Slightly extended Fail2Ban integration

  • turbodb

    (@turbodb)


    21 hours, 5 minutes ago

    I’ve recently started to take advantage of the Fail2Ban integration (via log file) and I think it’s super cool that you’ve got that (for the few of us that might use it).

    One thing that would make it even better for me is a bit more info in the log file. Specifically, I’d like to create different jails based on why the message was flagged as spam. In fact, I want to follow a similar pattern to the existing Antispam Bee documentation – if a message is flagged due to the honeypot, make the Fail2Ban jail longer than if the message is flagged due to content (for example).

    This should be as simple as adding a bit more info (flag reason or some such) to each line in the log file. Of course, I’m not sure if the impact on back-compat, so perhaps it also needs a setting – either in the UI or wp-config, to support the new information.

    Possible?

    Thanks for a great product!

    The page I need help with: [log in to see the link]

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Author Bernhard Kau

    (@kau-boy)

    20 hours, 11 minutes ago

    Thanks, that’s a neat idea, combining the ASB log with fail2ban. Would you mind sharing your configuration?

    In terms of extending the log: we are currently actively working on the new version 3, which is a complete rewrite of the plugin. All the rules still exist, but the logging will be more verbose. I can’t answer from the top of my head if it includes the information you’ll need, but maybe you can test our beta.1 and check if it works for you or file an issue/PR with what you would need.

    You can find the beta here: https://github.com/pluginkollektiv/antispam-bee/releases/tag/3.0.0-beta.1

    • This reply was modified 20 hours, 10 minutes ago by Bernhard Kau.
    Thread Starter turbodb

    (@turbodb)

    19 hours, 57 minutes ago

    I was under the impression that there was already F2B integration from this documentation

    https://antispambee.pluginkollektiv.org/documentation/#fail2ban

    I currently have fail2ban setup to monitor that log file (which I specify in my wp-config), and as lines are added, I use these rules to add IPs to jail:

    • Two spam detections from one IP within 24 hours trigger a 24-hour ban.
    • Supports validated IPv4 and IPv6 addresses.
    • Remains harmlessly idle when Antispam Bee is absent (no log entries are created)

    I only added this earlier today, and my log so far has two lines in it:

    2026-08-07 14:54:53 comment for post=474 from host=148.222.185.43 marked as spam
    2026-08-07 14:56:03 comment for post=6792 from host=178.20.47.39 marked as spam

    Ideally, this log file would provide more information and/or be more structured. Perhaps a CSV:

    Datetime, ObjectType, Object ID, Post ID, IP Address, Reason 

    2026-08-07 14:54:53, Comment, 12343, 474, 148.222.185.43, honeypot
    2026-08-07 14:56:03, Comment, 12344, 6792, 178.20.47.39, content

    Or a machine readable format like:

    2026-08-07T12:34:56Z ASB_SPAM_V1 ip=198.51.100.40 objecttype=comment objectid=12322 post=123  reasons=asb-honeypot,asb-regexp

    But even just adding more info to the existing log file (that I could parse) would be fine:

    2026-08-07 14:54:53 comment for post=474 from host=148.222.185.43 marked as spam (honeypot)
    2026-08-07 14:56:03 comment for post=6792 from host=178.20.47.39 marked as spam (content)

    Does that make sense?

    I’ll take a closer look at v3 b1 as well, thanks!

    • This reply was modified 19 hours, 45 minutes ago by turbodb.
    Thread Starter turbodb

    (@turbodb)

    19 hours, 43 minutes ago

    I took a look at v3b1 and the new antispam_bee_post_processors look interesting and I could probably use them to achieve what I want.

    However, having ASB log the additional metadata about spam objects seems like a more straight-forward, higher performance, lower maintenance option. So, I’d very much appreciate seeing this end up in v3. (It looks like there isn’t currently more info in the log in v3.)

    How long before v3 is released? I probably wouldn’t install a beta on our production servers.

    • This reply was modified 19 hours, 42 minutes ago by turbodb.
    Plugin Author Bernhard Kau

    (@kau-boy)

    19 hours, 38 minutes ago

    I didn’t know we had this on the documentation page. 🙈😅

    Then I assume v3 could add the reasons as well, since they are really useful. ASB v3 will even detect multiple reasons, unless one of those is marked as “final”.

    I already have an idea on how to implement this. It might land in beta.2 already, which I might be able to finish over the weekend.

Viewing 4 replies - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.

Tags