page from bruteforcing. I'm wondering if anyone can tell me what php page to place under LocationMatch. It appears that ucp.php?mode=login is the login page, but that's also the user control panel and I don't want to accidentally lock people out of a core function of the forum. Does anyone know the correct php page to use for LocationMatch? Also is the RESPONSE_STATUS correct for PHPBB? The code below should ban users if there are 10 PHPBB failed login attempts in 3 minutes.
/etc/modsecurity/modsecurity_custom_rules.conf:
# PHPBB Bruteforce Protection
SecDataDir /tmp
SecAuditLogType Concurrent
SecAction phase:1,nolog,pass,initcol:ip=%{REMOTE_ADDR},initcol:user=% {REMOTE_ADDR},id:500 0134
<LocationMatch "ucp.php?mode=login">
# Setup brute force detection.
# React if block flag has been set.
SecRule user:bf_block "@gt 0" "deny,status:401,log,auditlog,msg:'10 PHPBB failed login attempts in 3 minutes.',severity:'2',id:5000135,tag:'PHPBB/BRUTEFORCE'"
# Setup Tracking. On a successful login, a 302 redirect is performed, a 200 indicates login failed.
SecRule RESPONSE_STATUS "^302" "phase:5,t:none,nolog,pass,setvar:ip.bf_counter=0,id:5000136"
SecRule RESPONSE_STATUS "^200" "phase:5,chain,t:none,nolog,pass,setvar:ip.bf_counter=+1,deprecatevar:ip.bf_cou nter=1/180,id:5000137"
SecRule ip:bf_counter "@gt 10" "t:none,setvar:user.bf_block=1,expirevar:user.bf_block=300,setvar:ip.bf_counter =0"
If this helps here is my mod_security version information:
[notice] ModSecurity for Apache/2.6.6 (http://www.modsecurity.org/) configured.
[notice] ModSecurity: APR compiled version="1.4.6"; loaded version="1.4.6"
[notice] ModSecurity: PCRE compiled version="8.30"; loaded version="8.30 2012-02-04"
[notice] ModSecurity: LUA compiled version="Lua 5.1"
[notice] ModSecurity: LIBXML compiled version="2.8.0"
