Case: Log-Driven Banning Blocked 5,300 IPs in Week One

Case: Log-Driven Banning Blocked 5,300 IPs in Week One
A WAF-less origin server was eating brute-force across SSH, wp-login.php, and xmlrpc.php.

Log-driven ban SOP:

— Step 1: Point fail2ban at three logs: auth.log, the nginx access log, and the WordPress login log.
— Step 2: WordPress jail: 5 failed logins in 10 min = 1-hour ban.
— Step 3: xmlrpc jail: any POST /xmlrpc.php matched against a malicious-UA list = 24-hour ban.
— Step 4: Set bantime.increment = true so repeat offenders escalate to a week.
— Step 5: After 7 days, pull fail2ban-client status for each jail.

Outcome: 5,300 distinct IPs banned in week one across jails. CPU load average dropped from 3.1 to 0.7. Brute-force noise in logs fell ~88%, surfacing the real anomalies.

Run this every time.