renekreijveld/jfail2ban
Watch
1
0
Fork
You've already forked jfail2ban
 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions
7 releases 7 tags
  • v1.0.0 d9646ccc63

    Release v1.0.0 Stable

    renekreijveld released this 2026-11-12 14:15:22 +00:00 | 22 commits to main since this release

    The first release of Fail2ban for Joomla: a Joomla 5/6 package that logs failed login attempts in the administrator to a file, so fail2ban can block the IP address of a brute-force attack.

    2026-11-12 13:45:02 +01:00 LOGINFAIL ip=1.2.3.4 user=admin
2026-11-12 13:45:09 +01:00 MFAFAIL ip=1.2.3.4 user=admin

    What it does

    • Logs a wrong password or unknown user (LOGINFAIL), and a correct password for a blocked or expired account.
    • Logs a wrong Multi-factor Authentication code (MFAFAIL), also after the MFA try limit has been reached.
    • Only logs the administrator; failed logins on the frontend are ignored.
    • Takes the IP address from Joomla, which only trusts X-Forwarded-For when Behind Load Balancer is enabled, so the address cannot be spoofed.
    • Writes the username in a safe form (no newlines, spaces or other characters that could forge a log line) and the time with its UTC offset.
    • Writes to logs/joomla-fail2ban.log one level above the Joomla root (outside the webroot) by default; the path is configurable. The folder is created when needed and a write error never blocks a login.

    Contents

    • plg_user_fail2ban: writes the log lines and holds the settings.
    • plg_system_fail2ban: a small helper that makes logging of wrong MFA codes possible (Joomla does not load user plugins in that request).
    • Both plugins are enabled on installation. Language files in English and Dutch.

    The repository also contains a fail2ban filter and jail, a logrotate example and installation instructions in the README.

    Note

    This version has no update server yet. Install v1.1.0 or newer: from that version on, Joomla shows new releases under System → Update → Extensions.

    Changed

    • Add Joomla fail2ban package for failed administrator logins
    Downloads