CSF Setup Fail2ban jail for Xenforo

Setup:

• CentOS Version: CentOS 7
• Centmin Mod Version Installed: 123.09beta01
• Nginx Version Installed: 1.19.10
• PHP Version Installed: 7.4.16
• MariaDB MySQL Version Installed: 10.4.18

Trying to use fail2ban in combination with CF Firewall to block the /install and /admin.php of Xenforo.

Tried to make custom jails like
failregex = <HOST>.*] "POST /install/index.php?upgrade
failregex = <HOST>.*] "POST /admin.php

---

Tested some more and came up with this:
Vhost conf:

Code:

location ~* /(admin\.php) {
    limit_req zone=xfadminlogin burst=1 nodelay;
}

location ~* /(/install/index\.php) {
    limit_req zone=xfinstalllogin burst=1 nodelay;
}

jail.local file:

Code:

[xenforo]
enabled = true
filter = xenforo
#action = csfdeny[name=xenforo]
action   = cloudflare
#action   = cloudflaretoken
logpath = /home/nginx/domains/*/log/access.log
port = http,https
bantime = 3600
maxretry = 5
findtime = 60

[xenforo-main]
enabled = true
filter = xenforo-main
#action = csfdeny[name=xenforo-main]
action   = cloudflare
#action   = cloudflaretoken
logpath = /home/nginx/domains/*/log/access.log
port = http,https
bantime = 3600
maxretry = 5
findtime = 60

xenforo.conf filter:

Code:

[Definition]
# /install/index.php?upgrade
failregex = <HOST>.*] "POST /install/index.php?upgrade
ignoreregex =

xenforo-main.conf filter:

Code:

[Definition]
# /admin.php
failregex = <HOST>.*] "POST /admin.php
ignoreregex =

cfuser and cftoken (global CF API key) are present in the cloudflare.conf file

Does this look okay?

 

I tested Cloudflare Access protection before, also used it for /install now. Thanks for the heads up

PS. Donated, it was long overdue.