The es-phpBB module was developed by Extra Systems to protect phpBB forums from hacker activity within the fail2ban system. Its core functionality is to detect specific suspicious activity in the /var/log/nginx/access.log file.
Connecting es-phpBB to fail2ban is done in the following way:
[es-phpBB] enabled = true filter = es-phpBB logpath = /var/log/nginx/access.log action = iptables-allports[name=es-phpBB, blocktype=DROP, protocol=all]
Please note that this filter blocks all protocols on all ports for the identified hacker, using the DROP method. This turns your host into a complete "black hole" for this particular attacker. They will not receive any response to any subsequent IP packets. This approach significantly reduces the load on your server's resources.
Our es-phpBB filter code looks like this:
[Definition]
failregex = ^<HOST> - - \[.*\] "POST /ucp\.php\?mode=register HTTP/\d\.\d" 200
^<HOST> - - \[.*\] "GET /viewtopic\.php\?(p|f)=\d+&sid=[0-9a-f]{32} HTTP/1\.1" 200
ignoreregex =
This filter is based on the fact that phpBB returns a 200 status code in the event of an unsuccessful registration (it sounds paradoxical, but this is a well-established fact). Its use will be especially effective when combined with the activation of security questions in the registration module on the phpBB forum. Spambots have now become adept at overcoming standard captchas, but they typically have significant problems answering tricky questions. In this case, our es-phpBB filter will very effectively block spambot attempts to guess answers to your questions, thereby reliably preventing their registration.
The second line of this filter is designed to block malicious activity from aggressive scanners that tend to systematically overload the web server (which hosts the phpBB forum) with a huge number of meaningless requests (by randomly changing the "sid" parameter). An example of such an attack can be seen here:
47.82.15.120 - - [24/May/2026:15:47:11 +0300] "GET /viewtopic.php?p=61&sid=9357550dc1804e4629dcdd8fdc5229d7 HTTP/1.1" 200 14935 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" 47.79.10.195 - - [24/May/2026:15:47:11 +0300] "GET /viewtopic.php?p=61&sid=f89c4ad7fc85b59f78a2c78043b842dc HTTP/1.1" 200 14962 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" 47.79.10.99 - - [24/May/2026:15:47:14 +0300] "GET /viewtopic.php?p=53&sid=aaacadec1873954e5a2e1ebaf81b6315 HTTP/1.1" 200 14938 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" 47.82.15.173 - - [24/May/2026:15:47:15 +0300] "GET /viewtopic.php?p=63&sid=f3632071a6b466a7104eb420dcd50078 HTTP/1.1" 200 14935 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" 47.82.13.56 - - [24/May/2026:15:47:15 +0300] "GET /viewtopic.php?p=55&sid=0c4d064c98f5962022c898762277d70d HTTP/1.1" 200 14934 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" 47.82.14.132 - - [24/May/2026:15:48:15 +0300] "GET /viewtopic.php?p=62&sid=2effa27b4f7dad2e53c162fc59056615 HTTP/1.1" 200 14939 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" 47.82.15.152 - - [24/May/2026:15:48:15 +0300] "GET /viewtopic.php?p=61&sid=e6f077186f4758f9834cfb8a5ebce0fb HTTP/1.1" 200 14957 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" 47.79.10.62 - - [24/May/2026:15:48:15 +0300] "GET /viewtopic.php?p=63&sid=967d58cdb32f00aaffe0e1c17a322b9c HTTP/1.1" 200 14956 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" 47.79.51.121 - - [24/May/2026:15:49:11 +0300] "GET /viewtopic.php?p=62&sid=5200c15f19374eb46fdef9abf2a55e7d HTTP/1.1" 200 14926 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
It goes without saying that for this filter to work properly (to avoid blocking legitimate search engines), you must have a corresponding robots.txt file on your site. For example, ours currently looks like this:
User-Agent: * Disallow: /adm/ Disallow: /app.php Disallow: /common.php Disallow: /cron.php Disallow: /download/ Disallow: /ext/ Disallow: /faq.php Disallow: /feed.php Disallow: /mcp.php Disallow: /memberlist.php Disallow: /notification.php Disallow: /posting.php Disallow: /report.php Disallow: /search.php Disallow: /styles/ Disallow: /ucp.php Disallow: /viewonline.php Disallow: /*&sid= Disallow: /*?sid= Disallow: /*&p= Disallow: /*?p= Disallow: /*view=print
Note these key lines here:
Disallow: /*&sid= Disallow: /*?sid= Disallow: /*&p= Disallow: /*?p=
It's easy to see that they clearly communicate to all legitimate search engines that addresses like
/viewtopic.php?p=63&sid=967d58cdb32f00aaffe0e1c17a322b9c
should not be requested from our server for indexing. Thus, our filter ultimately blocks exclusively hacker activity, not legal activity.
In addition, it is highly desirable (for effective indexing of your forum content on phpBB by legal search engines) to have a properly formed sitemap on your site (in the form of sitemap.txt or sitemap.xml).
In practical use on our Linux servers, this filter has proven to be very effective in suppressing hacker and spammer activity on forums created on the phpBB platform.
The content of this page is also available in Russian.
| © Extra Systems, 2026 |
|